What’s the right way to revoke access when an employee or contractor leaves?
I'm trying to understand what a solid offboarding process looks like for a small engineering team. When someone leaves, we may have SSH keys on several servers, shared…
secrets management
What’s a good way to manage application configuration and secrets across Kubernetes environments?
We deploy several .NET microservices to Kubernetes, and each service has its own configuration. Currently, a Jenkins job generates an application.json file, which is deployed as a ConfigMap…
Where did teams move after HCP Vault Secrets shut down?
HCP Vault Secrets was shut down a few months ago, and the suggested replacement, HCP Vault Dedicated, works quite differently. Many teams originally chose HVS because they didn't…
What’s the best way to manage layered Kubernetes configuration and secrets?
I have extensive experience but have never designed configuration management for a fleet of applications. We deploy .NET microservices to Kubernetes, each with its own configuration. Today, a…
What’s the best way to manage application configuration and secrets across Kubernetes services?
We deploy a fleet of .NET microservices to Kubernetes, and each service currently receives a generated application.json file through a ConfigMap. A Jenkins job builds that file before…
What’s the safest way to manage secrets in production Kubernetes?
In a production Kubernetes environment, which approach do you generally recommend for storing, accessing, and rotating secrets? The main options I'm considering are native Kubernetes Secrets, the Secrets…
Is There Any Advantage to Buying 1Password Through AWS Marketplace?
I'm looking for a way to centralize secrets across multiple environments and possibly use 1Password as a basic key-value store. During deployments, I'd like a script to load…
Should I Buy 1Password Through AWS Marketplace for Secrets Management?
I'm considering 1Password as a central place to manage secrets across multiple environments. The plan is to keep basic key-value secrets there, then use scripts during deployments to…
What’s the safest way to manage CI/CD credentials?
When I first built a deployment pipeline, I put database passwords and API keys in GitHub Actions Secrets and assumed encryption made them safe. I'm now realizing that…
How do you manage third-party API keys when edge functions use OIDC?
OIDC makes a lot of sense for cloud services because edge functions can exchange a runtime identity for short-lived credentials instead of storing permanent AWS access keys in…
How Can I Determine Whether a Leaked API Key Is Still Active Without Using It?
I'm building a decision-making system that receives a possible leaked API key and decides whether to ignore it, verify it, or trigger removal and rotation. It currently considers…
After moving to workload identity, how much secret management is actually left?
I'm trying to understand what remains after replacing long-lived cloud credentials with workload identity and OIDC. Using identities for services like AWS or S3 seems to eliminate a…
How should I replace long-lived Kubernetes credentials and restrict workloads outside the cluster?
I inherited a couple of in-cluster agent workloads that authenticate to internal APIs and a database using long-lived credentials stored in Kubernetes Secrets. There is also a static…
Should We Use One Azure Key Vault per Application or a Shared Vault per Environment?
Our platform team is designing Azure Key Vault usage for several applications in the same ART. We are considering either a separate vault for each application or one…
What’s the safest way to store secrets collected by a Flask app?
I'm building a Flask application that collects sensitive values such as API tokens and needs to retain them on a Linux system. My initial idea was to write…
What’s the best way to manage database credentials and grants for Kubernetes services at scale?
We run services on AWS using RDS, EKS, Redshift, and DocumentDB. Today, Liquibase applies schema changes with shared credentials from Parameter Store, while a Jenkins library creates per-application…
Is it safe to keep all GitOps deployments in one repository?
I'm setting up GitOps for the first time, and the advice I've seen says it's perfectly normal to keep all deployment manifests in a single repository. That setup…
How should I integrate Checkmarx DAST into a CI/CD pipeline?
I'm a penetration tester working on a CI/CD integration with Checkmarx. I understand the basics, but I need guidance on three areas: securely managing pipeline secrets, running authenticated…
What’s the Most Practical Path from Scattered CI/CD Secrets to Runtime Injection?
Our secrets have accumulated in several places over the past year: a few repositories, .env files, Jenkins credentials, and developers' laptops. I want to fix this before it…
How should I manage secrets for Docker Compose files stored in Git?
I'm considering putting my Docker Compose files and application stacks in a Git repository so a server can pull and deploy them. I understand that passwords, API keys,…