Static vs. Dynamic Secrets: What Are We Really Talking About?#

Why: Secret lifecycle sits next to your identity/workload-identity interests — dynamic, short-lived credentials are the same philosophical ground as SPIFFE-style workload identity, and OpenBao (the open-source Vault fork) is where that ecosystem is heading post-license-change.
What: A definitional and operational deep-dive into what actually counts as a secret, and the static vs. dynamic distinction — whether it's technical, operational, or philosophical — with a live demo of provisioning and rotation behavior (from abstract only).
How: Live demo stack: OpenBao, Keycloak, PostgreSQL, OpenSSH — showing how secrets are provisioned and rotated in practice and what that implies for security and operations.
Where applicable: General conceptual grounding, vendor-neutral in tools (OpenBao rather than Vault proper is itself a signal). More of a clarifying/terminology talk than a novel-technique talk; useful for calibrating how your org talks about secrets, not for new architecture.