Comparison
Secret managementvsSecret sprawl
Secret management
the database password is fetched at start-up from a service that logs who asked, instead of sitting in the repository.
Storing credentials in a dedicated system with access control, audit and rotation, and delivering them to workloads at run time. The delivery mechanism matters as much as the store: an environment variable is visible to anything that can read the process, and a mounted file at least can be refreshed in place. The hard part is never the storage — it is that the workload must authenticate to the secret store somehow, which is what workload identity exists to solve.
Full entry →Secret sprawl
the same API key is in a pipeline variable, two config maps, a wiki page and someone's laptop, and rotating it breaks three things.
The same credential copied into many systems until nobody knows the full set of places it lives. It is what makes rotation frightening and therefore rare, which is how a five-year-old key ends up in production. The remedy is a single source with short-lived derived credentials, so copies expire on their own rather than persisting until someone finds them.
Full entry →