What's your workflow to pass cloud secrets/config metadata to apps safely?
- Terraform or Pulumi outputs → Vault/KMS → CI replaces values in YAML → K8s secrets operator injects env vars → app starts → DATABASE_PASSWORD typo, chaos ensues.
- Copy-pasted creds from Slack or Teams.
- Secrets/configs left in plaintext files or repos.
- Password managers with outdated entries that no one really trusts.
As a developer, what frustrates me most is the lack of predictability. Between Terraform, Vaults, pipelines, and operators, it’s often unclear who “owns” the truth — and every layer can quietly introduce drift.
So I’m curious:
- How are you handling that handoff today? - Are you still pushing everything through Vault + env vars, or have you built something cleaner? - What has actually worked for you in production — and what’s bitten you later?
Would love to hear some real war stories or simple patterns that actually hold up over time.