0

I am looking for a way to provide secrets to a container running on Google Cloud Run responding to the following criteria:

  • secure
  • centralized & pulled based
  • free
  • simple
  • working with a team, with various trust scopes
  • host agnostic: changing 1 config will be the same on aws, gcp, azure

When starting a new project with containers, I always come to the point where I need to manage secrets, and I often find it difficult. My current solution is to store my secrets encrypted on a public git repository, and decrypt them inside the container, in the entry point script.

But I don't like so much installing gpg along with Django and it's dependencies. I am now thinking of running another container on the same network, which sole responsibility will be serving the config to the first container.

Is it secure ? Is there a better way ?

1

There is probably a better way if you are working with Google Cloud Run. I have not tried this but I see that they have "Secret Manager" that you can use. They also mention a project Berglas that can be used to store secrets in GCS cloud storage.

In my personal experience, it find it best to leverage widely adopted solutions and avoid creating a unique solution for security. Getting it right is non trivial and it is less code you have to support.

This FAQ has doc links to the solutions I mentioned. https://github.com/ahmetb/cloud-run-faq#how-to-configure-secrets-for-cloud-run-applications

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.