Unajua kuzingatia usanidi wa kati na siri kwa njia ya huduma?

Question

Accepted Answer

Na kwa duzeni za huduma, huwezi kusimamia usanidi na siri ad hoc kwa kila upakaaji. **Usanidi wa kati** unashikilia mipangilio katika chanzo kimoja kinachoadhibiwa, na **waongozaji wa siri** huhifadhi maadili yenye heshima kwa salama.

## Usanidi uliotengana

Usanidi unaishi nje ya zana ya kujenga, kwa hivyo picha moja inafanya kazi katika dev/staging/prod na mipangilio tofauti.

```yaml
# values injected at runtime, not baked into the image
DATABASE_URL: ${DB_URL}        # per-environment
FEATURE_NEW_CHECKOUT: "true"   # toggle without redeploy
PAYMENT_TIMEOUT_MS: "3000"
```

## Njia za usanidi

| Njia | Mfano |
|---|---|
| Seva ya usanidi | Spring Cloud Config, Consul |
| Inayomilikiwa na mkutanishi | Kubernetes ConfigMaps |
| Mkutanishi wa siri | HashiCorp Vault, AWS Secrets Manager |

## Siri — ziweke kando

Usijahifadhi siri kwenye ConfigMaps za kawaida au git.

```bash
# fetch a secret at startup, short-lived, audited
export DB_PASSWORD=$(vault kv get -field=password secret/orders/db)
```

## Mbinu nzuri

```text
✓ Externalize config (12-factor): config in the environment
✓ Secrets in a dedicated manager with rotation + audit logs
✓ Dynamic refresh for non-secret toggles (no redeploy)
✗ Never commit secrets to source control
```

## Kwa nini inamaanisha

Usanidi wa kati hukuruhusu kubadilisha tabia (timeouts, bendera za sifa) na kuzunguka akaunti kwa huduma nyingi bila kujenga tena na kusambaza kila moja.

Kuhifadhi siri katika mkutanishi halisi wa siri — si picha au git — ni mahitaji ya usalama ya msingi ambayo inakua na idadi ya huduma.

Njia	Mfano
Seva ya usanidi	Spring Cloud Config, Consul
Inayomilikiwa na mkutanishi	Kubernetes ConfigMaps
Mkutanishi wa siri	HashiCorp Vault, AWS Secrets Manager