Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Configuration or Secret? Classifying Settings, Twelve-Factor and Where Secrets Leak
A secret is any setting that lets someone act on your behalf once they have it, and its only natural home is a secret store; build-time, runtime and environment-specific config can live in the repo or the environment. Using Bookstore we see, with real output, a key left in Git history, a connection string exposed by docker inspect, /proc/environ and createdump, and an API key in the Angular bundle, then build the inventory that leads to the series' goal of secretless access.
One Artifact, Many Environments: Configuration Layering in .NET, Environment Variables and Runtime Config in Angular
To run one artifact in many environments, put only shared defaults into the artifact and supply environment-specific values at deploy time through environment variables or a runtime config file. On .NET 10 we measure provider order (a BOOKSTORE_ prefix beats the command line, an ASPNETCORE_ prefix loses to appsettings), set up fail fast with ValidateOnStart and [OptionsValidator], and generate Angular's config.json at runtime with provideAppInitializer and an nginx entrypoint.
Azure Key Vault with .NET: Managed Identity, RBAC, the Configuration Provider and the Right Credential in Production
A .NET app should reach Key Vault without carrying a password, through a managed identity holding the Key Vault Secrets User role on that vault only, and production should use ManagedIdentityCredential instead of DefaultAzureCredential. We set up AddAzureKeyVault with a prefixed secret manager and ReloadInterval, and see with real output from a local emulator the reload, a three-minute startup without managed identity, and an unresolved App Service reference left as the value.
Azure App Configuration: Centralized Configuration, Labels for Environments, Sentinel-Key Refresh and Key Vault References
Azure App Configuration is for non-secret settings that several services share and that must change without a deploy; secrets stay in Key Vault and the store holds only references. On the official emulator we see, with real output, labels separating environments, a change that does not apply until the sentinel key changes, an unresolved Key Vault reference stopping startup and the 1-second refresh floor, and we manage changes through pull requests and a pipeline.
HashiCorp Vault and OpenBao: KV, Auth Methods, Policies and Dynamic Credentials for SQL Server
Vault and OpenBao create a new, short-lived database user on every startup, and the best way to keep the app unaware of Vault is to read the file Vault Agent writes with reloadOnChange. We set up KV v2, policies and AppRole and see with real output on SQL Server lease renewal, a stored connection string failing with "Login failed" after revoke, a revoke stuck without KILL permission, and OpenBao lacking a SQL Server plugin.
Secrets in Containers and Kubernetes: External Secrets Operator, Secrets Store CSI Driver and Workload Identity
In Kubernetes a secret should come from Vault or Key Vault; the External Secrets Operator turns it into a Kubernetes Secret, while the Secrets Store CSI Driver puts it straight into the pod's volume. Measured on kind, a change in Vault reached the pod reading a volume in about 56 seconds, while the pod using environment variables kept the old value until restarted. We also see CSI rotation being off by default, an ARG token left in docker history, and BuildKit secret mounts and Compose secrets.
Secret Rotation and Leak Response: Rotating Without Downtime, the First 60 Minutes After a Leak and Secretless Architecture
Seamless rotation treats two secrets as valid for a while: the new secret is added on the accepting side first, used once it has spread everywhere, and the old one is removed based on measurement. We rotate Bookstore's payment webhook secret with primary and secondary values without a restart, scope a leak with Vault's audit log, automate with Key Vault's SecretNearExpiry event, and reach a secretless architecture with zero secrets for Azure and database access.