We deploy several .NET microservices to Kubernetes, and each service has its own configuration. Currently, a Jenkins job generates an application.json file, which is deployed as a ConfigMap and referenced by the application. We would like to replace this with a cleaner approach using ConfigMaps and Secrets to override values from the built-in application.json.
In a previous environment, we used Ansible with several layers of YAML files. A playbook merged the files in order to produce the final configuration, but this led to duplicated variables and made it difficult to understand where the effective value came from.
I'm looking for a solution with a useful UI, clear access control, and preferably a way to inspect the evaluated configuration. Developers should be able to manage normal configuration, while sensitive values such as passwords and API keys should be restricted to authorized users.
I have considered OpenBao, Infisical, and Phase. OpenBao does not make the fully resolved configuration especially easy to inspect, Phase appears focused mainly on secrets rather than both ConfigMaps and Secrets, and the self-hosted licensing options for Infisical seem expensive.
What tools or patterns are you using for this? Is there another solution I should consider?
3 Answers
A clean pattern is to keep ordinary configuration in version-controlled YAML and generate the ConfigMaps with Jsonnet, Kustomize, or Helm. Changes can then go through review and deployment automation. Keep passwords, API keys, and other sensitive values in a vault rather than in the configuration files.
For secrets, OpenBao combined with External Secrets Operator works well. Store the secret values in OpenBao, then let the operator create or update Kubernetes Secrets from them. Applications can reference those Secrets while their non-sensitive configuration remains plain YAML. Secret refreshes can happen periodically, and a refresh can also be triggered when a value changes.
A hybrid approach may fit better than trying to make one product solve everything. A configuration-management platform such as Chef can provide more predictable policy and attribute handling than deeply nested file merges, along with a UI for evaluated state and job history. Kubernetes can still render the non-sensitive ConfigMaps, while External Secrets Operator handles the bridge from the secret store into the cluster.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures