A secret is sensitive configuration data, such as a credential, stored so authorized automation can access it without exposing its value.
A secret stores sensitive configuration, such as credentials, so authorized automation or applications can use it without exposing the value in ordinary configuration. section 4.3section 10.7
Treat secrets differently from ordinary configuration:
Store deployment credentials in a repository secret such as GCP_CREDENTIALS rather than committing the downloaded JSON file. section 4.3
Reference runtime passwords through a Kubernetes Secret instead of storing them as files or ordinary configuration values. section 10.7
Do not assume a Kubernetes Secret is encrypted or fully secure; production systems may require a secret manager such as Vault. section 10.7
Injecting a Redis password
A Kubernetes deployment can populate DATABASE_PASSWORD from the redis-password key in the redis-cluster Secret, while reading DATABASE_URL from a separate configuration map. section 10.7
Figure 4.6 Add the contents of the key to a secret in GitHub.
Shows how to add deployment-key contents to a GitHub repository secret. section 4.3
How Shipping Go: Develop, deliver, discuss, design, and go again covers it
How deep it goes
Explains repository storage, Kubernetes references, and security limits, but defers implementation of a robust external secret manager.
Examples
Uses a GCP JSON credential in GitHub and a Redis password referenced by a Kubernetes deployment.
What it assumes
Assumes familiarity with deployment accounts, repositories, Kubernetes resources, configuration maps, and environment variables.
What you can do after
Operate/configure GitHub and Kubernetes deployments by storing credentials and injecting passwords through secret references.
How it connects
Connects secrets with continuous deployment, Kubernetes, configuration maps, environment variables, and secret managers.
.NET in Action, Second EditionA secret is sensitive information, such as a credential or cryptographic key, that must be protected from unauthorized disclosure.
external access integrationused by · An external access integration is a Snowflake object that governs outbound access from Snowflake code to external network locations using specified network rules and secrets.
managed identityaddressed by · A managed identity is a nonhuman digital identity whose credentials and lifecycle are administered by a cloud or infrastructure service, allowing workloads to authenticate to supported resources without managing credentials directly.
SecretManagementused by · SecretManagement is a PowerShell module framework that provides a common interface for storing and retrieving secrets through registered vault extensions.
configurationcontrasts with · A specification of settings, parameters, or component relationships that determines how a system, application, model, or process is structured or operates.
Azure Key Vaultused by · Azure Key Vault is a Microsoft Azure managed service for securely storing and controlling access to secrets, cryptographic keys, and certificates.
This explainer was generated by Manning's knowledge graph from the text of Shipping Go: Develop, deliver, discuss, design, and go again. The section links point to the parts of the book it draws on.
