News for hackers. Stuff that matters.

A comment on DigitalOcean App Platform. Parent comment

Re:DigitalOcean App Platform by bastawhiz on Tuesday October 06, 2020 @05:46PM (#24702673)
Has GAE sorted out secrets management? Last I checked, they required you to commit secrets to the repo you push, which necessitates your secrets being on whatever computer (or whoever's computer) does production deploys. Contrast this with DO/Heroku/etc. which lets you set environment variables.

Some folks suggest using a DB to store secrets on GAE, but this is (IMO) just obfuscation.

[ Parent | on HN ]
Re:DigitalOcean App Platform by praet on Tuesday October 06, 2020 @06:02PM (#24702821)
Yes, they added Secret Manager early this year: https://cloud.google.com/secret-manager
[ Parent | on HN ]
Re:DigitalOcean App Platform by ypeter on Tuesday October 06, 2020 @06:08PM (#24702891)
And before this you could implement Cloud KMS in your app to decrypt the encrypted secrets you can store in your repo.
[ Parent | on HN ]
Re:DigitalOcean App Platform by bastawhiz on Wednesday October 07, 2020 @01:22PM (#24710494)
This still seems ridiculous. Why did I need to keep secrets in my repo to begin with? GAE, as far as I can tell, has been the only major PaaS that hasn't offered a solution for this. It's so easy to get wrong...it contradicts one of the biggest rules of version control: keep your secrets out of your repo.
[ Parent | on HN ]
Re:DigitalOcean App Platform by stickfigure on Thursday October 08, 2020 @05:10PM (#24723993)
There are a million ways to do it that don't require Google? Your CI system builds the production image, it can get secrets from anywhere.
[ Parent | on HN ]
Re:DigitalOcean App Platform by bastawhiz on Friday October 09, 2020 @01:27PM (#24732236)
My CI system arguably shouldn't have access to production secrets any more than my developers' macbooks.
[ Parent | on HN ]