<p>You can achieve this in multiple ways.</p>
<p>You can set your credentials as secrets if you use a CI/CD system such as Jenkins or Gitlab pipelines. Then reference them within your pipeline script as variables and inject the credentials into your application during the build. This will not expose the credentials in the CI/CD system logs. Please refer to the following articles for more information:</p>
<p><a href="https://docs.gitlab.com/ee/ci/variables/" rel="nofollow noreferrer">https://docs.gitlab.com/ee/ci/variables/</a></p>
<p><a href="https://www.jenkins.io/doc/book/using/using-credentials/" rel="nofollow noreferrer">https://www.jenkins.io/doc/book/using/using-credentials/</a></p>
<p><a href="https://devops.com/how-to-securely-manage-secrets-within-jenkins/" rel="nofollow noreferrer">https://devops.com/how-to-securely-manage-secrets-within-jenkins/</a></p>
<p>Depending on your application security requirements, you can set up an identity-based secret and encryption management system such as <code>Hashicorp Vault.</code> Vault provides encryption services that are gated by authentication and authorization methods. You can create a role for your CI/CD system within the Vault and get the secrets during the build to auto-generate a <code>.env</code> file. Learning the vault concepts may take a decent amount of time.</p>
<p><a href="https://docs.gitlab.com/ee/ci/secrets/" rel="nofollow noreferrer">https://docs.gitlab.com/ee/ci/secrets/</a></p>

CC BY-SA 4.0
2022-11-11T02:41:13.653Z
2022-11-11T02:41:13.653Z
ThatTechGuy
<p>I know I can use CD pipelines to deploy an app to a given environment (dev/stage/prod)</p>
<p>Given that each environment should have its own environment variables/secrets for each app, how can I streamline the process of securely setting those variables/secrets in each environment without having to ssh into the environment server and create a .env file for the specific app/environment that's being deployed?</p>
<p>I've heard of KeyVaults but I'm not sure if that's overkill for a single set of environments.</p>

<continuous-deployment><environments><environment-variables>
Deploying environment secrets to services
Jordan Renaud
# Deploying environment secrets to services

(Asked by: username_0 on 2022-11-10)

I know I can use CD pipelines to deploy an app to a given environment (dev/stage/prod)

Given that each environment should have its own environment variables/secrets for each app, how can I streamline the process of securely setting those variables/secrets in each environment without having to ssh into the environment server and create a .env file for the specific app/environment that's being deployed?

I've heard of KeyVaults but I'm not sure if that's overkill for a single set of environments.

**Tags:** continuous-deployment, environments, environment-variables


---

## 1 answers

### Answer by username_1 on 2022-11-11. Score: 1

You can achieve this in multiple ways.

You can set your credentials as secrets if you use a CI/CD system such as Jenkins or Gitlab pipelines. Then reference them within your pipeline script as variables and inject the credentials into your application during the build. This will not expose the credentials in the CI/CD system logs. Please refer to the following articles for more information:

<https://docs.gitlab.com/ee/ci/variables/>

<https://www.jenkins.io/doc/book/using/using-credentials/>

<https://devops.com/how-to-securely-manage-secrets-within-jenkins/>

Depending on your application security requirements, you can set up an identity-based secret and encryption management system such as `Hashicorp Vault.` Vault provides encryption services that are gated by authentication and authorization methods. You can create a role for your CI/CD system within the Vault and get the secrets during the build to auto-generate a `.env` file. Learning the vault concepts may take a decent amount of time.

<https://docs.gitlab.com/ee/ci/secrets/>


---

