Kepiye carane nangani konfigurasi terpusat lan rahasia ing saindene layanan?

Question

Accepted Answer

Kanthi puluhan layanan, sampeyan ora bisa nangani config lan rahasia ad hoc saben deployment. **Konfigurasi terpusat** njaga setelan ing siji sumber sing dikelola, lan **manajer rahasia** nyimpen nilai sensitif kanthi aman.

## Konfigurasi sing dibuwang

Konfigurasi manggon ing luar artefak build, mula gambar sing padha mbukak ing dev/staging/prod kanthi setelan beda.

```yaml
# values injected at runtime, not baked into the image
DATABASE_URL: ${DB_URL}        # per-environment
FEATURE_NEW_CHECKOUT: "true"   # toggle without redeploy
PAYMENT_TIMEOUT_MS: "3000"
```

## Pendekatan konfigurasi

| Pendekatan | Contoh |
|---|---|
| Config server | Spring Cloud Config, Consul |
| Ndhéwé orchestrator | Kubernetes ConfigMaps |
| Manajer rahasia | HashiCorp Vault, AWS Secrets Manager |

## Rahasia — tetep adoh

Jangan nduwe rahasia ing ConfigMaps biasa utawa git.

```bash
# fetch a secret at startup, short-lived, audited
export DB_PASSWORD=$(vault kv get -field=password secret/orders/db)
```

## Praktek apik

```text
✓ Externalize config (12-factor): config in the environment
✓ Secrets in a dedicated manager with rotation + audit logs
✓ Dynamic refresh for non-secret toggles (no redeploy)
✗ Never commit secrets to source control
```

## Kenapa iku penting

Konfigurasi terpusat ngidini sampeyan ngganti perlakuan (timeouts, bendera fitur) lan muteraké kredensyal ing saindene layanan tanpa nggawe ulang lan ngluncurake ulang saben sawijining.

Mumet rahasia ing manajer rahasia nyata — ora ing gambar utawa git — iku syarat keamanan garis dasar sing mendhak karo nomer layanan.

Pendekatan	Contoh
Config server	Spring Cloud Config, Consul
Ndhéwé orchestrator	Kubernetes ConfigMaps
Manajer rahasia	HashiCorp Vault, AWS Secrets Manager