40
votes
Accepted
Passing secrets to a Docker container
You have 3 methods to get secrets to an app inside a docker container. The first 2 involve docker configuration. The last one is to have your apps directly fetch secrets from a secret store.
1 - ...
- 1,402
12
votes
Accepted
Should AWS arn values be treated as secrets?
Well, from a security point of view, it's never bad to give people less information.
But, as long as you have sensible security policies in AWS, there is no reason that an arn has to be considered ...
- 1,430
3
votes
Accepted
Terraform's local state (the 2 tfstate files) contain very sensitive info
Do not store your state in anything besides remote backend. Even if you store it in a remote backend the secrets will appear in a plain text again, this is an ongoing Terraform limitation.
In our ...
- 614
1
vote
Accepted
How to protect secrets whilst enabling the ability to amend a pipeline
Developers or even admins of your GitHub repository wouldn't be able to see secrets configured there by default. Even if you debug GitHub Actions workflows and accidentally log secrets, GitHub would ...
- 792
1
vote
How to fetch azure secret if exist in KV using terraform
This looks like a case for a conditional resource.
First, look up the secrets with a data "azurerm_key_vault_secrets" block:
data "azurerm_key_vault_secrets" "example" {
...
- 3,295
1
vote
How to manage Env Variables / Configs on a Helm Chart + Github Actions + Github Secrets
Here's what I'd try to do:
Move the environment variables to .env file, which can be read by the Python application e.g. by python-dotenv and make this file the single source of truth. Depending on ...
- 146
1
vote
How to manage Env Variables / Configs on a Helm Chart + Github Actions + Github Secrets
The process itself looks fine to me, what I would do is:
Add a test in the last step that runs helm template on a few targets that may get this parameter, to verify it is not failing.
Add the ...
- 141
1
vote
How to deploy static website from public repo via Github Actions to private web server
By coincidence, I have found a possible solution via Github Secrets.
- 11
1
vote
Accepted
Recommended Design - Communication among Jenkins + Vault + App
My choice would be design B.
It's true that the availability of the Vault would be crucial, but Jenkins' availability would similarly be crucial in design A. So from this perspective the decision ...
- 6,672
1
vote
How to handle different credentials in continuous integration?
I'm not familiar with teamcity, but you can :
add a config folder in your repo, and inside this repo
create three files (staging.yml, preprod.yml, prod.yml).
on each file you will write down ...
- 11
1
vote
Jenkins: make a credential available to all users
I was a little confused by the OP question and follow up, so answering about GitHub access to jenkinsfile-based pipeline jobs:
Credentials stored in Jenkins can be available to all users with rights ...
- 111
1
vote
Passing secrets to a Docker container
There is another option only using pipe:
docker run -d -i --name $n alpine sh -c 'read A; echo "[$A]"; exec some-server'
docker exec -i $n sh -c 'cat > /proc/1/fd/0' <<< _a_secret_
First,...
- 111
Only top scored, non community-wiki answers of a minimum length are eligible