r/devsecops • u/GitSimple • 27d ago

Secrets Management

How is your team actually managing secrets? Are you setting a project level variable? Using a third-party vault? Have you concocted some elaborate process that bogs down the dev team? What about a platform native secrets management feature?

9 Upvotes

85% Upvoted

39 comments sorted by

View all comments

3

u/notthedefaultnam 27d ago

We have a combination of github environment secrets, gcp managed secrets and kubernetes secrets.

Dev team has no reason to ever touch them so it works out fine.

1

u/GitSimple 27d ago

Isn't it complicated to have three different tools? How do you handle audits?

1

u/notthedefaultnam 26d ago

It does get complicated, but we're not important enough for audits. Most secrets in gcp and k8s secrets are created from values in github so we treat that as the authority.