weblogtag
cicd
18 posts with this tag, newest first.
Tags, archive, series1 active
Tags
Archive
More
Posts 18
-
NuGet library CI: versioning from branch name and dual-registry publish
dotnet pack with version from branch name, push to GitLab Package Registry via CI_JOB_TOKEN, selective publish to Artifactory for stable releases with manual gate and user restriction.
-
SonarQube in GitLab CI: dotnet-sonarscanner and coverage delta
GIT_DEPTH:0 for blame, custom SDK image per service via rules variables override, dotnet-coverage collection, coverage delta check against last successful pipeline via GitLab API.
-
GitLab CI multi-environment pipeline: workflow rules and deploy gates
workflow.rules to suppress duplicate pipelines, stages for dev/test/demo/preprod/prod, per-environment deploy jobs extending a shared .deploy anchor, manual prod gate with user restrictions, Grafana deploy annotations.
-
Helm chart config pattern: Files.Get, tpl, and the config/ directory
Storing appsettings.json as a consul-template HCL source in config/, loading rendered output into ConfigMaps with Files.Get + tpl, subPath volumeMounts, and checksum annotations for forced rolling restarts.
-
consul-template in the GitLab CI deploy job
Using consul-template -once to render Vault secrets into Helm chart config/ before helm upgrade. HCL template patterns for per-service and shared secrets, CA cert rendering, and why this beats ESO for CI-time secret injection.
-
Vault JWT auth from GitLab CI: no static tokens
Configuring Vault JWT auth with GitLab JWKS, per-environment roles with bound_claims on ref and project_path, short-lived Vault tokens in CI jobs, and kubeconfig fetched from Vault at deploy time.
-
Flux Image Update Automation: auto-bump image tags in git
ImageRepository scans the registry, ImagePolicy selects the right tag (semver, regex), ImageUpdateAutomation commits the updated tag back to git via marker annotations.
-
Trivy + SonarQube: security scanning in a GitLab CI pipeline
Filesystem and live Kubernetes cluster scans with Trivy. SARIF for the repo scan, JSON-to-external-issues conversion for k8s findings, imported into SonarQube.
-
GitLab CI for an infra repo: lint, validate, and flux reconcile
Pipeline stages for a Kubernetes infra repository: yamllint, kubectl kustomize per environment, flux reconcile on merge, Telegram/Mattermost notifications.
-
Helm chart testing: lint, unit tests, and ct in CI
helm lint, helm-unittest for template assertions, chart-testing (ct) for changed-chart detection, CI/CD stub values files, and what to actually test in your Helm charts.
-
GitLab CI DinD: Docker builds with BuildKit caching
Docker-in-Docker setup with TLS, registry layer caching with mode=max, registry mirror to bypass DockerHub rate limits, multi-arch builds with QEMU, and Trivy scan in the same pipeline.
-
Helm values-per-environment: the -f layering pattern
Base values.yaml with production defaults, minimal per-env override files, FluxCD HelmRelease inline values, dry-run template verification, and why to avoid --set in production pipelines.
-
GitLab CI Docker deploy pipeline: build, push, and rolling update
Full GitLab CI pipeline for containerized apps: Docker build with BuildKit layer caching, push to private registry, kubectl rollout with SHA-pinned image tags, multi-environment promotion, and registry cleanup job.
-
DefectDojo in Kubernetes: security findings as a first-class CI gate
DefectDojo HelmRelease, Trivy and SonarQube report upload via API, product and engagement model, SLA enforcement in CI that fails pipelines on unacknowledged high-severity findings.
-
Trivy Operator in Kubernetes: automated vulnerability scanning
Trivy Operator deployment via Helm, VulnerabilityReport and ConfigAuditReport CRDs, Prometheus metrics integration, alerting on HIGH/CRITICAL CVEs, and Trivy in GitLab CI with SARIF upload.
-
Terraform modules for PostgreSQL RBAC: roles, users, and default privileges
Reusable Terraform modules for PostgreSQL using the cyrilgdn/postgresql provider: db_role, db_user, default_privileges, S3 backend state locking, and GitLab CI pipeline for plan/apply with env promotion.
-
GitLab Runner in Kubernetes
Helm deployment, Docker-in-Docker with emptyDir for TLS certs, per-job resource limits in runner config, registration token via ESO, S3 cache for fast builds.
-
SonarQube in Kubernetes: deployment and GitLab CI integration
SonarQube HelmRelease with PostgreSQL backend (CloudNativePG), GitLab OAuth, ESO for credentials, sonar-scanner-cli job in GitLab CI, GIT_DEPTH:0 for blame.
No posts match the selected filters.