Consolidate secrets storage - Githubissues

mozmeao / infra

Mozilla Marketing Engineering and Operations Infrastructure

https://mozilla.github.io/meao/

Mozilla Public License 2.0

58 stars 12 forks source link

Consolidate secrets storage #1375

Closed stevejalim closed 2 years ago

stevejalim commented 2 years ago

Our k8s secrets are securely stored with encryption in multiple private stores.

It's generally felt that it'd be simpler (and therefore less prone to error or confusion) to have them all in one similarly secure store.

Also note that Nucleus Staging needs it current secrets capturing https://github.com/mozmeao/nucleus-private-config/issues/2 - it looks like it's using Dev secrets, but let's make it formal

Success criteria

[x] All k8s secrets for MEAO live in the same place
[x] Encrypted stored secrets from Basket are moved over
[x] Encrypted stored secrets from Bedrock are moved over
[x] Encrypted stored secrets from Nucleus are moved over
[x] Encrypted stored secrets from Snippets are moved over
[x] Access lists are reviewed and pruned as appropriate; stored secrets rotated and/or re-encrypted as appropriate