Skip to content

SECRETS_MANAGEMENT.md

Latest commit

 

History

History
83 lines (57 loc) · 2.39 KB

SECRETS_MANAGEMENT.md

File metadata and controls

83 lines (57 loc) · 2.39 KB
Raw

Secrets Management

Overview

The FlossWare Platform implements secure secrets management to prevent credential exposure in configuration files, logs, and backups. Credentials are no longer stored in plaintext and are instead referenced from external secret management systems or environment variables.

Security Goals

  1. No Plaintext Credentials - Credentials never stored in YAML descriptors
  2. Encrypted Storage - Secrets stored in external systems (Vault, AWS)
  3. Auditability - Secret access logged with audit trails
  4. Rotability - Credentials rotatable without code changes
  5. No Leakage - Credentials masked in all logs and errors

Supported Secret Providers

Environment Variables (Built-in)

The simplest solution. Secret values injected as environment variables at deployment.

Configuration:

classpath:
  - url: https://repo.example.com/libs
    auth:
      type: basic
      username: ${REPO_USERNAME}
      password: ${REPO_PASSWORD}

Deployment:

export REPO_USERNAME=myuser
export REPO_PASSWORD=mypassword
java -Dplatform.config=application.yaml ...

Implementation

Three new classes in platform-api:

  1. SecretsProvider - Interface for secret retrieval
  2. EnvironmentVariablesSecretsProvider - Environment variable implementation
  3. CredentialMasker - Utility for masking credentials in logs

Changes to IsolatedClassLoader

  • Added resolveSecret() method for credential resolution
  • Updated getAuthFromDescriptor() to resolve secrets
  • Never logs plaintext credentials
  • Supports ${VARNAME} syntax for environment variables

Changes to ApplicationDescriptor

  • Added resolveProperty() method for custom secret resolution
  • Updated documentation to mention environment variable support

Migration

  1. Replace plaintext credentials with ${VAR_NAME} references
  2. Set environment variables before deployment
  3. Verify no credentials in logs or version control

Testing

Comprehensive tests included:

  • EnvironmentVariablesSecretsProviderTest
  • CredentialMaskerTest
  • IsolatedClassLoaderTest enhancements for environment variable resolution

Issue Reference

GitHub Issue #323: SECURITY - Implement Secrets Management for Credential Storage

Addresses:

  • Credentials in plaintext in YAML files
  • Passwords logged in debugging output
  • Credentials in configuration backups
  • No encryption at rest
  • No credential rotation mechanism