Muster für das Secrets-Management in Cloud-Native-Anwendungen

# ❌ Secrets embedded in configuration
# docker-compose.yml
services:
  api:
    environment:
      DB_PASSWORD: "super_secret_password_123"
      API_KEY: "sk-live-abc123def456"
      JWT_SECRET: "my-jwt-signing-key"
# Visible in process listings, docker inspect,
# version control history, CI/CD logs

# ✅ Secrets referenced, not embedded
# docker-compose.yml
services:
  api:
    environment:
      DB_PASSWORD_FILE: /run/secrets/db_password
      API_KEY_FILE: /run/secrets/api_key
    secrets:
      - db_password
      - api_key
 
secrets:
  db_password:
    external: true
  api_key:
    external: true
# Secrets injected at runtime, never in config files

// Vault client with token renewal and secret lease management
import Vault from "node-vault";
 
interface VaultConfig {
  endpoint: string;
  roleId: string;
  secretId: string;
}
 
class SecretManager {
  private client: ReturnType<typeof Vault>;
  private leases: Map<string, { leaseId: string; ttl: number }> =
    new Map();
 
  constructor(private config: VaultConfig) {
    this.client = Vault({
      apiVersion: "v1",
      endpoint: config.endpoint,
    });
  }
 
  async authenticate(): Promise<void> {
    const result = await this.client.approleLogin({
      role_id: this.config.roleId,
      secret_id: this.config.secretId,
    });
    this.client.token = result.auth.client_token;
 
    // Schedule token renewal before expiry
    const renewalInterval =
      (result.auth.lease_duration * 0.75) * 1000;
    setInterval(() => this.renewToken(), renewalInterval);
  }
 
  private async renewToken(): Promise<void> {
    try {
      await this.client.tokenRenewSelf();
    } catch {
      // Token renewal failed — re-authenticate
      await this.authenticate();
    }
  }
 
  async getDatabaseCredentials(
    role: string
  ): Promise<{ username: string; password: string }> {
    const result = await this.client.read(
      `database/creds/${role}`
    );
 
    // Track lease for renewal
    this.leases.set(role, {
      leaseId: result.lease_id,
      ttl: result.lease_duration,
    });
 
    return {
      username: result.data.username,
      password: result.data.password,
    };
  }
 
  async getSecret(path: string): Promise<Record<string, string>> {
    const result = await this.client.read(
      `secret/data/${path}`
    );
    return result.data.data;
  }
 
  async revokeAllLeases(): Promise<void> {
    for (const [, lease] of this.leases) {
      await this.client.write("sys/leases/revoke", {
        lease_id: lease.leaseId,
      });
    }
    this.leases.clear();
  }
}
 
// Usage with automatic credential rotation
const vault = new SecretManager({
  endpoint: process.env.VAULT_ADDR ?? "http://vault:8200",
  roleId: process.env.VAULT_ROLE_ID ?? "",
  secretId: process.env.VAULT_SECRET_ID ?? "",
});
 
await vault.authenticate();
 
// Dynamic database credentials — unique per instance,
// automatically expired
const dbCreds = await vault.getDatabaseCredentials(
  "api-readonly"
);

# ❌ Kubernetes Secret — base64 encoded, not encrypted
apiVersion: v1
kind: Secret
metadata:
  name: api-credentials
data:
  api-key: c2stbGl2ZS1hYmMxMjNkZWY0NTY=
# base64 is NOT encryption. Anyone with repo access
# can decode this.

# ✅ Sealed Secret — encrypted, safe to commit
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: api-credentials
  namespace: production
spec:
  encryptedData:
    api-key: AgBy3i4OJSWK+PiTySYZZA9r...
    # Encrypted with the cluster's public key
    # Only the sealed-secrets controller can decrypt
  template:
    metadata:
      name: api-credentials
    type: Opaque

# Workflow: encrypt locally, commit safely
# Fetch the cluster's public cert
kubeseal --fetch-cert \
  --controller-namespace kube-system \
  > pub-cert.pem
 
# Encrypt a secret value
echo -n "sk-live-abc123" | kubeseal \
  --raw \
  --from-file=/dev/stdin \
  --namespace production \
  --name api-credentials \
  --cert pub-cert.pem
 
# The output is safe to commit to Git

// ❌ Scattered secret access throughout codebase
async function handleRequest(req: Request) {
  const apiKey = process.env.STRIPE_API_KEY; // Where does this come from?
  const dbUrl = process.env.DATABASE_URL;     // Who rotates this?
  // Secrets scattered across handler files
}

// ✅ Centralized secret provider with lazy loading
interface SecretProvider {
  get(key: string): Promise<string>;
  getAll(keys: string[]): Promise<Map<string, string>>;
}
 
class CompositeSecretProvider implements SecretProvider {
  constructor(
    private providers: SecretProvider[],
  ) {}
 
  async get(key: string): Promise<string> {
    for (const provider of this.providers) {
      try {
        return await provider.get(key);
      } catch {
        continue;
      }
    }
    throw new Error(`Secret not found: ${key}`);
  }
 
  async getAll(
    keys: string[]
  ): Promise<Map<string, string>> {
    const results = new Map<string, string>();
    for (const key of keys) {
      results.set(key, await this.get(key));
    }
    return results;
  }
}
 
// File-based provider for Docker/Kubernetes secrets
class FileSecretProvider implements SecretProvider {
  constructor(private basePath: string = "/run/secrets") {}
 
  async get(key: string): Promise<string> {
    const filePath = `${this.basePath}/${key}`;
    const content = await fs.readFile(filePath, "utf-8");
    return content.trim();
  }
 
  async getAll(
    keys: string[]
  ): Promise<Map<string, string>> {
    const results = new Map<string, string>();
    for (const key of keys) {
      results.set(key, await this.get(key));
    }
    return results;
  }
}
 
// Environment variable provider as fallback
class EnvSecretProvider implements SecretProvider {
  async get(key: string): Promise<string> {
    const value = process.env[key];
    if (!value) {
      throw new Error(`Environment variable ${key} not set`);
    }
    return value;
  }
 
  async getAll(
    keys: string[]
  ): Promise<Map<string, string>> {
    const results = new Map<string, string>();
    for (const key of keys) {
      results.set(key, await this.get(key));
    }
    return results;
  }
}
 
// Application bootstrap: resolve all secrets once at startup
const secrets = new CompositeSecretProvider([
  new FileSecretProvider(),
  new EnvSecretProvider(),
]);
 
const config = {
  stripeKey: await secrets.get("STRIPE_API_KEY"),
  databaseUrl: await secrets.get("DATABASE_URL"),
  jwtSecret: await secrets.get("JWT_SECRET"),
};
// Pass config to services — no secret lookups in handlers

// Dual-read pattern for zero-downtime rotation
interface RotatableSecret {
  current: string;
  previous: string | null;
  rotatedAt: Date;
}
 
class RotatingApiKeyValidator {
  private keys: RotatableSecret;
 
  constructor(keys: RotatableSecret) {
    this.keys = keys;
  }
 
  validate(providedKey: string): boolean {
    // Accept both current and previous during rotation window
    if (providedKey === this.keys.current) return true;
    if (
      this.keys.previous &&
      providedKey === this.keys.previous
    ) {
      // Log that a client is still using the old key
      console.warn(
        "Request using previous API key — client needs update"
      );
      return true;
    }
    return false;
  }
}
 
// Rotation procedure:
// 1. Generate new secret, store as "current"
// 2. Move old "current" to "previous"
// 3. Deploy — services accept both keys
// 4. Update all clients to use new key
// 5. After grace period, remove "previous"