Skip to main content
43 votes
Accepted

Passing secrets to a Docker container

You have 3 methods to get secrets to an app inside a docker container. The first 2 involve docker configuration. The last one is to have your apps directly fetch secrets from a secret store. 1 - ...
BoomShadow's user avatar
  • 1,472
15 votes
Accepted

Should AWS arn values be treated as secrets?

Well, from a security point of view, it's never bad to give people less information. But, as long as you have sensible security policies in AWS, there is no reason that an arn has to be considered ...
John Humphreys's user avatar
4 votes

Passing secrets to a Docker container

There is another option only using pipe: docker run -d -i --name $n alpine sh -c 'read A; echo "[$A]"; exec some-server' docker exec -i $n sh -c 'cat > /proc/1/fd/0' <<< _a_secret_ First,...
James Z.M. Gao's user avatar
3 votes
Accepted

Terraform's local state (the 2 tfstate files) contain very sensitive info

Do not store your state in anything besides remote backend. Even if you store it in a remote backend the secrets will appear in a plain text again, this is an ongoing Terraform limitation. In our ...
Recoba20's user avatar
  • 642
1 vote

Best practices of authentication to Vault

The key factor here is that the credential that you use to authenticate to Vault should be short-lived. So in case it gets stolen the attacker will have only a very limited time to use it. Of all the ...
Vasilii Angapov's user avatar
1 vote
Accepted

How do I get a secret into a property file with openshift and kubernetes?

There are two ways you can manage this : Like you said, make the secret data available trough environnement variables and run sed or envsubst on the file before startup. Or, you could create a secret ...
ABWassim's user avatar
  • 126
1 vote
Accepted

Is it possible to create a tls kubernetes secret using Azure Key Vault data resources in Terraform?

Method #1 from the original post works - the key point I was missing was how I was getting the cert/key into Azure KeyVault. As mentioned in the post, I was copy/pasting the text from the files into ...
az2tonez's user avatar
1 vote

How to fetch azure secret if exist in KV using terraform

This looks like a case for a conditional resource. First, look up the secrets with a data "azurerm_key_vault_secrets" block: data "azurerm_key_vault_secrets" "example" { ...
Bruce Becker's user avatar
  • 3,623
1 vote

How to manage Env Variables / Configs on a Helm Chart + Github Actions + Github Secrets

Here's what I'd try to do: Move the environment variables to .env file, which can be read by the Python application e.g. by python-dotenv and make this file the single source of truth. Depending on ...
David Lukac's user avatar
1 vote

How to manage Env Variables / Configs on a Helm Chart + Github Actions + Github Secrets

The process itself looks fine to me, what I would do is: Add a test in the last step that runs helm template on a few targets that may get this parameter, to verify it is not failing. Add the ...
Avi's user avatar
  • 141
1 vote

How to deploy static website from public repo via Github Actions to private web server

By coincidence, I have found a possible solution via Github Secrets.
Marko A.'s user avatar
1 vote
Accepted

How to protect secrets whilst enabling the ability to amend a pipeline

Developers or even admins of your GitHub repository wouldn't be able to see secrets configured there by default. Even if you debug GitHub Actions workflows and accidentally log secrets, GitHub would ...
taleodor's user avatar
  • 900
1 vote
Accepted

Recommended Design - Communication among Jenkins + Vault + App

My choice would be design B. It's true that the availability of the Vault would be crucial, but Jenkins' availability would similarly be crucial in design A. So from this perspective the decision ...
Dan Cornilescu's user avatar
1 vote

How to handle different credentials in continuous integration?

I'm not familiar with teamcity, but you can : add a config folder in your repo, and inside this repo create three files (staging.yml, preprod.yml, prod.yml). on each file you will write down ...
zidosni's user avatar
  • 11
1 vote

Jenkins: make a credential available to all users

I was a little confused by the OP question and follow up, so answering about GitHub access to jenkinsfile-based pipeline jobs: Credentials stored in Jenkins can be available to all users with rights ...
John Fisher's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible