Secrets Are Not Configuration

.env files were fine until migrations, rotations, Kubernetes, OIDC, and app sprawl turned them into a liability.

Original work date

June

The problem

At small scale, .env files felt good enough. Then the environment grew. Apps moved hosts. Docker gave way to k3s. OIDC secrets regenerated. Databases stayed external. App configs needed to be restored, moved, and updated.

The environment

• App: Infisical, k3s, various apps
• Host:
• Cluster / namespace:
• Version:
• Relevant config: .env files

What failed

Suddenly, secrets were not just “configuration.” They were scattered operational risk.

The fix

Infisical became part of the platform foundation before the k3s app migration. Secrets could be stored centrally and delivered into Kubernetes through the operator instead of recreating the same .env sprawl in a new format.

Final state

What I learned

A secret copied everywhere is not really a secret.

Useful commands / config

paste commands here