Tag: DevSecOps
All the articles with the tag "DevSecOps".
-
Renovate: dependency updates that don't drive you mad
Renovate instead of a flood of one-off PRs per dependency: packageRules grouping, schedules, automerge with a cooldown, and a self-hosted GitLab CI run. We cover the flow, the config, and where the automerge trust boundary sits.
-
OpenTofu: state encryption and leaving Terraform without drama
OpenTofu encrypts state and plan client-side, before the backend ever sees them — a feature Terraform still doesn't have. We cover migration, key providers (PBKDF2, AWS/GCP KMS, OpenBao), and why backend encryption isn't the same thing.
-
External Secrets Operator: Vault secrets in Kubernetes without copy-paste
External Secrets Operator syncs secrets from Vault and cloud Secret Managers straight into native Kubernetes Secrets. The SecretStore/ExternalSecret model, refreshInterval rotation, and a working Vault example.
-
Trivy in CI: catch vulns and generate an SBOM before prod
One pipeline step blocks vulnerable images from shipping and hands you an SBOM on the way. What Trivy scans, how to gate on severity, how to quiet the noise with .trivyignore and VEX, and how it ties into keyless signing.