Careeroza

Secrets and Network Security

Managing Secrets

  • Never commit passwords, client secrets or API keys (Razorpay key secret!) to Git, not even in a private repo.
  • Inject them as environment variables or mounted files from Kubernetes Secrets, HashiCorp Vault (Spring Cloud Vault), AWS Secrets Manager or GCP Secret Manager.
  • Kubernetes Secrets are only base64-encoded by default: enable encryption at rest and restrict who can read them (RBAC). Tools like External Secrets Operator or Sealed Secrets keep them out of Git.
  • Rotate secrets regularly; short-lived dynamic DB credentials from Vault are even better.

Config tree

Spring Boot reads mounted secret files with a config tree import:

application.yml

spring:
  config:
    import: optional:configtree:/etc/secrets/     # file /etc/secrets/spring.datasource.password -> property

Example output

$ ls /etc/secrets
spring.datasource.password  razorpay.key-secret

Lock Down the Internal Network

NetworkPolicy

A Kubernetes NetworkPolicy that lets only order-service (and the gateway) reach payment-service:

payment-netpol.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: payment-service-ingress
  namespace: shopease
spec:
  podSelector:
    matchLabels:
      app: payment-service
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: order-service
        - podSelector:
            matchLabels:
              app: api-gateway
      ports:
        - protocol: TCP
          port: 8084

Example output

$ kubectl -n shopease exec deploy/product-service -- curl -s -m 3 http://payment-service:8084/actuator/health
curl: (28) Connection timed out after 3001 milliseconds
  • Only the gateway (through an Ingress) is reachable from the internet; services use internal ClusterIP Services.
  • Run actuator on a separate management port (management.server.port: 9090) that is never exposed publicly.
  • Secure Kafka with SASL/SSL and topic ACLs so only payment-service can write to payment-events.