What’s the safest way to manage CI/CD credentials?
When I first built a deployment pipeline, I put database passwords and API keys in GitHub Actions Secrets and assumed encryption made them safe. I'm now realizing that…
short-lived tokens
What’s the safest way to manage CI/CD credentials?
When I first built a deployment pipeline, I stored database passwords and API keys in the platform's encrypted secrets store and assumed that was sufficient. I've since realized…
How do you protect kubeconfigs and use kubectl safely?
How do you manage kubeconfig files securely on your machine? I'm especially interested in setups where someone works on backend or frontend code while also administering clusters. If…
How do you safely manage kubeconfig files and kubectl credentials?
How are you managing kubeconfig files on your workstation, and what precautions do you take when running kubectl or similar tools? For people who work on applications while…
How should I replace long-lived Kubernetes credentials and restrict workloads outside the cluster?
I inherited a couple of in-cluster agent workloads that authenticate to internal APIs and a database using long-lived credentials stored in Kubernetes Secrets. There is also a static…
What’s the best way to support secure human API access without long-lived tokens?
We run an internal self-service platform API, and people need to access it from CLI tools and scripts. Right now, we create a static token, display it once…
What’s the best way to manage human access to an internal API?
We run an internal self-service platform API, and employees sometimes need to access it from command-line tools or scripts. Right now, we issue a static token, display it…