September 2021 Summaries

The traditional siloed approach to secrets management is no longer adequate due to its friction and limitations, such as a clunky UI dashboard and SDKs that are awkward to implement. Instead, a platform-native secret store and language-agnostic environment variables are becoming the norm in modern infrastructure platforms like Cloudflare Workers, Vercel, Netlify, and AWS Lambda. This approach prioritizes developer productivity and security, recognizing that compliance-driven approaches can create unnecessary friction. The "SecretOps" approach to managing secrets is built on six principles, including centralizing secrets management, supporting automatic syncing across deployment platforms, and providing a single pane of glass view for configuration and secrets. SecretOps differs from traditional secrets management by embracing the multi-cloud and platform world and understanding the needs of developers and DevOps teams. By working with them rather than against them, SecretOps aims to increase developer productivity, remove security theatre, and confidently manage application config and secrets at scale.

The Doppler Kubernetes Operator continuously synchronizes secrets, including PKCS12 certificates, between Doppler and a Kubernetes cluster. To use the Operator, first install it using Helm or kubectl, then import the PKCS12 certificate into Doppler. The Operator creates a custom resource in Kubernetes to store the synced secret. A service token is required for the Operator to access the secrets. The Operator mounts the certificate inside a container and verifies its metadata.

The tutorial covers how to install MongoDB 5 on Debian/Ubuntu, create a root CA and self-signed TLS/SSL certificates using mkcert, configure the MongoDB server to use these certificates, store the certificates in a secrets manager called Doppler, access the certificates using the Doppler CLI, and finally configure a MongoDB client to connect to the server using TLS/SSL mode. The tutorial assumes prior knowledge of how TLS/SSL certificates and the chain of trust work.

Doppler is a tool that makes managing secrets for Docker Compose applications easy, allowing developers to securely supply SSL/TLS certificates in PEM format to their applications. To use Doppler with Docker Compose, developers need to install the Doppler CLI and authenticate, then create certificate and key secrets using the Doppler dashboard or CLI. The `docker-compose` file must be configured to mount the TLS certificate and key, and to expand variables correctly for variable expansion inside the container. Once set up, Doppler simplifies the process of managing secrets, including injecting environment variables and certificates into Docker Compose applications. In production environments, Doppler can be used with a Virtual Machine's file system location by scoping a Doppler Service Token to the application code directory, ensuring secure management of secrets across different environments.

You have successfully installed and authenticated the Doppler CLI, accessed a Kubernetes cluster, created a Doppler project with required variables including TLS certificate and key, created a TLS certificate and key secret in Doppler, synced the TLS certificate and key to a Kubernetes secret using the Doppler CLI, mounted the TLS certificate and key inside a Kubernetes deployment, enabled automatic secrets sync with the Kubernetes Operator.

Andre Azzolini, a seasoned software engineer with diverse experience in building large-scale eCommerce frameworks, Fortune 500 solutions, and real-time web applications, has found his ideal fit at Doppler, where he can combine his passions for making developers more productive and improving computer security. He is drawn to the company's emphasis on environment configuration, secrets management, and security, which aligns with his own interests and values. At Doppler, Andre enjoys a full-stack role that offers variety and meaningful work, allowing him to build user-facing features and contribute to improvements in the tokenization system. The team's strong focus on software quality, trust, and cooperation has made it an attractive place for Andre to grow as an engineer, where he can wake up each day excited to tackle challenging projects.

I recently transitioned to a new job after realizing that I was looking for something but wasn't sure exactly what it was. During my interviews with various companies, including Doppler, I gained direction and helped me identify my priorities. The team at Doppler was genuinely excited about the platform they were developing, and I quickly learned that every member brings different strengths and values to their roles. The company has a clear direction forward and is highly invested in the quality of its product. I appreciated that the team's values were clearly aligned with my own, and not just thrown together as corporate messaging. Doppler prioritizes honesty and transparency, mutual understanding in security, practicing what they preach, and providing tools to build secure software. The company's mission to establish secure engineering practices resonated with me, and I was inspired by the drive and skills of my teammates.