Security (DevSecOps) · Module 02

Secret management

Keep passwords, tokens and keys out of code: catch leaked secrets with gitleaks, store and issue them with Vault or a cloud secret manager, and use Kubernetes Secrets and pipeline secrets correctly.

Practice interactively →

What you will learn

• Explain why secrets in code and Git history are a major risk
• Scan repositories and block commits containing secrets with gitleaks and pre-commit
• Write and read secrets and understand dynamic secrets in HashiCorp Vault
• Read secrets from AWS Secrets Manager and Azure Key Vault with the CLI
• Create Kubernetes Secrets and know the limits of base64
• Pass secrets into CI/CD safely, preferring OIDC over long-lived keys

Lessons

1. Why secret management matters

   A secret is anything that grants access, such as passwords, API keys, tokens and private keys; leaving them in code, committed .env files or logs is a leading cause of cloud incidents.

2. Secret scanning with gitleaks and pre-commit

   Automatically find secrets in code and Git history with gitleaks, block them at commit time with a pre-commit hook, scan again in CI and handle false positives with an allowlist.

3. HashiCorp Vault basics

   Vault stores secrets encrypted, grants access by policy, audits every read and can generate dynamic secrets that expire; learn seal, auth methods, secrets engines, policies and the vault kv commands.

4. Cloud secret managers

   AWS Secrets Manager, AWS SSM Parameter Store and Azure Key Vault store secrets encrypted with KMS, control access with IAM or RBAC, rotate automatically and audit reads; apps read them with a managed identity instead of keys.

5. Kubernetes Secrets and their limits

   Kubernetes Secrets are only base64, not encryption; protect them with RBAC, encryption at rest and file mounts, and sync them from an external secret manager with External Secrets or Sealed Secrets.

6. Secrets in CI/CD pipelines

   Pipelines hold deploy rights, which makes them valuable targets; use the CI platform's secret store, scope secrets to environments, keep them out of logs and replace long-lived keys with OIDC for short-lived cloud credentials.