阅读中文版本

Pipeline Secrets Injection Workflow

Inject pipeline credentials from a secret manager at runtime so secrets never live in code, logs, or job parameters.

Overview

Provide pipeline credentials securely without persisting them in artifacts or logs.

This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.

Environment and prerequisites

• A secret manager
• Workload identity for the pipeline
• Log redaction

Procedure

1. Store secrets in a manager

Move all credentials into a secret manager with access policies.

Expected state: No secret is stored in code or config files.

2. Grant workload identity least privilege

Allow the pipeline identity to read only the secrets it needs.

Expected state: Each job can read only its own secrets.

3. Fetch at runtime and avoid logging

Retrieve secrets just before use and ensure they are redacted from logs.

Expected state: Secrets are used transiently and never logged.

4. Rotate and audit access

Rotate secrets on a schedule and review access records.

Expected state: Secret use is attributable and rotated.

# fetch a secret at runtime, never in job parameters
sops exec-env secrets.enc.yaml 'python job.py'

Verification

Confirm no secret appears in code, parameters, or logs, and that access is scoped and audited.

Decision points

Env vars or runtime fetch?

• Runtime fetch from a manager
• Environment variables

Recommendation: Fetch at runtime; env vars leak into process listings and crash dumps.

Shared or per-job identities?

• Per-job identity
• One shared identity

Recommendation: Use per-job identities so compromise has limited scope.

Common failures

• Secrets in parameters leak via job history.
• Broad identities expose more than needed.
• Missing redaction puts secrets in logs.