How to Manage Environment Variables for Continuous Deployment

Question

So, a common practice these days is to put connection strings & passwords as environment variables to avoid their being placed into a file. This is all fine and dandy, but I'm not sure how to make this work when trying to set up a continuous deployment workflow with some configuration management tool such as Salt/Ansible or Chef/Puppet.

Specifically, I have the following questions in environments using the above mentioned configuration management tools:

1. Where do you store connection strings/passwords/keys separate from codebases?
   • Do you keep those items in a code-repo of some type (git, etc.)?
   • Do you use some structure built-in to your tool?
2. How do you keep those same items secure?
3. Do you track changes/back-up these items, and if so, how?

Answer 1

In Chef you can

1. store passwords or API tokens in either encrypted data bags or using chef-vault. They are then decrypted while chef does the provisioning (with encrypted data bags using a shared secret, with chef-vault using the existing PKI of Chef client).
2. set environment variables when calling external software using the environment parameter of e.g. the execute resource.
3. not sure, what to write here -- I'd say you don't really manage them. This way you set the variables only for the command that needs it, not e.g. for the whole chef run.