4 ms·
A config store like Vault. Of course, that needs credentials too, which are typically a file on the file system. IMO, people are overly sensitive about environ
by falcolas 6y ago
A config store like Vault. Of course, that needs credentials too, which are typically a file on the file system.
IMO, people are overly sensitive about environment vars. They are really no worse than files on the file system - both can be accessed if you're a privileged user on that machine.
- KptMarchewa 6y agoVault should be source of those env variables. Via some predefined initcontainer or something like that, to which devs don't have access to.
- danielhlockard 6y agoOr you could, you know, auth to vault and pull the creds from vault inside of your app?
- tylerchr 6y agoYou could, but then you’ll have replaced a universal and standardized abstraction with a hard commitment to one very specific approach. That doesn’t come cheap.
- falcolas 6y agoOne thing that I like, which this approach allows for, is live configuration. For things like databases and such which allow for the regular rolling of credentials. It's not simple by itself, but it simplifies other things.
- 0xEFF 6y agoHow do you auth to vault?