Environment Variables and Secrets

# CHAPTER 10

Environment Variables and Secrets #

1. Introduction #

2. Learning Objectives #

• Distinguish between standard Environment Variables and Encrypted Secrets.

• Set and utilize Environment Variables dynamically within a pipeline.

• Securely store credentials in GitHub Repository Secrets (or Jenkins Credentials).

• Inject Encrypted Secrets into pipeline steps safely.

• Understand the risks of Secret leakage in CI/CD log files.

3. Beginner-Friendly Explanation #

• Environment Variable (Public Info): You leave a sticky note on the fridge: "The thermostat is set to 72 degrees. The dog's name is Buster." Anyone walking through the house can read this. It configures how the house operates, but it's not a secret.

• Secret (Encrypted Data): You have a locked safe in the basement containing the keys to your Ferrari. You give the house sitter the combination, but tell them never to write it down.

In a CI pipeline, the Node.js version is an Environment Variable. The AWS Database Password is a Secret. Both are injected into the pipeline at runtime, but Secrets are heavily guarded.

4. Standard Environment Variables #

name: Environment Variable Demo

# Define globally. Available to all jobs.
env:
  NODE_ENV: production
  APP_PORT: 8080

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Print Variables
        # The variables are injected into the bash shell
        run: echo "Deploying app in $NODE_ENV mode on port $APP_PORT"

5. Managing Encrypted Secrets #

Once saved, the value is permanently encrypted. You cannot even view it again in the UI; you can only update it or delete it.

To use the secret in your pipeline, you use the ${{ secrets.SECRET_NAME }} context.

      - name: Deploy to Cloud Provider
        run: ./deploy_script.sh
        # Inject the secrets securely into the step's environment
        env:
          AWS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
          AWS_SECRET: ${{ secrets.AWS_SECRET_KEY }}

6. Mini Project: Configure Encrypted Deployment Secrets #

Step-by-Step Architecture Concept:

1. 1. Generate an API token from your external service (e.g., xoxb-12345-secret-token).

1. 2. Save it in GitHub Secrets as SLACK_BOT_TOKEN.

1. 3. Create the workflow:

name: Secure Notification Pipeline

on: [push]

jobs:
  notify-team:
    runs-on: ubuntu-latest
    steps:
      - name: Send Slack Notification
        uses: slackapi/slack-github-action@v1.24.0
        with:
          # The Action reads this specific payload
          payload: |
            {
              "text": "Deployment to Production is complete! :rocket:"
            }
        env:
          # The Action REQUIRES the SLACK_WEBHOOK_URL to be in the environment.
          # We securely inject it from our encrypted vault.
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

*The API token is never exposed in the code, yet the pipeline successfully authenticates to Slack and sends the message.*

7. Real-World Scenarios #

• Least Privilege Principle: Never create a single, master AWS IAM user with "Administrator Access" and put its keys in your CI/CD Secrets. If the CI pipeline is hacked, the attacker owns your entire company. Create a highly restricted IAM user that ONLY has permission to upload files to a specific S3 bucket, and use *those* keys in the CI pipeline. If leaked, the damage is heavily contained.

• Avoid Command-Line Arguments for Secrets: Never pass a secret directly as a command-line argument.

• Empty Secrets: If a pipeline script fails with an "Authentication Denied" or "Missing Password" error, but the YAML looks perfect, the most common culprit is a typo in the Secret name. If you write ${{ secrets.AWS_KEY }} but the secret is actually named AWS_ACCESS_KEY, GitHub will simply inject a blank empty string ("") without throwing a YAML error, causing silent authentication failures.

• Q: Describe the mechanism by which highly sensitive credentials (like AWS Secret Keys) should be injected into a CI/CD pipeline. Why is committing these credentials to version control a catastrophic security failure?

• Q: Explain how modern CI platforms (like Jenkins or GitHub Actions) handle log masking to prevent the accidental exposure of injected Secrets. What coding practices can inadvertently bypass this masking?