6

Proper management of an application's secrets has always been a challenge. New challenges came with the adoption of the cloud. There's a great OWASP presentation about the reality and challenges of storing secrets in the cloud. You might be surprised to hear that storing secrets into the source code is one of the solution (or "architecture") presented. That'...


5

Here's an example of using them in a pipeline safely. In this case, they are injected as environment variables and their value should never have to be shown unless you explicitly choose to print out the variable content for some reason or other. Environment variables are generally seen as the best way to store secrets at this point and are heavily relied ...


3

For a purely EC2-based environment, the easiest solution is to use AWS IAM roles and S3 bucket policies. Some formulations of this pattern also include KMS for encryption and DynamoDB instead of S3 for storage but I've not found a hugely compelling reason to use either. Check out https://github.com/poise/citadel, it is specifically aimed at Chef users but ...


2

Start by reading this: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html Those are best-practices and do not take into account business policies. I don't think having one account per region is more secure than having policies scoped by regions. In cli, you will have to specify the region in the command anyway (not sure if AWS cli uses a ...


1

withCredentials publish environment variables, and in sh to access the environment variables, you have to do it like this: "${env.JOB_BASE_NAME}". Try this: withCredentials([usernamePassword(credentialsId: params.git_credential, passwordVariable: 'DOCKER_PASSWORD', usernameVariable: 'DOCKER_USERNAME')]) { sh 'git reset --hard; git clone https://$...


1

You need to provide more information about the technology stack. In a nutshell, you would mix the responsibilities of the host, taking care for the gitlab runnner + credential store is not a good design practice. If the host goes down, you are loosing 2 essential services, instead of just one. Most likely you would have other consumers of the store. Also ...


1

You could use the git credentials.helper feature https://git-scm.com/docs/gitcredentials


1

First How to check Check certificate expiration You can use the kubeadm alpha certs check-expiration command to check when certificates expire on a given cluster. Simplest remedy : you can choose to upgrade the control plance which will renew the certs and then you are good and secure as before loosing your laptop. Automatic certificate renewal Note : ...


Only top voted, non community-wiki answers of a minimum length are eligible