Manage configuration and secrets
Classify every value as a constant, a deployment parameter, or a secret; load configuration through the standard precedence chain, parsed once and fail-closed; and keep secrets out of git by referencing them at runtime and committing only encrypted-at-rest .env files.
Units5
Duration26 min
Levelintermediate
By the end of this module, you'll be able to:
- Classify any value as a domain invariant (a code constant), a deployment parameter (typed config), or a secret (a runtime reference), using the 12-Factor litmus test.
- Load configuration through a standard precedence chain, parsed once at the boundary into one typed, immutable value that fails closed on invalid or missing input.
- Select an environment by which overlay file loads, not by branching on
dev/prodin code. - Keep secrets out of git: hold a
SecretRefin config, resolve it at runtime, and commit only encrypted-at-rest.envfiles with the private key held in the secret store.
Prerequisites
- Basic familiarity with environment variables and a service's startup configuration.
- Helpful but not required: an AI-native org's non-negotiable floor (least privilege, docs-as-code).
Units
- 01Introduction4 min
- 02The configuration model7 min
- 03Secrets and environments7 min
- 04Knowledge check5 min
- 05Summary3 min
Related
- Design and version an API Shape a clean, consistent API against a clear API design standard - resources, standard methods, typed errors, cursor pagination, idempotency - then version and deprecate it under a versioning policy so no consumer is ever broken without consent.
- Apply the naming standards Name a new identifier, file, repo, or branch the way an AI-native org does - keyword-first, no redundant prefix, cased by role - and tell a functional keyword apart from a product codename, so your first artifact passes the naming gate by default.
- Read the pipeline that ships your change Follow a change from a pull request through the canonical CI stage set to a gated production deploy - the ordered gates a pipeline runs, why CI is the real gate, and how the deployment model promotes one signed artifact dev to staging to prod.