In this lesson, you will learn how to inject sensitive credentials into your CI/CD runners without leaking them into plaintext logs or vulnerable environment variables.
The Problem with Standard Environment Variables
In many CI/CD configurations, developers rely on injecting secrets as standard environment variables. While convenient, this approach is fraught with risk: these variables are often captured by debug logs, visible to child processes, and easily inspected via env commands within a compromised container. If a build step logs the entire environment for debugging, your production tokens are exposed.
Secure Injection via Mounted Files
Instead of environment variables, use ephemeral secret files mounted into the runner's filesystem. Most orchestrators (like Kubernetes-native runners) allow you to map a secret provider (such as HashiCorp Vault or Kubernetes Secrets) to a specific path, such as /run/secrets/api_key.
By reading the secret directly from a file, you prevent the token from being exported into the runner's shell process environment. Furthermore, you should configure your CI/CD platform to mask these values in logs. Even if a script executes cat /run/secrets/api_key, the platform’s output filter will detect and redact the content.
Example: Kubernetes Volume Mount
In a Kubernetes-based runner, define the secret as a volume to ensure it is only accessible to the specific task:
spec:
containers:
- name: build-step
volumeMounts:
- name: secret-volume
mountPath: "/etc/secrets"
readOnly: true
volumes:
- name: secret-volume
secret:
secretName: my-deployment-token
Avoiding Log Leaks
Even with file-based injection, you must be cautious. Avoid commands like echo $MY_TOKEN or env in your pipeline scripts. If a command fails, the pipeline might dump all variables to the stdout log. Use dedicated secrets managers that integrate with your runner to dynamically inject secrets just-in-time, and ensure your runner’s service account is restricted to the minimum required access, following the principle of least privilege.
Key Takeaway: Prioritize file-based secret mounting over environment variables to isolate sensitive data from process introspection and prevent accidental exposure in pipeline logs.