Provide proper place to store secrets & configuration

Again Sander, thanks for bringing this up. It is not the first time we hear about it. We will also look into this one, exploring what options we have. 

I was assuming that with a trend towards 'bring your own ID/authorization’, the need to store secrets would eventually get less. But that assumption might be wrong. 

Regards,

Jan-Willem

Just an update: We have started refining this and look for options. We wrote the following, sofar:

Enabling our app developers (=customers) to store app-related secrets on our cloud platform: probably a technical solution and user documentation.

Typical use cases: database credentials, storage access keys.

Requirements:

1. AIMMS running inside a pod can retrieve a secret needed by the app
2. CRUD on secrets
3. Must-have: at cloud customer account level
4. Could-have: at application-role level (later)

Possible solution 1:

1. Key Vault per cloud customer account
2. Managed Identity per cloud customer account
3. K8s Service Account to which the Managed Identity is linked through an environment variable
4. This will give the pod API access to the Key Vault
5. Provide an AIMMS library for Key Vault access

Possible solution 2:

1. Store customer-account-specific JSON files with secrets into our ‘central’ Key Vault
2. Provide that JSON file as environment to the application running inside the pod
3. Provide to app developers an API for CRUD on application secrets

Next step is technical refinement/design and then estimation of the effort required. But please let us know what you think sofar.

Jan-Willem

Hi Jan Willem, thanks for the update. For me, this request is (functionally) linked to this request: 

For that to succeed, I think that also the application level is needed (not only customer account level). (And indeed, application + role level would even be nicer.)

The technical implementation is outside of my area of expertise, so I’ll leave that up to you. 

You may well be right Sander. Thanks.

Jan-Willem

Sander, this item is on our ‘workbench’, trying to come up with a design, amidst some other projects.

Jan-Willem

Latest update: this has been planned for the current Program Increment, expecting a release in Q2 2025.

Unfortunately this got pushed back as other matters took priority. It is now due for release by 18 August.

Apologies for the delay.