How to handle different credentials in continuous integration?

Question

I am using teamcity to automatically build and test a nodejs application. The problem I am facing is that the application needs to have some environment variables set during the build phase, as well as some secret variables that need to be set during the actual deployment (this is a manual step). These environment variables should be different depending on where the application should be deployed and I have no idea on how to solve this during the actual build.

I guess one solution would be to set up different builds for different environments such as test, stage and production. Looking into using vault to store my secrets in something like <PROJECTNAME>/<ENVIRONMENT>/secret.

Any ideas on how to solve this problem?

Answer 1

I'm not familiar with teamcity, but you can :

• add a config folder in your repo, and inside this repo
• create three files (staging.yml, preprod.yml, prod.yml).
• on each file you will write down variables specific to each environment, and apply them within pipeline.

For secrets, it's cautious to handle that manually or better use Vault.

To not throw on error your pipeline/pods, set secrets as optional that could help if you want to set them later.

Answer 2

If you are using kubernetes as deployment environment, you could use configmaps and apply them on building your code.