3 ms·

I don't think dumping production secrets to anywhere qualifies as a good idea I am going to guess this is comparing the key part of key value stores - I regula

• lstamour 7y ago
  Comparing keys is interesting, it’s a way of versioning the set of credentials you’re using. Here I meant dumping staging values and then comparing prod values as retrieved to staging ones. As in, only compare values in prod as they are used by a deploy script or system configuration tool. That said, if you have one server, one place where secrets are kept, then it’s probably safe enough to send non-prod secrets to servers as a way of ensuring the secrets are invalid. Meaning, you don’t actually need to know the prod secrets to test staging or known weak secrets against prod. That said, if in practice your secrets are randomly generated as services deploy, you’ll likely need to validate by observed behaviour rather than using hard-coded credentials. And if you’re practicing blue/green deploys, then staging might be just as production as prod...