Secrets, identity and the supply chain

the database password is fetched at start-up from a service that logs who asked, instead of sitting in the repository.

Secret management

the same API key is in a pipeline variable, two config maps, a wiki page and someone's laptop, and rotating it breaks three things.

Secret sprawl

the token the workload holds expires in fifteen minutes, so a leaked one is worth almost nothing by the time it is found.

Short-lived credential

the service proves what it is to the cloud without holding any credential, because the platform attests to it.

Workload identity

the thing calling the API is not a person, and its permissions were granted once in 2022 by someone who has left.

Service account

an internal HTTP endpoint hands out the machine's cloud credentials to anything running on it that can make a request.

Instance metadata service

your pipeline swaps its own identity for a short-lived role in the target account, and that swap is logged.

Role assumption

the pipeline authenticates to the cloud with a signed token from its own provider, so there is no stored key at all.

Identity federation

the key never leaves the service; you send it data to encrypt and it sends the result back, logging every call.

Key management service

the data is encrypted with a key that is itself encrypted by a key you never see, and rotating the outer one does not rewrite the data.

Envelope encryption

everything worked for a year and then stopped at once on a Sunday, because a certificate nobody owned had expired.

Certificate rotation

the role was widened during an incident three years ago and nothing has ever narrowed it again.

Privilege creep

teams can create their own roles, and none of the roles they create can exceed the ceiling you set.

Permission boundary

nobody holds production access by default; you request it, state why, and it expires by itself in an hour.

Just-in-time access

there is a sealed credential that bypasses every control, its use pages three people, and it has been used twice.

Break-glass access

every change request to the platform is recorded with who made it and what it was, in a place they cannot edit.

Control plane audit log

the rule that every workload must set resource limits is a file with tests, and it fails the pipeline rather than a review.

Policy as code

the deployment was rejected at submission because the image was unsigned and it asked to run as root.

Admission controller

your artefact contains code from four hundred projects you have never read and a build system nobody has audited.

Software supply chain

an attacker published a package with your internal name at a higher version, and the build helpfully preferred it.

Dependency confusion

the cluster refuses to run an image that is not signed by your pipeline, so a pushed-by-hand image simply will not start.

Artefact signing

you can prove which commit, which builder and which inputs produced this exact image, from a signed statement rather than a wiki page.

Build provenance

the scan result, the test outcome and the review approval are each signed statements attached to the artefact's digest.

Attestation