tag: security
- SonarQube in GitLab CI: dotnet-sonarscanner and coverage delta GIT_DEPTH:0 for blame, custom SDK image per service via rules variables override, dotnet-coverage collection, coverage delta check against last successful pipeline via GitLab API.
- Vault JWT auth from GitLab CI: no static tokens Configuring Vault JWT auth with GitLab JWKS, per-environment roles with bound_claims on ref and project_path, short-lived Vault tokens in CI jobs, and kubeconfig fetched from Vault at deploy time.
- Security defaults in a FastAPI app: headers, auth, and input validation CSP, HSTS, HTTP Basic Auth with timing-safe comparison, and path traversal prevention — what's in the app and what's missing.
- Automatic TLS with cert-manager, Let's Encrypt, and Traefik IngressRoutes ClusterIssuers, HTTP-01 challenges, multi-SAN certificates, and addPrefix middleware for subdomain routing.
- Kubernetes RBAC patterns: per-namespace roles in GitOps Aggregated ClusterRoles for developer and devops, RoleBindings scoped per namespace managed by Flux, ClusterRoleBinding for monitoring read-only access.
- Trivy + SonarQube: security scanning in a GitLab CI pipeline Filesystem and live Kubernetes cluster scans with Trivy. SARIF for the repo scan, JSON-to-external-issues conversion for k8s findings, imported into SonarQube.
- cert-manager: wildcard certificates with DNS-01 challenge ClusterIssuer with ACME DNS-01 via Yandex Cloud DNS webhook. Certificate CR for *.dev.test.antonnovikov.com, sealed distribution to spoke clusters.
- Cilium NetworkPolicy: default-deny and DNS-aware rules Default-deny ingress per namespace, allow from APISIX, CiliumNetworkPolicy toFQDNs for external APIs, L7 HTTP path rules, cluster-wide Prometheus scrape policy.
- External Secrets Operator + HashiCorp Vault: Kubernetes auth flow ESO authenticates to Vault using a Kubernetes ServiceAccount token. ClusterSecretStore, ExternalSecret, and the bootstrap steps for Vault Kubernetes auth.
- Multi-stage Dockerfile for .NET: build once, run lean Three-stage pattern with restore/build/runtime layers, cache optimization by separating project files from source code, non-root user, readOnlyRootFilesystem, BuildKit registry caching in GitLab CI.
- DefectDojo in Kubernetes: security findings as a first-class CI gate DefectDojo HelmRelease, Trivy and SonarQube report upload via API, product and engagement model, SLA enforcement in CI that fails pipelines on unacknowledged high-severity findings.
- APISIX as Kubernetes ingress: rate limiting, JWT routing, and Lua plugins APISIX Ingress Controller with ApisixRoute, limit-count for rate limiting per consumer, JWT claim-based routing for A/B testing, serverless Lua plugin for request transformation, canary releases.
- Traefik Middleware for security headers: HSTS, CSP, and frame protection Traefik Middleware resources for HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Content-Security-Policy. IngressRoute wiring and testing headers with curl.
- Cilium network policy: default-deny and workload isolation Default-deny CiliumNetworkPolicy per namespace, selective allow rules for DNS, ingress controller, inter-service traffic, FQDN-based egress policies, and L7 HTTP policy for path-level control.
- Trivy Operator in Kubernetes: automated vulnerability scanning Trivy Operator deployment via Helm, VulnerabilityReport and ConfigAuditReport CRDs, Prometheus metrics integration, alerting on HIGH/CRITICAL CVEs, and Trivy in GitLab CI with SARIF upload.
- SonarQube in Kubernetes: deployment and GitLab CI integration SonarQube HelmRelease with PostgreSQL backend (CloudNativePG), GitLab OAuth, ESO for credentials, sonar-scanner-cli job in GitLab CI, GIT_DEPTH:0 for blame.
- SealedSecrets: storing encrypted kubeconfigs in git Bitnami SealedSecrets encrypt cluster credentials for safe git storage. Sealing workflow, namespace binding, update process, and controller troubleshooting.
- External Secrets Operator with HashiCorp Vault: JWT auth and KV v2 ESO ClusterSecretStore with Vault JWT authentication via Kubernetes service accounts, ExternalSecret syncing KV v2 paths, refresh interval, secret templating, and ESO vs SealedSecrets tradeoffs.
- Sealed Secrets: the full ceremony from install to cluster migration kubeseal workflow: controller install, offline sealing with pub cert, cert backup procedures, rotating controller keys, and re-sealing all secrets when migrating to a new cluster.
- HashiCorp Vault: bootstrap, unseal, and Kubernetes auth Vault HA with Raft storage, operator init ceremony, manual unseal vs YC KMS auto-unseal, Kubernetes auth method setup, KV v2, policies, and ESO role binding.
No posts match the selected filters.