How to store secrets files for multiple clients in a CI pipeline?

user_3320393 0
Viewed 309

The product that I'm working on requires to deploy separate instances of apps for different clients. I have to deal with some YAML config files that contain secret tokens, each client got a separate YAML file with their own secrets. Right now these file only exists on my computer, and when I deploy by hand I can acces the files.

We want to introduce a CI pipeline for our deployments. The problem is that all of the providers that I check only support key-value pairs as secrets, therefore it would be inconvinient to copy the whole file contents as secret like CLIENT_NAME_SECRET=<yaml file contents>. Like this I always have to copy the secret edit in my editor and reupload to the CI. My other idea was that I store them in a private git repo and only SSH access would be possible, so only the CI and the developers could access the files. Is it secure and safe to store like that?

What are the best practices to store multiple client secrets for CI pipelines, what do you recommend?

gitlab gitlab-ci credentials token continuous-integration
1 Answers

Why don't you just provide the secrets with the file-type in your GitLab?

In the repository of your product, under Settings > CI/CD you can add Variables to your CI/CD Pipeline.

One of the options you have is to include File-types.

enter image description here

Then you can access that file directly through the key-name you put (for example with cat $MY_VARIABLE_KEY)

You could create one variable and job for each customer, so each one would use the explicit YML file for its concrete configuration.

user_89515710
Related