4 ms·
We currently don't have direct support for secrets other than your service account's access tokens. We hope to support more arbitrary secrets in the future. As
by skj 10y ago
We currently don't have direct support for secrets other than your service account's access tokens. We hope to support more arbitrary secrets in the future.
As you said, you can bake things into a base image (ew) or use your credentials to fetch them from somewhere else (I suggest Cloud Storage).
- lobster_johnson 10y agoThe problem with uploading them somewhere is that you introduce an implicit dependency that must be documented and dealt with as part of the whole devops universe — it's just one more thing on top of a heap of other things. It's much nicer, and more secure (in terms of locking down just one thing and not having to manage multiple to be able to centralize secrets somewhere. Whereas keeping things like this close the project is of course more convenient for developers. Drone has tried two different systems, neither of which were ideal, and is working on a third one. I believe the third one also involves encrypted secrets committed to the project repo.
- ravdovid 10y agoThank you for the input -- we do recognize the importance of being able to manage secure inputs to your builds and are investigating good solutions for this.