November 2022 Summaries

Kubernetes Secrets are a fundamental building block of the modern Software Development Lifecycle (SDLC) and provide two methods for injecting secrets into containers: as files, environment variables, or a combination of both. To manage Kubernetes Secrets securely, it is strongly recommended to enable encryption at rest. However, this approach poses several security questions, such as where to store encrypted secret files and how to manage access to them. As an alternative, Kubernetes Secret managers provide a secure and encrypted source of truth for secrets storage at enterprise scale, with multiple choices on the market. The most common methods for syncing secrets to Kubernetes are using Secrets Agent/Sidecar Injection, Kubernetes Secrets Operators, and the Secrets Store Container Storage Interface (CSI). However, none of these solutions provide an out-of-the-box, elegant solution for triggering deployments to be reloaded when secrets change. To overcome this challenge, teams can rely on open-source tools such as Reloader or consider using a Secrets Manager like Doppler that simplifies the process of managing and syncing secrets, providing an easy-to-use experience with automatic reload upon secrets update.

Doppler secret snapshots provide a robust failsafe for legacy and on-prem environments where secrets must be fetched at runtime, offering high availability and protection in network-restricted environments or when Doppler's API rate limit is exceeded. By bundling secrets snapshots into the application build during CI/CD, applications can access their secrets even if Doppler's API is unreachable. The use of a passphrase ensures secure encryption and decryption of secrets, allowing for independent rotation of authentication tokens and passphrases. Secrets snapshots support name transformers and download formats, making it easy to integrate with existing build processes. With the addition of the `--fallback-only` option, applications can fall back to a specific secrets snapshot when running in production, ensuring high availability even in case of API issues.