mirror of
https://github.com/wshobson/agents.git
synced 2026-03-18 09:37:15 +00:00
style: format all files with prettier
This commit is contained in:
@@ -22,6 +22,7 @@ Implement secure secrets management in CI/CD pipelines without hardcoding sensit
|
||||
## Secrets Management Tools
|
||||
|
||||
### HashiCorp Vault
|
||||
|
||||
- Centralized secrets management
|
||||
- Dynamic secrets generation
|
||||
- Secret rotation
|
||||
@@ -29,18 +30,21 @@ Implement secure secrets management in CI/CD pipelines without hardcoding sensit
|
||||
- Fine-grained access control
|
||||
|
||||
### AWS Secrets Manager
|
||||
|
||||
- AWS-native solution
|
||||
- Automatic rotation
|
||||
- Integration with RDS
|
||||
- CloudFormation support
|
||||
|
||||
### Azure Key Vault
|
||||
|
||||
- Azure-native solution
|
||||
- HSM-backed keys
|
||||
- Certificate management
|
||||
- RBAC integration
|
||||
|
||||
### Google Secret Manager
|
||||
|
||||
- GCP-native solution
|
||||
- Versioning
|
||||
- IAM integration
|
||||
@@ -75,22 +79,22 @@ jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Import Secrets from Vault
|
||||
uses: hashicorp/vault-action@v2
|
||||
with:
|
||||
url: https://vault.example.com:8200
|
||||
token: ${{ secrets.VAULT_TOKEN }}
|
||||
secrets: |
|
||||
secret/data/database username | DB_USERNAME ;
|
||||
secret/data/database password | DB_PASSWORD ;
|
||||
secret/data/api key | API_KEY
|
||||
- name: Import Secrets from Vault
|
||||
uses: hashicorp/vault-action@v2
|
||||
with:
|
||||
url: https://vault.example.com:8200
|
||||
token: ${{ secrets.VAULT_TOKEN }}
|
||||
secrets: |
|
||||
secret/data/database username | DB_USERNAME ;
|
||||
secret/data/database password | DB_PASSWORD ;
|
||||
secret/data/api key | API_KEY
|
||||
|
||||
- name: Use secrets
|
||||
run: |
|
||||
echo "Connecting to database as $DB_USERNAME"
|
||||
# Use $DB_PASSWORD, $API_KEY
|
||||
- name: Use secrets
|
||||
run: |
|
||||
echo "Connecting to database as $DB_USERNAME"
|
||||
# Use $DB_PASSWORD, $API_KEY
|
||||
```
|
||||
|
||||
### GitLab CI with Vault
|
||||
@@ -181,9 +185,9 @@ deploy:
|
||||
runs-on: ubuntu-latest
|
||||
environment: production
|
||||
steps:
|
||||
- name: Deploy
|
||||
run: |
|
||||
echo "Deploying with ${{ secrets.PROD_API_KEY }}"
|
||||
- name: Deploy
|
||||
run: |
|
||||
echo "Deploying with ${{ secrets.PROD_API_KEY }}"
|
||||
```
|
||||
|
||||
**Reference:** See `references/github-secrets.md`
|
||||
@@ -200,6 +204,7 @@ deploy:
|
||||
```
|
||||
|
||||
### Protected and Masked Variables
|
||||
|
||||
- Protected: Only available in protected branches
|
||||
- Masked: Hidden in job logs
|
||||
- File type: Stored as file
|
||||
@@ -294,14 +299,14 @@ spec:
|
||||
name: database-credentials
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: username
|
||||
remoteRef:
|
||||
key: database/config
|
||||
property: username
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: database/config
|
||||
property: password
|
||||
- secretKey: username
|
||||
remoteRef:
|
||||
key: database/config
|
||||
property: username
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: database/config
|
||||
property: password
|
||||
```
|
||||
|
||||
## Secret Scanning
|
||||
|
||||
Reference in New Issue
Block a user