3 ms·
Secrets should really be stored in services, not files outside of maybe a single bootstrap file (unless you're working on the secret storage service itself). I
by xxpor 6y ago
Secrets should really be stored in services, not files outside of maybe a single bootstrap file (unless you're working on the secret storage service itself).
I generate my secrets once, send them off to the secrets service, and then my service queries that service. I never see the secrets with my own eyes.
- tnorthcutt 6y agoCan you expand on this? What service do you use to store your secrets?
- dividedbyzero 6y agoWhat are you using for this? This sounds like a neat setup.
- corobo 6y agoIt is a single bootstrap file, it bootstraps your env variables I've not come across what you describe
- this-pony 6y agoThis sounds like a turtles all the way down kind of think... Then is it OK to keep the secret of the secrets service, or something in that sense.
- dfee 6y agoThe idea is that you keep the name of the secret, and grant access to the secret manager via roles / policies which are generally open to devs on a subnet for a development environment but locked down in production environments.