Basically, trying to wrap my brain around how I should be handling secrets using Docker, k8s, and Skaffold in a dev environment. I'm pretty new to this tech, so don't fully understand all of it.

Just not sure if I should be using a .env, or config.json, that isn't committed to the repo, or if there is a better way with using Docker.

Ideally, I could just refer to process.env.API_KEY in my code, regardless of environment, and it would just work and grab the correct environmental variables. If it is in production in AWS, it would just grab the keys from Key Management Services. In production, it would just grab them from where ever.

Did come across this, which seems to apply to Docker Swarm so may not be relevant:


So what is the best practice using Docker, k8s, Skaffold for handling environmental variables and secrets in developement?

1 Answer 1


Generally best practice in this kind of setup is to make use of some kind of secrets management tool. The theory is that you want secrets to be injected into containers at runtime and restrict who has access to them as much as possible.

For Kubernetes, you can use the in-built secrets resource type. There's some good documentation on it here.

One thing to watch for is that you need to enable an additional option to ensure the secrets are encrypted at rest. There's documentation on how to do this here.

If you want something more flexible, or with additional features, there are a wide array of third party secrets management tools available. Hashicorp Vault is one of the more used options here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .