Tag: Security
All the articles with the tag "Security".
-
Teleport instead of a VPN: audited access to servers, Kubernetes, and databases
Teleport solves a different problem than NetBird or Cloudflare Tunnel: they give you network access, Teleport gives you audited access to a specific resource. We cover short-lived certificates instead of SSH keys and kubeconfig, session recording with tsh play, and resource-level RBAC — then wire up access to a test Kubernetes cluster with tsh kube login.
-
SPIFFE/SPIRE: cryptographic workload identity instead of static secrets
SPIFFE standardizes workload identity through short-lived SVID certificates, and SPIRE — its reference implementation — issues and rotates them via two-tier attestation (node + workload) with no pre-shared secret anywhere. We break down how it differs from external-secrets-operator, how federation works across clusters, and deploy SPIRE to fetch a real X.509-SVID for a test pod.
-
OpenTofu: state encryption and leaving Terraform without drama
OpenTofu encrypts state and plan client-side, before the backend ever sees them — a feature Terraform still doesn't have. We cover migration, key providers (PBKDF2, AWS/GCP KMS, OpenBao), and why backend encryption isn't the same thing.
-
Container Security: A Practical Checklist for Implementation
Updated:A practical security checklist for Docker and Kubernetes containers: images, privileges, secrets, networking, and runtime — what to verify before shipping to production.