Security & Supply Chain
Security as part of the pipeline rather than an audit at the end: secrets through workload identity instead of static keys, SLSA provenance, SBOMs and the CRA deadlines, admission policies. And a clear line between what regulation demands and what is simply sensible.
-
CSP behind a consent gate: why a green header proves nothing
The evaluator flagged two errors and both turned out to be dead entries. The real defect surfaced only once the check ran against browser behaviour instead of the header.
-
External Secrets Operator + Workload Identity: secrets access without a single long-lived key
An external secret store answers where secrets live — and creates a new secret: the credential for the store itself. How ESO and workload identity close the loop with no long-lived keys.
-
Cyber Resilience Act: why you need an SBOM by September 2026, not 2027
Everyone is watching December 2027, but vulnerability reporting starts a year earlier — and you cannot report what your inventory cannot list.
-
SLSA L0–L3 and provenance: a chain of trust from commit to admission
An SBOM tells you «what's inside», a signature tells you «who signed». Between them sits provenance — «how it was built». After SolarWinds that's the question admission has to ask.
-
DevSecOps in five stages: from secret-scan to admission policy
Five CI stages with exit-code 1 plus a cluster-side admission gate — the only pattern under which DevSecOps actually blocks production instead of running as a green-checkmark ritual.