|
| 1 | +# Secrets |
| 2 | + |
| 3 | +<blockquote class="info"> |
| 4 | +This article explains how to use secrets in a workspace. To authenticate the |
| 5 | +workspace provisioner, see <a href="./templates/authentication">this</a>. |
| 6 | +</blockquote> |
| 7 | + |
| 8 | +Coder is open-minded about how you get your secrets into your workspaces. |
| 9 | + |
| 10 | +## Wait a minute... |
| 11 | + |
| 12 | +Your first stab at secrets with Coder should be your local method. |
| 13 | +You can do everything you can locally and more with your Coder workspace, so |
| 14 | +whatever workflow and tools you already use to manage secrets may be brought |
| 15 | +over. |
| 16 | + |
| 17 | +For most, this workflow is simply: |
| 18 | + |
| 19 | +1. Give your users their secrets in advance |
| 20 | +1. Your users write them to a persistent file after |
| 21 | + they've built their workspace |
| 22 | + |
| 23 | +<a href="./templates#parameters">Template parameters</a> are a dangerous way to accept secrets. |
| 24 | +We show parameters in cleartext around the product. Assume anyone with view |
| 25 | +access to a workspace can also see its parameters. |
| 26 | + |
| 27 | +## Dynamic Secrets |
| 28 | + |
| 29 | +Dynamic secrets are attached to the workspace lifecycle and automatically |
| 30 | +injected into the workspace. For a little bit of up front template work, |
| 31 | +they make life simpler for both the end user and the security team. |
| 32 | + |
| 33 | +This method is limited to |
| 34 | +[services with Terraform providers](https://registry.terraform.io/browse/providers), |
| 35 | +which excludes obscure API providers. |
| 36 | + |
| 37 | +Dynamic secrets can be implemented in your template code like so: |
| 38 | + |
| 39 | +```hcl |
| 40 | +resource "twilio_iam_api_key" "api_key" { |
| 41 | + account_sid = "ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" |
| 42 | + friendly_name = "Test API Key" |
| 43 | +} |
| 44 | +
|
| 45 | +resource "coder_agent" "dev" { |
| 46 | + # ... |
| 47 | + env = { |
| 48 | + # Let users access the secret via $TWILIO_API_SECRET |
| 49 | + TWILIO_API_SECRET = "${twilio_iam_api_key.api_key.secret}" |
| 50 | + } |
| 51 | +} |
| 52 | +``` |
| 53 | + |
| 54 | +A catch-all variation of this approach is dynamically provisioning a cloud service account (e.g [GCP](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_key#private_key)) |
| 55 | +for each workspace and then making the relevant secrets available via the cloud's secret management |
| 56 | +system. |
| 57 | + |
| 58 | +## Coder SSH Key |
| 59 | + |
| 60 | +Coder automatically inserts an account-wide SSH key into each workspace. In MacOS |
| 61 | +and Linux this key is at `~/.ssh/id_ecdsa`. You can view and |
| 62 | +regenerate the key in the dashboard at Settings > SSH keys. |
0 commit comments