Channels
#general
Title
m
many-knife-65312
06/13/2023, 5:19 PMhi, quick question that I didn't find any docs for: what is the recommended practice for committing pulumi projects to a public repo, when those projects have secrets?
is it safe (or even advisable) to commit the pulumi config file for a stack that has secrets?
b
brainy-church-78120
06/13/2023, 5:34 PMas long as they are encrypted, you should be good. i would recommend you give this a read.
https://www.pulumi.com/docs/concepts/secrets/
m
many-knife-65312
06/13/2023, 5:35 PMThanks @brainy-church-78120 I skimmed that doc, and may have missed mentions of committing secrets
b
brainy-church-78120
06/13/2023, 5:36 PMyah me too, i didn't see that specific thing called out, either. i think that would be a good addition if ur up for contributing.
https://github.com/pulumi/pulumi-hugo/edit/master/themes/default/content/docs/concepts/secrets.md
m
many-knife-65312
06/13/2023, 5:37 PM👍🏼 I'll do what I can
s
straight-arm-50771
06/13/2023, 5:44 PMyou can also use AWS or GCP Secrets Manager to store them, then have a variable fetch them on runtime
m
many-knife-65312
06/13/2023, 5:48 PMThat's a good suggestion. I was thinking about using vault. Does that also fetch at runtime?
s
straight-arm-50771
06/13/2023, 5:49 PMyes, I tried vault also...found it to just be one more thing to maintain so went with cloud-native
m
many-knife-65312
06/13/2023, 5:51 PMAwesome, thanks
p
purple-lawyer-93544
06/13/2023, 5:56 PMYou can also look at SOPS for the generic 'secrets in shared code' solution that isn't Pulumi specific.
s
straight-arm-50771
06/13/2023, 5:57 PMansible vault does the same, but not sure I'd trust it still, lol
m
many-knife-65312
06/13/2023, 5:58 PMThat looks interesting. I think our cirrusci files have that file format
s
salmon-account-74572
06/14/2023, 3:41 PMConfiguration values marked as secret are safe to commit (they’re encrypted), but using a secrets provider as suggested in this thread is an equally valid approach.
p
purple-lawyer-93544
06/14/2023, 3:52 PMSOPS is nice for providing options, and consistent tooling (and some IDE assistance). Can go all the way from PGP to just about any provider you can think of.
m
many-knife-65312
06/14/2023, 4:46 PMawesome, thanks for the replies all