<p>We are working on a Java Spring Boot application, that needs access to a database, the password is stored on the <code>application.properties</code> file.</p>
<p>Our main issue is that the passwords might be viewable when uploaded to GitLab/GitHub.</p>
<p>I found that we can use Jasypt to encrypt the data, but from what I read, I need to use the decryption key on the execution, which is also stored on Git, in order to be deployed using Kubernates.</p>
<p>Is there some way to secure our passwords in such a case? We are using AWS if that makes any difference, and we are trying to use the EKS service, but until now we have had a VM with K8s installed.</p>

<p>Do not store passwords in <code>application.properties</code> as you mention is insecure but also you may have a different version of your application (dev, staging, prod) which will use different databases and different passwords.</p>
<p>What you can do in this case is maintain the password empty in source files and <a href="https://docs.spring.io/spring-boot/docs/current/reference/html/features.html#features.external-config" rel="nofollow noreferrer">externalize this configuration</a>, i.e you can use an environment variable in your k8 deployment file or VM that the application will be run,  spring boot will load it as property value if they have the right format. From spring <a href="https://docs.spring.io/spring-boot/docs/current/reference/html/features.html#features.external-config" rel="nofollow noreferrer">documentation</a>:</p>
<blockquote>
<p>Spring Boot lets you externalize your configuration so that you can work with the same application code in different environments. You can use a variety of external configuration sources, include Java properties files, YAML files, environment variables, and command-line arguments.</p>
</blockquote>
