How One Go Binary Brokers SSH, kubectl and RDP Without Handing Out Credentials

A development team spent 18 months building a single Go binary plus PostgreSQL that acts as a credential broker, eliminating the need to distribute SSH keys, kubeconfigs, or database passwords to individual users or machines. Instead of issuing short-lived certificates that require changes to every host's configuration, the broker keeps secrets encrypted in its database and decrypts them in memory only for the duration of each session. When a user requests access, the controller verifies their grant, pulls the relevant credential, and stitches together the client and target connections transparently. The architecture means all session traffic passes through the controller twice, doubling bandwidth usage on its network interface — a known cost the team openly acknowledges. RDP is the one exception where the credential must reach the client due to NLA protocol constraints, though the team ensures it is never written to disk or displayed in the UI.