3 ms·
My main reason for avoiding passing secrets via the environment is that updating the secret requires a process restart. Using in-process mechanisms to retrieve
by jameshart 4y ago
My main reason for avoiding passing secrets via the environment is that updating the secret requires a process restart. Using in-process mechanisms to retrieve secrets from a vault or KMS lets long running processes benefit from frequently rotated keys.
- pharmakom 4y agoShouldn’t all services be designed so that they can be updated without impacting service consumers anyway?
- ElevenLathe 4y agoThis isn't always possible to do without some poor UX for things like multiplayer games or VoIP where the pod keeps state and latency is a noticeable factor.
- jameshart 4y agoSure, processes can shut down and spin up any time, but I’d rather not have to just to update credentials.