secrets-management

密钥管理

使用 Vault、AWS Secrets Manager 和其他工具进行 CI/CD 流水线的安全密钥管理实践。

目的

在 CI/CD 流水线中实现安全的密钥管理，避免将敏感信息硬编码。

使用场景

• 存储 API 密钥和凭据
• 管理数据库密码
• 处理 TLS 证书
• 自动轮换密钥
• 实施最小权限访问

密钥管理工具

HashiCorp Vault

• 集中式密钥管理
• 动态生成密钥
• 密钥轮换
• 审计日志
• 精细的访问控制

AWS Secrets Manager

• AWS 原生解决方案
• 自动轮换
• 与 RDS 集成
• 支持 CloudFormation

Azure Key Vault

• Azure 原生解决方案
• 由 HSM 支持的密钥
• 证书管理
• 与 RBAC 集成

Google Secret Manager

• GCP 原生解决方案
• 版本控制
• 与 IAM 集成

HashiCorp Vault 集成

设置 Vault

# Start Vault dev server
vault server -dev

# Set environment
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='root'

# Enable secrets engine
vault secrets enable -path=secret kv-v2

# Store secret
vault kv put secret/database/config username=admin password=secret

在 GitHub Actions 中使用 Vault

name: Deploy with Vault Secrets

on: [push]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Import Secrets from Vault
      uses: hashicorp/vault-action@v2
      with:
        url: https://vault.example.com:8200
        token: ${{ secrets.VAULT_TOKEN }}
        secrets: |
          secret/data/database username | DB_USERNAME ;
          secret/data/database password | DB_PASSWORD ;
          secret/data/api key | API_KEY

    - name: Use secrets
      run: |
        echo "Connecting to database as $DB_USERNAME"
        # Use $DB_PASSWORD, $API_KEY

在 GitLab CI 中使用 Vault

deploy:
  image: vault:latest
  before_script:
    - export VAULT_ADDR=https://vault.example.com:8200
    - export VAULT_TOKEN=$VAULT_TOKEN
    - apk add curl jq
  script:
    - |
      DB_PASSWORD=$(vault kv get -field=password secret/database/config)
      API_KEY=$(vault kv get -field=key secret/api/credentials)
      echo "Deploying with secrets..."
      # Use $DB_PASSWORD, $API_KEY

**参考：**请参阅 references/vault-setup.md

AWS Secrets Manager

存储密钥

aws secretsmanager create-secret \
  --name production/database/password \
  --secret-string "super-secret-password"

在 GitHub Actions 中检索

- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-region: us-west-2

- name: Get secret from AWS
  run: |
    SECRET=$(aws secretsmanager get-secret-value \
      --secret-id production/database/password \
      --query SecretString \
      --output text)
    echo "::add-mask::$SECRET"
    echo "DB_PASSWORD=$SECRET" >> $GITHUB_ENV

- name: Use secret
  run: |
    # Use $DB_PASSWORD
    ./deploy.sh

使用 AWS Secrets Manager 的 Terraform

data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "production/database/password"
}

resource "aws_db_instance" "main" {
  allocated_storage    = 100
  engine              = "postgres"
  instance_class      = "db.t3.large"
  username            = "admin"
  password            = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"]
}

GitHub Secrets

组织/仓库密钥

- name: Use GitHub secret
  run: |
    echo "API Key: ${{ secrets.API_KEY }}"
    echo "Database URL: ${{ secrets.DATABASE_URL }}"

环境密钥

deploy:
  runs-on: ubuntu-latest
  environment: production
  steps:
  - name: Deploy
    run: |
      echo "Deploying with ${{ secrets.PROD_API_KEY }}"

**参考：**请参阅 references/github-secrets.md

GitLab CI/CD 变量

项目变量

deploy:
  script:
    - echo "Deploying with $API_KEY"
    - echo "Database: $DATABASE_URL"

受保护和已屏蔽的变量

• 受保护：仅在受保护的分支中可用
• 已屏蔽：在作业日志中隐藏
• 文件类型：以文件形式存储

最佳实践

1. 绝不将密钥提交到 Git
2. 为每个环境使用不同的密钥
3. 定期轮换密钥
4. 实施最小权限访问
5. 启用审计日志
6. 使用密钥扫描工具（GitGuardian、TruffleHog）
7. 在日志中屏蔽密钥
8. 对静态存储的密钥进行加密
9. 尽可能使用短期令牌
10. 记录密钥要求

密钥轮换

使用 AWS 自动轮换

import boto3
import json

def lambda_handler(event, context):
    client = boto3.client('secretsmanager')

    # Get current secret
    response = client.get_secret_value(SecretId='my-secret')
    current_secret = json.loads(response['SecretString'])

    # Generate new password
    new_password = generate_strong_password()

    # Update database password
    update_database_password(new_password)

    # Update secret
    client.put_secret_value(
        SecretId='my-secret',
        SecretString=json.dumps({
            'username': current_secret['username'],
            'password': new_password
        })
    )

    return {'statusCode': 200}

手动轮换流程

1. 生成新密钥
2. 在密钥存储中更新密钥
3. 更新应用以使用新密钥
4. 验证功能
5. 撤销旧密钥

External Secrets Operator

Kubernetes 集成

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-backend
  namespace: production
spec:
  provider:
    vault:
      server: "https://vault.example.com:8200"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "production"

---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-credentials
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: database-credentials
    creationPolicy: Owner
  data:
  - secretKey: username
    remoteRef:
      key: database/config
      property: username
  - secretKey: password
    remoteRef:
      key: database/config
      property: password

密钥扫描

Pre-commit 钩子

#!/bin/bash
# .git/hooks/pre-commit

# Check for secrets with TruffleHog
docker run --rm -v "$(pwd):/repo" \
  trufflesecurity/trufflehog:latest \
  filesystem --directory=/repo

if [ $? -ne 0 ]; then
  echo "❌ Secret detected! Commit blocked."
  exit 1
fi

CI/CD 密钥扫描

secret-scan:
  stage: security
  image: trufflesecurity/trufflehog:latest
  script:
    - trufflehog filesystem .
  allow_failure: false

参考文件

• references/vault-setup.md - HashiCorp Vault 配置
• references/github-secrets.md - GitHub Secrets 最佳实践

相关技能

• github-actions-templates - 用于 GitHub Actions 集成
• gitlab-ci-patterns - 用于 GitLab CI 集成
• deployment-pipeline-design - 用于流水线架构