Skip to content

Bridges

A Bridge is a persistent on-premises agent that caches assigned Lockers in memory and serves secrets to local systems without requiring a live connection to the Zaita platform. Bridges are well-suited for environments where:

  • High availability is required and brief platform connectivity interruptions should not affect secrets delivery
  • Latency to the platform is a concern
  • Multiple local processes or services need access to the same secrets

The Bridge downloads Locker bundles from the platform, decrypts them using its own rotating cryptographic key, and holds secret values in memory. Values are zeroed from memory on process exit and are never written to disk.

Prerequisite: The Bridge must be registered and running before Lockers can be assigned to it. See CLM Bridges — Setting Up for Bridge registration and deployment instructions.

How Secrets Caching Works

When a Locker is assigned to a Bridge, the Bridge downloads an encrypted copy of the Locker's secrets from the Zaita platform and holds them in memory. This cache is updated automatically when secrets are added or removed.

The Bridge communicates with the platform via periodic heartbeats. When the platform signals that a Locker's contents have changed, the Bridge starts an asynchronous sync to refresh the affected Lockers without blocking its other operations.

For details on the sync process and cache management, see Managing Bridge Caches.

Encryption Model

Each Locker download is encrypted with the Bridge's current public key using the ECDH + AES-256-GCM protocol. The Bridge performs the ECDH locally and decrypts the bundle in memory. The same ephemeral encryption model used for Courier downloads ensures forward secrecy — compromise of one download bundle does not expose others.

The Bridge's key pair rotates automatically every 24 hours. After a rotation, the next Locker sync re-downloads encrypted bundles using the new key.

Memory Safety

Secret values in the Bridge are stored using memory types that zero their contents when dropped. This means:

  • On Bridge shutdown or restart, secret values are not recoverable from process memory.
  • The cache is rebuilt from the platform on each startup.
  • If the Bridge is unable to reach the platform on startup, the cache starts empty and fills as connectivity is restored.

Comparing Delivery Methods

Method Delivery Persistence Requires Platform Connectivity
Bridge In-memory, served to local processes Until Bridge restarts Only for sync; cache remains usable offline
Courier Written to file at scheduled intervals Until file is overwritten Yes, on each run
Workload Direct API call at runtime None (transient) Yes, on each call

For guidance on choosing a delivery method, see Introduction to Secrets Management or Best Practices.

Next Steps