Secrets & access
Articles tagged Secrets & access — notes and deep-dives grouped under this topic.
-
External Secrets Operator + Workload Identity: secrets access without a single long-lived key
An external secret store answers where secrets live — and creates a new secret: the credential for the store itself. How ESO and workload identity close the loop with no long-lived keys.
-
DevSecOps in five stages: from secret-scan to admission policy
Five CI stages with exit-code 1 plus a cluster-side admission gate — the only pattern under which DevSecOps actually blocks production instead of running as a green-checkmark ritual.
-
OIDC → AWS STS: CI/CD Without Long-Lived Keys
Federated identity replaces AWS_ACCESS_KEY_ID in CI/CD: one pattern for GitHub, GitLab and Atlantis — no rotation, real CloudTrail attribution.