4 ms·

So how do you do version the configuration management for the cluster that runs everything? It needs to be versioned, and yet with just the data in it you need

So how do you do version the configuration management for the cluster that runs everything? It needs to be versioned, and yet with just the data in it you need to be able to recreate your entire environment from scratch.

shkkmo 9y ago
If you want your secrets under version control, then they should be encrypted. There are lots of ways of doing this. git-crypt is one that is configuration management agnostic. Most CM tools have their own way of dealing with secrets and there are CM agnostic tools like git-crypt. I'm not personally familiar with anything besides ansible-vault, but this article seems to provide a pretty good summary of several options: https://www.threatstack.com/blog/cloud-security-best-practices-finding-securing-managing-secrets-part-2/ https://www.threatstack.com/blog/cloud-security-best-practic...