4 ms·
How are secrets intended to be managed? E.g.: NPM auth tokens (for private NPM modules), Github tokens (e.g. for private Ruby gems or submodules), Slack webhook
by lobster_johnson 10y ago
How are secrets intended to be managed? E.g.: NPM auth tokens (for private NPM modules), Github tokens (e.g. for private Ruby gems or submodules), Slack webhooks, etc.
I suppose one could bake that stuff into a base image, or store it in a Kubernetes secret that the build service account has access to.
- skj 10y agoWe currently don't have direct support for secrets other than your service account's access tokens. We hope to support more arbitrary secrets in the future. As you said, you can bake things into a base image (ew) or use your credentials to fetch them from somewhere else (I suggest Cloud Storage).
- lobster_johnson 10y agoThe problem with uploading them somewhere is that you introduce an implicit dependency that must be documented and dealt with as part of the whole devops universe — it's just one more thing on top of a heap of other things. It's much nicer, and more secure (in terms of locking down just one thing and not having to manage multiple to be able to centralize secrets somewhere. Whereas keeping things like this close the project is of course more convenient for developers. Drone has tried two different systems, neither of which were ideal, and is working on a third one. I believe the third one also involves encrypted secrets committed to the project repo.
- ravdovid 10y agoThank you for the input -- we do recognize the importance of being able to manage secure inputs to your builds and are investigating good solutions for this.