<p>I am trying to learn Google Kubernetes Engine. I am deploying a web app in Node.js on a cluster containing 6 sensitive environment variables. Locally I have them in an .env file that I have .gitignored. I push the code to github which creates a container on Cloud Build through a trigger.</p>
<p>I am using the graphical user interface of GCP (i.e not Kubectl, gsutil or the likes of it). I am also doing it without Yaml-files. This works perfectly fine for now.</p>
<p>However, I am troubleshooting an issue which makes me having to deploy new workloads all the time, and as such I need to add those environmental variables every time, which is quite tedious.</p>
<p>I understand the solution is to do it either using gsutil and/or use yaml-files. I know I will have to start using gsutil and yaml at some point, and maybe that is now.</p>
<p>However, I wonder if I put environmental variables in a yaml-file that I push to github and further on to GCP, I obviously cannot gitignore it. <strong>How, then, do I keep the passwords etc outside of the code base?</strong> I moved these variables from the code into environmental variables for that reason.</p>
<p>What is common/good practise to work with environmental variables on GCP - in a easy and safe manner?</p>

<blockquote>
<p>What is common/good practise to work with environmental variables on
GCP - in a easy and safe manner?</p>
</blockquote>
<p>Very easy documentation : <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/secret" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/concepts/secret</a></p>
<p>You should be using the Key-value store or other Key value management service.</p>
<p>Kubernetes suggest the best practice is to use the K8s <strong>secret</strong> and <strong>configmap</strong> which is base64 encoded key-value pair. That you applied to K8s cluster using YAML and which further get injected to deployment and application get it from the environment.</p>
<p>Either you inject variables into environment variables or inject as files into file system from where further used by the application.</p>
<p>You can check more at : <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/configuration/secret/</a></p>
<p><strong>Basic example secret injecting as Environment:</strong></p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
  - name: mycontainer
    image: redis
    env:
      - name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username 
</code></pre>
<p>You store files into secret and that secret base64 encoded injected to deployment and add file there in the filesystem. Once your application starts it start using a file from that file.</p>
<p><strong>Basic example secret injecting as File into file system:</strong></p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: mypod
    image: redis
    volumeMounts:
    - name: foo
      mountPath: &quot;/etc/foo&quot;
  volumes:
  - name: foo
    secret:
      secretName: mysecret
</code></pre>
<p>Now it's on you which type of Environment variables you have, if it's simple Key-value or .env etc.</p>
<p>If it's simple Keyvalue, you are looking for <strong>encryption</strong> at rest, security and other access policy, and <strong>UI</strong> to update secret.</p>
<p>i would recommend checking out the <a href="https://www.vaultproject.io/" rel="nofollow noreferrer">Hashicorp</a> vault famous and used by many enterprises. Using this you can encrypt the secret and inject it into the deployment. But you need deploy and manage this workload it's not managed service like secret manager or so.</p>
<p>i am not an employee of Google but you are on GKE i would also suggest checking out the Secret manager or KMS which can manage your secret.</p>
<p>Article : <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets</a></p>
<p>Github CSI driver : <a href="https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp" rel="nofollow noreferrer">https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp</a></p>
<p>If you have no concerns with <strong>encoding</strong> and those are not important secrets you can use <strong>default inbuilt K8s secret</strong>.</p>
<p>On committing YAML file side, if you are using <strong>Vault</strong> or <strong>secret manager</strong> you won't have to manage <strong>secret</strong> in YAML file or deployment YAML won't be storing any <strong>confidential</strong> <strong>secrets</strong>.</p>
