AIO Secrets Strategy #461

New issue

Open

opened 2024-12-02 20:37:36 -05:00 by mafyuh · 0 comments

mafyuh commented

2024-12-02 20:37:36 -05:00

Owner

Currently secrets are all over the place. I refuse to push even encrypted secrets to Git.

Forgejo (workflows)
Bitwarden Secrets Manager
Docker Hosts in .env
Kubernetes
Tofu terraform.tfvars
Packer credentials file

Want to use Bitwarden Secrets as the main source and have all things pull from here.

OpenTofu

Can use something like bws-cache to lookup by secret name and not ID, similar to this script and calling them like this

Forgejo (workflows)

Already "done" as shown here, but need to improve, have to manually map the ID's to names still

Docker Hosts

Implemented in Docker CD step and having env variables in /docker/secret-mappings.yml

Packer

TBD

Kubernetes

TBD

Currently secrets are all over the place. I refuse to push even encrypted secrets to Git. - Forgejo (workflows) - Bitwarden Secrets Manager - Docker Hosts in `.env` - Kubernetes - Tofu `terraform.tfvars` - Packer credentials file Want to use Bitwarden Secrets as the main source and have all things pull from here. ## OpenTofu Can use something like [bws-cache](https://github.com/rippleFCL/bws-cache) to lookup by secret name and not ID, similar to [this script](https://github.com/chkpwd/iac/blob/main/terraform/bws_lookup.py) and calling them like [this](https://github.com/chkpwd/iac/blob/44af303d8ac2ab862be6b1dbcd023750807cbdd9/terraform/cloudflare/a_records.tf#L6) ## Forgejo (workflows) Already "done" as shown [here](https://git.mafyuh.dev/mafyuh/iac/src/commit/dc694cfb73fe631bdc547116ba524b782384e096/.forgejo/workflows/tofu.yml#L26), but need to improve, have to manually map the ID's to names still ## Docker Hosts Implemented in Docker CD step and having env variables in /docker/secret-mappings.yml ## Packer TBD ## Kubernetes TBD