Secrets Management: Centralization, Encryption, and Rotation

One Source of Truth, Injected at Runtime

Application secrets should live in a dedicated secrets manager, not in the repository, the CI configuration, or a teammate's laptop. Applications and pipelines pull secrets at runtime from the manager — scoped per environment (dev, staging, production) so a development credential can never reach production. This makes access revocable and auditable, and removes secrets from places they are easily copied or leaked.

• Store secrets in a managed system, never in committed files or chat
• Scope secrets per environment so dev credentials cannot touch production
• Inject at runtime; do not bake secrets into images or build artifacts
• Restrict and log read access — every fetch should be attributable

Encrypt the Config That Must Live in Git

Some configuration genuinely belongs in version control — Kubernetes manifests, infrastructure-as-code, environment files for GitOps. For those, encrypt the secret values in place so the repository never holds plaintext credentials. Tools that encrypt only the values (leaving keys readable) let you review diffs and keep GitOps workflows while ensuring a repo leak does not expose live secrets.

# Encrypt only the values in a secrets file before committing
# (keys stay readable so diffs remain reviewable)
sops --encrypt --in-place secrets.enc.yaml

# Decryption happens at deploy time, in memory only:
sops --decrypt secrets.enc.yaml | kubectl apply -f -

Make Rotation Routine

A secret that never changes is a secret that will eventually leak and stay leaked. Define a rotation cadence for every credential class — shorter for high-value keys — and automate it where possible so rotation is a scheduled, low-drama event rather than a post-incident scramble. Track ownership and expiry so a departing teammate or an expiring token never becomes a silent outage or an open door.

• Define and document a rotation cadence per credential type
• Rotate immediately on any suspected exposure or teammate offboarding
• Prefer short-lived, dynamically issued credentials over long-lived static keys
• Alert ahead of token and certificate expiry to avoid surprise outages