Hands-On Continuous Integration and Delivery

Overall best practices for secrets management

As we have stated before throughout the book, it is not good practice to commit raw passwords and secrets into source control and you will need to have a way to safely retrieve passwords when running CI/CD pipelines. You can use the CI server itself to store passwords and secrets and then retrieve them using environment variables or you can use services such as Vault to securely store your passwords. Remember that it can be unsafe to use execution tracing in shell scripts in CI environments so be mindful when debugging builds and using the set -x flag in Bash.