Hands-On Continuous Integration and Delivery

Best practices in password and secrets storage

As we have seen throughout the chapters covering Jenkins, Travis CI, and CircleCI, each continuous integration server has a way to store secure information such as passwords, API keys, and secrets. It is dangerous to run certain actions in the CI server, such as execution tracing with Bash by using the set -x option in Bash. It is better to either use the CI server's functionality to securely store passwords and secrets, such as the context settings for each project in CircleCI ,which cannot be seen by anyone other than a project owner. You can also use a tool such as Vault (https://www.vaultproject.io/intro/index.html) to securely store your passwords and that can be retrieved using a RESTful ...