Config & Secrets

Purpose and scope

Ensure configuration is externalized, versioned, and secure across environments.

Outcomes

• No secrets in repos or images.
• Environment parity and predictable rollouts.
• Fast, auditable config changes.

Signals of trouble

• .env files committed or passed around manually.
• Snowflake configs between environments.
• Secrets rotated inconsistently.

Remediation steps

1. Integrate a secrets manager (Vault/SSM) with apps and CI.
2. Store config overlays in Git; validate parity in CI.
3. Automate secret rotation and drift detection.

Checklists and assets

• playbooks/12factor-modernized/checklist.md config tasks.

References

• GitOps docs; internal security policies.