The best automation is the script you wrote once and forgot about. Until you realize you’d be miserable without it. That’s the bar I hold every workflow script to: will this save me more time than it took to write? Most “productivity automation” content you find online fails that test. The scripts look clever in a conference talk, end up in your dotfiles, and collect dust. They solve hypothetical problems, not real ones. ...
A Kubernetes Secret is not actually secret. That’s a hard sentence to sit with, especially if you’ve been dutifully creating Secret objects and patting yourself on the back for not hardcoding credentials in your ConfigMap. The problem runs deeper than most teams realize, and it doesn’t get fixed by following the basic Kubernetes documentation. This post is about what actually works, at different scales, with honest tradeoffs for each approach. ...
It started with a misconfigured CI runner. A developer had a Jenkins pipeline building Docker images. The container ran as root. A dependency had a known RCE vulnerability. When the exploit landed, the attacker had root inside the container, and because that process was root, they also had root on the host. They pivoted to the secrets store, grabbed credentials, and spent three weeks inside the network before anyone noticed. ...
Note: This guide combines personal experience from writing deployment scripts across macOS, Linux, and Windows environments with patterns documented in the Python pathlib documentation, Git documentation, PowerShell cross-platform guidance, Python subprocess module, and GitHub Actions runner images. A deployment script that works on macOS. A colleague runs it on Windows. It fails immediately. The culprit? A hardcoded forward slash in a file path. I’ve seen this exact scenario play out multiple times over the past five years, and it’s almost always preventable. ...
Update (January 2026): The package versions in this tutorial were current as of March 2024. While the concepts and approach remain valid, you should check for newer versions of the tools mentioned (Hadolint, Terrascan, pre-commit hooks, etc.). Most importantly, update actions/checkout@v3 to actions/checkout@v4 in your workflows - v3 uses deprecated Node.js 16. As I continue this series on CI/CD pipeline security, it is time to now work on securely building and deploying our application. This post picks up where my Build Secure Python Pipelines: Adding Tests and Hooks in Action post left off. ...