云端密码与 secrets 管理器 采用零知识加密

  pipelines:  default:  - step:  name: Deploy with Passwork credentials  image: passwork/passwork-cli:latest  script:  - passwork-cli exec --password-id 'deploy_credentials' -- ./deploy.sh  environment:  - PASSWORK_HOST=https://your-passwork.domain  - PASSWORK_TOKEN=$PASSWORK_TOKEN  - PASSWORK_MASTER_KEY=$PASSWORK_MASTER_KEY  

  from passwork_client import PassworkClient # Client initialization passwork = PassworkClient("https://your-passwork.domain") passwork.set_tokens("your_access_token", "your_refresh_token") passwork.set_master_key("your_master_key")  # Getting secrets database_item = passwork.get_item(item_id=PASSWORD_ID) database_password = database_item['password']  # Using in application db_connection = connect_to_database(  host="prod-db.company.com",  password=database_password )  

  # Running container with access to secrets docker run --rm \  -e PASSWORK_HOST=https://your-passwork.domain \  -e PASSWORK_TOKEN=your_access_token \  -e PASSWORK_MASTER_KEY=your_master_key \  passwork/passwork-cli:latest \  exec --folder-id FOLDER_ID --tags "production" -- python app.py  # Or in docker-compose services:  app:  image: passwork/passwork-cli:latest  command: exec --folder-id ${FOLDER_ID} --tags "production" -- ./start-app.sh  environment:  - PASSWORK_HOST=https://your-passwork.domain  - PASSWORK_TOKEN=${PASSWORK_TOKEN}  - PASSWORK_MASTER_KEY=${PASSWORK_MASTER_KEY}  

  # Via YAML manifest passwork-cli exec --folder-id FOLDER_ID --tags "production" -- sh -c " cat <<EOF | kubectl apply -f - apiVersion: v1 kind: Secret metadata:  name: app-production-config  namespace: production type: Opaque stringData:  database-url: \"postgresql://\$DB_USERNAME:\$DB_PASSWORD@\$DB_HOST:5432/app\"  redis-url: \"redis://:\$REDIS_PASSWORD@redis:6379\"  api-key: \"\$API_KEY\"  webhook-secret: \"\$WEBHOOK_SECRET\" EOF"