DevSecOps Practice Hub

Secrets Management

Store, distribute, rotate and audit credentials without embedding them in code or pipeline configuration.

IntermediateSecrets ManagementIdentityCloudInfrastructure

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Code Static analysis, secret detection and secure coding practices.
  • Deploy Policy enforcement, admission control and infrastructure security.
  • Operate Runtime security, secrets rotation and configuration reconciliation.

Overview

A secrets manager becomes the single source of truth for credentials. Applications and pipelines authenticate with a workload identity and receive short-lived secrets, ideally generated on demand rather than stored.

Why it matters

Static credentials scattered across CI variables and config files cannot be rotated confidently. Centralisation makes rotation, revocation and audit possible.

How it works

  1. 01Workloads authenticate using platform identity (Kubernetes service account, OIDC, cloud IAM).
  2. 02The secrets engine issues a lease-bound credential.
  3. 03Applications refresh before expiry; revocation is immediate and central.
  4. 04Every issuance and access is logged for audit.

Common tools

HashiCorp VaultExternal Secrets OperatorAnsible VaultSOPSVaultKubernetesAWSAnsible

Implementation examples

yamlExternal Secrets Operator sync
apiVersion: external-secrets.io/v1beta1kind: ExternalSecretmetadata:  name: payments-dbspec:  refreshInterval: 1h  secretStoreRef:    name: vault-backend    kind: ClusterSecretStore  target:    name: payments-db-credentials  data:    - secretKey: password      remoteRef:        key: database/payments        property: password
Keeps the credential out of git while still letting workloads consume a normal Kubernetes Secret.
bashEncrypt variables with Ansible Vault
ansible-vault encrypt_string 's3cr3t' --name 'db_password'
Suitable for automation repositories; the vault password itself must come from a secrets manager or prompt, never from the repository.

Best practices

  • Prefer dynamic, short-lived credentials over long-lived static ones.
  • Bind secret access to workload identity rather than a shared token.
  • Alert on unusual access patterns, not just failed reads.

Common mistakes

  • Syncing secrets into environment variables that get logged.
  • Using one shared service account for every workload.

Hands-on labs