Secrets managers and rotation
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
keep secrets out of code, images, and Git, and rotate them.
Planned topics
- Secrets: database passwords, API keys, signing keys, certificates.
- Store them in a secrets manager (Vault, AWS Secrets Manager, Azure Key Vault) with access by workload identity, not shared passwords.
- Apps fetch secrets at start or on refresh; avoid long-lived static credentials; prefer dynamic short-lived credentials.
- Rotate regularly and after any suspicion; design for two valid credentials during rotation.
- Environment variables leak into dumps and logs; mounted files or direct API fetch are safer.
Draft outline details
Demonstration
a pod identity reading shop/orders/db from the secrets manager; a secret scanner (such as gitleaks) in CI.
Check your understanding
Why avoid secrets in environment variables?
Show answer
They show up in dumps, process listings, and debug output.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.