weblogtag
security
20 posts with this tag, newest first.
Tags, archive, series1 active
Tags
Archive
More
Posts 20
-
SonarQube in GitLab CI: dotnet-sonarscanner and coverage delta
GIT_DEPTH:0 for blame, custom SDK image per service via rules variables override, dotnet-coverage collection, coverage delta check against last successful pipeline via GitLab API.
-
Vault JWT auth from GitLab CI: no static tokens
Configuring Vault JWT auth with GitLab JWKS, per-environment roles with bound_claims on ref and project_path, short-lived Vault tokens in CI jobs, and kubeconfig fetched from Vault at deploy time.
-
Security defaults in a FastAPI app: headers, auth, and input validation
CSP, HSTS, HTTP Basic Auth with timing-safe comparison, and path traversal prevention — what's in the app and what's missing.
-
Automatic TLS with cert-manager, Let's Encrypt, and Traefik IngressRoutes
ClusterIssuers, HTTP-01 challenges, multi-SAN certificates, and addPrefix middleware for subdomain routing.
-
Kubernetes RBAC patterns: per-namespace roles in GitOps
Aggregated ClusterRoles for developer and devops, RoleBindings scoped per namespace managed by Flux, ClusterRoleBinding for monitoring read-only access.
-
Trivy + SonarQube: security scanning in a GitLab CI pipeline
Filesystem and live Kubernetes cluster scans with Trivy. SARIF for the repo scan, JSON-to-external-issues conversion for k8s findings, imported into SonarQube.
-
cert-manager: wildcard certificates with DNS-01 challenge
ClusterIssuer with ACME DNS-01 via Yandex Cloud DNS webhook. Certificate CR for *.dev.test.antonnovikov.com, sealed distribution to spoke clusters.
-
Cilium NetworkPolicy: default-deny and DNS-aware rules
Default-deny ingress per namespace, allow from APISIX, CiliumNetworkPolicy toFQDNs for external APIs, L7 HTTP path rules, cluster-wide Prometheus scrape policy.
-
External Secrets Operator + HashiCorp Vault: Kubernetes auth flow
ESO authenticates to Vault using a Kubernetes ServiceAccount token. ClusterSecretStore, ExternalSecret, and the bootstrap steps for Vault Kubernetes auth.
-
Multi-stage Dockerfile for .NET: build once, run lean
Three-stage pattern with restore/build/runtime layers, cache optimization by separating project files from source code, non-root user, readOnlyRootFilesystem, BuildKit registry caching in GitLab CI.
-
DefectDojo in Kubernetes: security findings as a first-class CI gate
DefectDojo HelmRelease, Trivy and SonarQube report upload via API, product and engagement model, SLA enforcement in CI that fails pipelines on unacknowledged high-severity findings.
-
APISIX as Kubernetes ingress: rate limiting, JWT routing, and Lua plugins
APISIX Ingress Controller with ApisixRoute, limit-count for rate limiting per consumer, JWT claim-based routing for A/B testing, serverless Lua plugin for request transformation, canary releases.
-
Traefik Middleware for security headers: HSTS, CSP, and frame protection
Traefik Middleware resources for HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Content-Security-Policy. IngressRoute wiring and testing headers with curl.
-
Cilium network policy: default-deny and workload isolation
Default-deny CiliumNetworkPolicy per namespace, selective allow rules for DNS, ingress controller, inter-service traffic, FQDN-based egress policies, and L7 HTTP policy for path-level control.
-
Trivy Operator in Kubernetes: automated vulnerability scanning
Trivy Operator deployment via Helm, VulnerabilityReport and ConfigAuditReport CRDs, Prometheus metrics integration, alerting on HIGH/CRITICAL CVEs, and Trivy in GitLab CI with SARIF upload.
-
SonarQube in Kubernetes: deployment and GitLab CI integration
SonarQube HelmRelease with PostgreSQL backend (CloudNativePG), GitLab OAuth, ESO for credentials, sonar-scanner-cli job in GitLab CI, GIT_DEPTH:0 for blame.
-
SealedSecrets: storing encrypted kubeconfigs in git
Bitnami SealedSecrets encrypt cluster credentials for safe git storage. Sealing workflow, namespace binding, update process, and controller troubleshooting.
-
External Secrets Operator with HashiCorp Vault: JWT auth and KV v2
ESO ClusterSecretStore with Vault JWT authentication via Kubernetes service accounts, ExternalSecret syncing KV v2 paths, refresh interval, secret templating, and ESO vs SealedSecrets tradeoffs.
-
Sealed Secrets: the full ceremony from install to cluster migration
kubeseal workflow: controller install, offline sealing with pub cert, cert backup procedures, rotating controller keys, and re-sealing all secrets when migrating to a new cluster.
-
HashiCorp Vault: bootstrap, unseal, and Kubernetes auth
Vault HA with Raft storage, operator init ceremony, manual unseal vs YC KMS auto-unseal, Kubernetes auth method setup, KV v2, policies, and ESO role binding.
No posts match the selected filters.