tag: cicd
- NuGet library CI: versioning from branch name and dual-registry publish dotnet pack with version from branch name, push to GitLab Package Registry via CI_JOB_TOKEN, selective publish to Artifactory for stable releases with manual gate and user restriction.
- SonarQube in GitLab CI: dotnet-sonarscanner and coverage delta GIT_DEPTH:0 for blame, custom SDK image per service via rules variables override, dotnet-coverage collection, coverage delta check against last successful pipeline via GitLab API.
- GitLab CI multi-environment pipeline: workflow rules and deploy gates workflow.rules to suppress duplicate pipelines, stages for dev/test/demo/preprod/prod, per-environment deploy jobs extending a shared .deploy anchor, manual prod gate with user restrictions, Grafana deploy annotations.
- Helm chart config pattern: Files.Get, tpl, and the config/ directory Storing appsettings.json as a consul-template HCL source in config/, loading rendered output into ConfigMaps with Files.Get + tpl, subPath volumeMounts, and checksum annotations for forced rolling restarts.
- consul-template in the GitLab CI deploy job Using consul-template -once to render Vault secrets into Helm chart config/ before helm upgrade. HCL template patterns for per-service and shared secrets, CA cert rendering, and why this beats ESO for CI-time secret injection.
- Vault JWT auth from GitLab CI: no static tokens Configuring Vault JWT auth with GitLab JWKS, per-environment roles with bound_claims on ref and project_path, short-lived Vault tokens in CI jobs, and kubeconfig fetched from Vault at deploy time.
- Flux Image Update Automation: auto-bump image tags in git ImageRepository scans the registry, ImagePolicy selects the right tag (semver, regex), ImageUpdateAutomation commits the updated tag back to git via marker annotations.
- Trivy + SonarQube: security scanning in a GitLab CI pipeline Filesystem and live Kubernetes cluster scans with Trivy. SARIF for the repo scan, JSON-to-external-issues conversion for k8s findings, imported into SonarQube.
- GitLab CI for an infra repo: lint, validate, and flux reconcile Pipeline stages for a Kubernetes infra repository: yamllint, kubectl kustomize per environment, flux reconcile on merge, Telegram/Mattermost notifications.
- Helm chart testing: lint, unit tests, and ct in CI helm lint, helm-unittest for template assertions, chart-testing (ct) for changed-chart detection, CI/CD stub values files, and what to actually test in your Helm charts.
- GitLab CI DinD: Docker builds with BuildKit caching Docker-in-Docker setup with TLS, registry layer caching with mode=max, registry mirror to bypass DockerHub rate limits, multi-arch builds with QEMU, and Trivy scan in the same pipeline.
- Helm values-per-environment: the -f layering pattern Base values.yaml with production defaults, minimal per-env override files, FluxCD HelmRelease inline values, dry-run template verification, and why to avoid --set in production pipelines.
- GitLab CI Docker deploy pipeline: build, push, and rolling update Full GitLab CI pipeline for containerized apps: Docker build with BuildKit layer caching, push to private registry, kubectl rollout with SHA-pinned image tags, multi-environment promotion, and registry cleanup job.
- DefectDojo in Kubernetes: security findings as a first-class CI gate DefectDojo HelmRelease, Trivy and SonarQube report upload via API, product and engagement model, SLA enforcement in CI that fails pipelines on unacknowledged high-severity findings.
- Trivy Operator in Kubernetes: automated vulnerability scanning Trivy Operator deployment via Helm, VulnerabilityReport and ConfigAuditReport CRDs, Prometheus metrics integration, alerting on HIGH/CRITICAL CVEs, and Trivy in GitLab CI with SARIF upload.
- Terraform modules for PostgreSQL RBAC: roles, users, and default privileges Reusable Terraform modules for PostgreSQL using the cyrilgdn/postgresql provider: db_role, db_user, default_privileges, S3 backend state locking, and GitLab CI pipeline for plan/apply with env promotion.
- GitLab Runner in Kubernetes Helm deployment, Docker-in-Docker with emptyDir for TLS certs, per-job resource limits in runner config, registration token via ESO, S3 cache for fast builds.
- SonarQube in Kubernetes: deployment and GitLab CI integration SonarQube HelmRelease with PostgreSQL backend (CloudNativePG), GitLab OAuth, ESO for credentials, sonar-scanner-cli job in GitLab CI, GIT_DEPTH:0 for blame.
No posts match the selected filters.