Secrets Belong in a Managed Store, Not in Code

Detailed practical guide

Prepare your workspace and inputs

Use only a fake credential while rehearsing. The example application path is /opt/credential-lab/read_credential.py and the service identity is credential-lab; create those through your host’s normal test-service provisioning process. The credential source belongs in a root-controlled file, not the repository.

Platform context: Linux test VM with systemd supporting LoadCredential= (introduced in systemd 247), Python 3 and an existing dedicated test service identity. Verify installed manual support first.

Scenario to reproduce or investigate

A scheduled integration reads an API key hard-coded in a script. A deploy may replace the script but leave copied secrets in history, command arguments and logs. Runtime delivery needs its own access and rotation procedure.

1. Verify the deployed credential mechanism and file ownership

   Check systemd --version and the installed systemd.exec manual for LoadCredential. Have the test-service owner create a root-controlled credential source /etc/credential-lab/api_token containing a fake token and restrictive ownership and permissions. Record only the path, owner and access policy, never the value.

   Command, configuration or input

   systemd --version
   stat /etc/credential-lab/api_token

   Expected result · ผลที่ควรเห็น

   The installed manager supports the directive, the source file is outside the repository and only the approved owner can modify it.

   If it fails · เมื่อไม่ผ่าน

   If LoadCredential is unsupported, use the organization’s supported secrets provider integration rather than silently falling back to a token embedded in Environment= or a command argument.

2. Read the runtime credential without logging its contents

   Save the Python application at the approved test path. systemd provides CREDENTIALS_DIRECTORY to a service using credentials. This code checks presence and returns only a generic readiness message; the real client should pass the value directly to its authenticated backend request without logging it.

   Command, configuration or input

   import os
   from pathlib import Path
   
   directory = os.environ.get("CREDENTIALS_DIRECTORY")
   if not directory:
       raise SystemExit("credential directory is unavailable")
   token = (Path(directory) / "api_token").read_text(encoding="utf-8").strip()
   if not token:
       raise SystemExit("credential is empty")
   print("Credential loaded; value intentionally not printed")

   Expected result · ผลที่ควรเห็น

   A correctly started test service prints only the readiness message; the token does not appear in stdout or process arguments.

   If it fails · เมื่อไม่ผ่าน

   If the directory is unavailable, confirm that the service is launched by the configured unit rather than directly from a shell. If reading fails, inspect identity and credential delivery without copying the value into the ticket.

3. Configure the isolated service and rehearse replacement

   Use this unit only after the named test user and paths exist. Save the prior unit configuration, verify the candidate with systemd-analyze verify, then deploy through the host’s approved service process. Replacing the source file is not enough for a running consumer: rehearse the supported service restart or reload and verify a real test authentication with the replacement token.

   Command, configuration or input

   [Unit]
   Description=Disposable credential delivery exercise
   
   [Service]
   Type=oneshot
   User=credential-lab
   LoadCredential=api_token:/etc/credential-lab/api_token
   ExecStart=/usr/bin/python3 /opt/credential-lab/read_credential.py
   NoNewPrivileges=yes
   PrivateTmp=yes

   Expected result · ผลที่ควรเห็น

   The unit reads the delivered credential, no plaintext value is logged and the real integration test accepts the replacement while rejecting the revoked old test token.

   If it fails · เมื่อไม่ผ่าน

   If the new token loads but authentication fails, investigate the provider-side scope or activation before revoking a still-needed credential. File loading alone does not prove a secret was rotated at its issuer.

Recovery and cleanup

Retain the previous non-secret unit and application revisions. Remove the disposable unit and fake credential through the host process after rehearsal. For real rotation, recover through a newly issued scoped credential rather than restoring a known exposed token.

Apply to actual work and known limits

Use a managed secret provider where required by your platform. LoadCredential provides service delivery; it does not itself implement provider issuance, revocation, enterprise audit or a complete secret lifecycle.

Authored against the cited documentation. Execution on the stated vendor product or physical equipment remains to be verified.