Almost every developer has used a .env file.
You add:
DATABASE_URL
JWT_SECRET
API_KEYThe application works.
Then another developer needs those values.
CI/CD needs them.
Staging needs them.
Production needs them.
Before you know it, the same secret exists in multiple places.
And then one day, that secret needs to be rotated.
Now the difficult questions begin:
Which applications are using it?
Which developers have a copy?
Which pipeline still has the old value?
Which environment did we forget to update?
This is why secret management isn't just about where you store a password.
It's also about how you access, distribute, update, and eventually rotate it.
And that's exactly what inspired this week's video.
🎥 What If We Remove the .env File?
In this video, I start with a simple FastAPI application using secrets from a local .env file.
Then I remove them.
The application is no longer ready.
Instead of putting the .env file back, I use Infisical.
The interesting part?
I don't change the application code.
The application still reads normal environment variables.
What changes is where those values come from and who is allowed to access them.
👉 Watch the video:
https://youtu.be/-SP7nhNijm4
One Important Problem: Secret Zero
There is another question that every secrets-management architecture eventually has to answer:
If Infisical stores my secrets, how does my application authenticate to Infisical?
For the local demo, I use an Infisical Machine Identity with Universal Auth.
In production, we can go further with approaches such as OIDC, Kubernetes authentication, or cloud workload identities.
The goal isn't to pretend that trust disappears.
The goal is to make that trust smaller, controlled, and auditable.
What You'll See
In the hands-on demo, we cover:
✅ Why .env files become a problem when secrets start spreading
✅ Running the application with and without local secrets
✅ Machine Identity and Secret Zero
✅ Injecting secrets with Infisical without changing application code
✅ Updating configuration and seeing the application pick up the new value
✅ What I would do differently in production
No complicated product tour.
Just one real problem and one practical implementation.
The Biggest Lesson
The dangerous part of a secret isn't only the secret itself.
It's how many uncontrolled copies of it exist.
Good secret management should help you answer:
Who can access it?
Which environment does it belong to?
Which workload needs it?
What happens when it changes?
And who changed it?
That's a much better way to think about secrets than simply asking:
"Where should we store our passwords?"
💼 DevOps Jobs — Freshers to 12+ Years
A lot of you have also been asking me to share DevOps job opportunities.
So I've started curating openings across different experience levels — from freshers to experienced DevOps, Cloud, SRE, and Platform Engineers.
Instead of randomly applying everywhere, check the roles that match your skills and experience and apply directly.
👉 View the DevOps job openings:
https://docs.google.com/spreadsheets/d/18_of0Ez0tfkma0BD13n63cnFoIl1Qdmd_FtMP6yT6w8/edit?gid=0#gid=0
I'll continue adding useful opportunities when I find them.
Share this list with someone currently looking for a DevOps role.
🚨 Practice Production Troubleshooting
Kubernetes Production Incident Challenge
👉 https://topmate.io/learnwithdevopsengineer/2039398
CI/CD Production Simulation Pack
👉 https://topmate.io/learnwithdevopsengineer/2054727
Need Help With Your Infrastructure?
For Azure, Kubernetes, Terraform, CI/CD, Platform Engineering, and production infrastructure implementation:
Looking for Sponsors
Building high-quality, production-focused educational content takes a significant amount of time.
Every project involves research, architecture, implementation, testing, documentation, recording, editing, and maintaining open-source repositories.
If your company builds products in:
Kubernetes
CNCF
Cloud Native
Platform Engineering
DevOps
AI Infrastructure
Observability
Security
Developer Tooling
and you'd like to support this educational series, I'd love to hear from you.
📧 Sponsorship & Partnerships:
[email protected]
Let's build something valuable for the engineering community together.
One Final Thought
One year ago, this channel was an idea.
Today, it's a growing community of engineers learning together.
The next year isn't just about learning Kubernetes.
It's about learning how modern production platforms are actually built.
I hope you'll join me for the journey.
See you in the next episode.
Arbaz
📺 YouTube: https://youtube.com/@learnwithdevopsengineer
📬 Newsletter: https://learnwithdevopsengineer.beehiiv.com/subscribe
📸 Instagram: https://instagram.com/learnwithdevopsengineer
☕ Support / Labs: https://buymeacoffee.com/learnwithdevopsengineer