Skip to content

Best Practices for Bridges

Choose the Right Delivery Method

Bridges provide in-memory secrets caching — they are most valuable when:

  • Platform connectivity cannot be guaranteed. The Bridge cache continues to serve secrets to local processes even during connectivity interruptions.
  • Many local consumers share the same Locker. A single Bridge cache serves multiple local processes without each making separate API calls.
  • Latency is a concern. Local memory access is faster than a round-trip to the platform API.

When the application already has reliable connectivity and only one process needs a secret, a Workload or Courier may be simpler.

Question Suggests
Does the host have reliable internet connectivity? Courier or Workload may suffice
Do multiple local processes need the same secrets? Bridge
Is secrets availability required during connectivity outages? Bridge
Is the consuming application a cloud-native service? Workload

High Availability

For environments where secrets availability is critical, deploy each Bridge with at least two instances. If the primary instance stops heartbeating for more than 5 minutes, another instance automatically promotes to primary and continues syncing.

See CLM Bridges — Best Practices for full HA deployment guidance.

Assign Only the Lockers a Bridge Needs

A Bridge that caches many Lockers holds more secret material in memory. Scope assignments carefully — assign only the Lockers that local consumers on that Bridge's network segment actually need.

Review assignments periodically and remove Lockers that are no longer consumed locally.

Segment Bridges by Environment

Deploy separate Bridges for distinct environments (production, staging, development) and network segments. This ensures:

  • A compromised Bridge has access only to the secrets for its own environment.
  • Access control remains clean — production Lockers are not assigned to a Bridge that is also reachable from development hosts.

Protect the Bridge Data Directory

The Bridge's data directory holds its trust token and asymmetric key pair. Restrict read and write access to the Bridge process user only. Do not back up the data directory — if a backup is restored, the Bridge will require re-registration.

Monitor Bridge Connectivity

A Bridge that loses connectivity to the platform will stop refreshing its Locker cache. If secrets are rotated while the Bridge is disconnected, consuming processes will receive stale values until connectivity is restored. Monitor Bridge heartbeat status in the platform's Bridge management page and set up alerting on disconnections.

Next Steps