Never in git
API keys, DB passwords, private keys — never commit. Use .gitignore, pre-commit hooks (gitleaks), secret scanning in CI.
If leaked: rotate immediately; assume compromised.
Secrets managers
HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager — central store, audit access, rotation APIs.
App fetches at startup or sidecar refresh — not baked in image.
Environment variables
Common pattern; risk: env dump in crash logs, /proc visibility, broad access in K8s.
Prefer short-lived credentials; restrict who can kubectl exec.
KMS envelope encryption
Data key encrypts data; KMS master key encrypts data key.
Rotate data keys without re-encrypting all data at once (re-wrap DEK).
Encryption at rest (awareness)
- RDS/S3 — platform encryption (SSE-S3, SSE-KMS)
- Application-level — field encrypt PII before DB (search trade-off)
Data Privacy topic — PII handling.
Rotation
Automate DB cred rotation: dual-password window, app reconnect logic, vault dynamic secrets.
Staff question: "What breaks during rotation?" — connection pools hold old password.
CI/CD secrets
GitHub Actions secrets, OIDC to cloud (no long-lived cloud keys in CI).
Cross-reference: Secure SDLC topic for supply chain; Observability — never log secrets.
Further Reading
- HashiCorp Vault — Secrets management conceptsReference25m
- AWS KMS — Envelope encryption overviewReference20m
Hands-On Tasks (Optional)
Security design drills — threat modeling, auth flows, and incident playbooks. Assumes Networking (TLS) fundamentals.
- Plan database credential rotation15m
Zero-downtime rotation for app DB password used by 30 pods. Dual-credential window, vault dynamic secrets, or IAM auth — pick and outline steps.