Questions tagged [secret-management]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
37 views

Best practices of authentication to Vault

What could be considered the most secure way of authenticating in HashiCorp Vault by an application running in a Kubernetes cluster? The AppRole method is nice, but implementing AppRole implies that ...
Volodymyr Melnyk's user avatar
0 votes
0 answers
9 views

How to retain `docker secret`s after restarting a single node swarm without values stored in plain text on file system?

I am trying to learn docker secret. I will use Docker Swarm and only have a maximum of 1 node in the cluster. I ran these commands: docker swarm init; printf "test123" | docker secret ...
learningtech's user avatar
0 votes
1 answer
35 views

How can I easily leak secrets and read the value with GitHub Actions?

GitHub actions seems to block out both the secret, and the base64 dump of the secret. Is there any easy way to dump all of secrets, or a list of secrets, from GitHub Actions? I need to be able to read ...
Evan Carroll's user avatar
  • 2,089
0 votes
1 answer
34 views

How can you retrieve (read) GitHub secrets without invoking CI?

Github has a functionality called "Secrets" made for GitHub Actions (which is their CI). These secrets are easy to read from the CI. You can do it like this, env: # Or as an environment ...
Evan Carroll's user avatar
  • 2,089
0 votes
0 answers
58 views

How to sync External Secrets on an AKS Cluster with an Azure Key Vault?

I'm trying to integrate AKS with Key Vault using the External Secrets operator. I've set up the operator itself using the Helm chart, and I've created a SecretStore resource pointed at a Vault (we'll ...
Ryan Draga's user avatar
0 votes
0 answers
13 views

How to enter \ character in terraform?

I have resource "aws_secretsmanager_secret" "mcasz2" { name = "mcasz/client/credentials" description = "mcasz 2.0 secretes for back-end" } resource "...
Vy Do's user avatar
  • 163
1 vote
1 answer
112 views

How do I get a secret into a property file with openshift and kubernetes?

I am new to openshift and kubernetes. I have a secret in openshift and made it avaliable to the pod as an environment variable. What is the best practice to get that value into a properies file (java) ...
Nifle's user avatar
  • 113
0 votes
0 answers
10 views

Concourse Pipeline Not Retrieving Configuration Values from AWS Secrets Manager

I'm experiencing an issue where my Concourse pipeline isn't picking up configuration values from AWS Secrets Manager. I have set everything up according to the documentation, ensured the necessary IAM ...
Vizeet Srivastava's user avatar
0 votes
0 answers
64 views

Secrets Scanning for Atlassian Bitbucket

I am looking for: A plugin on Atlassian Bitbucket which would help us run scan on entire code to detect any hardcoded secrets A tool/script which could be run in a pipeline right after the code is ...
Biju's user avatar
  • 255
2 votes
1 answer
452 views

Is it possible to create a tls kubernetes secret using Azure Key Vault data resources in Terraform?

I have a certificate file and a private key file that I am using to implement tls encrypted traffic for several different k8s pods running under an NGINX ingress load balancer. This works fine (i.e. ...
az2tonez's user avatar
1 vote
1 answer
814 views

How to fetch azure secret if exist in KV using terraform

I am using below terraform code for fetch azure secret and this is working fine when secret is exist in the azure KV. Getting error when secret is not available in KV. data "...
Nullpointer's user avatar
0 votes
1 answer
243 views

How can I retrieve a lost login token for KubeApps?

How can I retrieve the root token from a KubeApps deployment?
Evan Carroll's user avatar
  • 2,089
3 votes
2 answers
2k views

How to manage Env Variables / Configs on a Helm Chart + Github Actions + Github Secrets

I have a Rest API in Python that has several Configuration variables that are setup at startup time. This variables are read from the environment variables of the host machine. Our production ...
Pablo Estrada's user avatar
0 votes
0 answers
14 views

Tooling to allow server apps to checkout passwords (database, email provider, etc) on multiple servers?

I'm looking for suggestions on the right kind of tools I can use to improve the security and ease of use for managing passwords for my multi-server apps. I have a couple of ubuntu-based servers ...
Geuis's user avatar
  • 109
1 vote
1 answer
414 views

How can I pass a secret from a Salt Master to a Minion without using a Pillar?

I am looking to understand how I can reduce duplication of secrets. For example SSL Certificates. I want to have the Salt Master pull the Certificate from a Secure Source (Azure Key Vault) and then '...
Steven K7FAQ's user avatar
0 votes
1 answer
167 views

How to deploy static website from public repo via Github Actions to private web server

I like to start an open-source project via Github where topics (markdown pages) can be created from the community. Via PR the changes get merged to the main repo and then it triggers a Github Action ...
Marko A.'s user avatar
4 votes
2 answers
8k views

Secrets in Docker without Swarm

I am using Docker, but not Swarm (or any other orchestration) for a project. Is there a way to leverage Docker Secrets without Swarm?
a20z's user avatar
  • 41
2 votes
1 answer
78 views

How to protect secrets whilst enabling the ability to amend a pipeline

I'm writing a CI pipeline using GitHub Actions. The pipeline will build a Docker image, which it will then push to our Docker repository (AWS ECR). In order to talk to ECR, we'll need to provide a ...
JohnLBevan's user avatar
13 votes
1 answer
5k views

Should AWS arn values be treated as secrets?

I have a configuration file that contains AWS resource ARNs stored in a git repo. This includes some ARNs of AWS IAM role resources. Should these be treated as if they are a secret value, and not ...
Preston Martin's user avatar
  • 3,278
2 votes
2 answers
86 views

Terraform's local state (the 2 tfstate files) contain very sensitive info

Part of my IaC that describes my systems for Azure is CosmosDB, and Keyvaults. Terraform happily created everything and I was able to use an output from CosmosDB (db keys) as an input to the Keyvault ...
Optical Carrier's user avatar
2 votes
1 answer
146 views

Recommended Design - Communication among Jenkins + Vault + App

Design A: CD tool communicate with Vault to fetch App secrets on its behalf Jenkins ( CD tool ) computes the Vault path according to the app/project & according to which environment the app will ...
Abdennour TOUMI's user avatar
1 vote
1 answer
81 views

How to manage Hashicorp Vault patching in AWS?

I'm setting up a Hashicorp Vault open source deployment in AWS, but I'm trying to figure out the best approach for keeping the underlying EC2 instances patched. I'm using AWS Systems Manager for ...
Prime's user avatar
  • 111
1 vote
2 answers
716 views

How to handle different credentials in continuous integration?

I am using teamcity to automatically build and test a nodejs application. The problem I am facing is that the application needs to have some environment variables set during the build phase, as well ...
Cyclonecode's user avatar
5 votes
1 answer
566 views

Jenkins: make a credential available to all users

I'd like to allow all of our organization's users to create new pipelines in Jenkins, via Blue Ocean... This requires a Github access token, meaning I have to either require each user to use their ...
ivan's user avatar
  • 151
50 votes
2 answers
52k views

Passing secrets to a Docker container

I have a base docker image which is used to run image analysis software. For each container created from the image, there are a set of configuration settings, some of which are secrets (encryption ...
Preston Martin's user avatar
  • 3,278