35 votes
Accepted

Passing secrets to a Docker container

You have 3 methods to get secrets to an app inside a docker container. The first 2 involve docker configuration. The last one is to have your apps directly fetch secrets from a secret store. 1 - ...
user avatar
  • 1,322
10 votes
Accepted

Should AWS arn values be treated as secrets?

Well, from a security point of view, it's never bad to give people less information. But, as long as you have sensible security policies in AWS, there is no reason that an arn has to be considered ...
user avatar
3 votes
Accepted

Terraform's local state (the 2 tfstate files) contain very sensitive info

Do not store your state in anything besides remote backend. Even if you store it in a remote backend the secrets will appear in a plain text again, this is an ongoing Terraform limitation. In our ...
user avatar
  • 604
1 vote

How to deploy static website from public repo via Github Actions to private web server

By coincidence, I have found a possible solution via Github Secrets.
user avatar
1 vote
Accepted

How to protect secrets whilst enabling the ability to amend a pipeline

Developers or even admins of your GitHub repository wouldn't be able to see secrets configured there by default. Even if you debug GitHub Actions workflows and accidentally log secrets, GitHub would ...
user avatar
  • 737
1 vote
Accepted

Recommended Design - Communication among Jenkins + Vault + App

My choice would be design B. It's true that the availability of the Vault would be crucial, but Jenkins' availability would similarly be crucial in design A. So from this perspective the decision ...
user avatar
1 vote

How to handle different credentials in continuous integration?

I'm not familiar with teamcity, but you can : add a config folder in your repo, and inside this repo create three files (staging.yml, preprod.yml, prod.yml). on each file you will write down ...
user avatar
  • 11
1 vote

Jenkins: make a credential available to all users

I was a little confused by the OP question and follow up, so answering about GitHub access to jenkinsfile-based pipeline jobs: Credentials stored in Jenkins can be available to all users with rights ...
user avatar
1 vote

Passing secrets to a Docker container

There is another option only using pipe: docker run -d -i --name $n alpine sh -c 'read A; echo "[$A]"; exec some-server' docker exec -i $n sh -c 'cat > /proc/1/fd/0' <<< _a_secret_ First,...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible