Sachin Chaurasiya
Search articles, labs, tools…

Articles

Technical articles

Practical, in-depth guides on DevOps, DevSecOps, Kubernetes, cloud security and infrastructure — with real commands, working examples and lessons from production.

Sachin Chaurasiya Written and maintained by Sachin Chaurasiya DevOps & DevSecOps Engineer · CKS · CKA · Azure DevOps

Start here

Prefer a structured route? Start with one of these paths, or browse all 9.

View all learning paths

  • DevSecOps Pipeline

    Security gates developers can live with: secrets, SAST and image scanning in GitLab CI and Jenkins.

    3 articles · 3 labs

  • CI/CD Engineering

    How a delivery pipeline really runs: build, test, artifact, deployment and rollback.

    4 articles · 2 labs

  • Kubernetes Operations

    Run workloads on a real cluster: controllers, probes and limits, real failures, Services and DNS, scaling.

    5 articles · 2 labs

Recommended

Hand-picked articles to get the most value from the site.

View all articles

All articles

Explore all articles, guides and technical deep dives.

  • CI/CD Argo CD

    Argo CD ApplicationSets for Multi-Environment Delivery

    One application, three environments, one ApplicationSet: generated Applications, a manual gate on production, deletion policy.

    14 min read

    Tested with Argo CD 3.5.3, Kubernetes 1.35 (kind 0.31) , kubectl 1.32, Gitea 1.24.7, Kustomize (built into Argo CD)

  • DevSecOps Cosign

    Attestations and Provenance: Binding the SBOM to the Image

    Attach the SBOM to the image digest as a signed in-toto attestation, verify it, and see what build provenance adds.

    7 min read

    Tested with Cosign 3.1.3 (ghcr.io/sigstore/cosign/cosign image), Syft 1.51.1 SBOM (CycloneDX 1.7) , registry:2, Docker 29.1

  • Cloud Security IAM

    Cloud Identity and Least Privilege: Humans, Workloads and CI

    Why a static access key is the wrong shape for a credential, and what short-lived, workload-bound identity looks like in practice.

    13 min read

    Tested with Kubernetes 1.35 (kind 0.31), kubectl 1.32 , Terraform 1.14.9, Checkov 3.3.17, AWS provider 6.64.0

  • Cloud Security Network Security

    Cloud Network Security Boundaries: Exposure, Tiers and Default Deny

    Public versus private, inbound versus outbound, and a three-tier layout where every boundary is proven with a connection test.

    14 min read

    Tested with Docker 29.1 (OrbStack 2.0.5), nginx 1.31.5 , Redis 8.2, Terraform 1.14.9, AWS provider 6.64.0, Checkov 3.3.17, OpenSSL 3.6.1

  • Kubernetes Kubectl

    Debugging Kubernetes Workloads: A Repeatable Process on Real Failures

    CrashLoopBackOff, ImagePullBackOff, a missing ConfigMap and an empty Service, each reproduced and fixed with six commands.

    10 min read

    Tested with Kubernetes 1.35 (kind 0.31), kubectl 1.32 , ci-demo:1.4.2, busybox:1.37 and curlimages/curl:8.14.1 images

  • DevSecOps SBOM

    Generate an SBOM with Syft and Read What It Tells You

    Inventory a real image, find out why one dependency became 234 packages, and keep the SBOM where it will be needed.

    8 min read

    Tested with Syft 1.51.1 (anchore/syft image), ci-demo:1.4.0 image on node:22.20.0-alpine3.22 , Docker 29.1, Python 3.14 for reading the JSON

  • Kubernetes Kubectl

    Kubernetes Health, Resources and Reliability

    Readiness, liveness and startup probes, requests and limits, OOMKilled, Pending and CPU throttling, each reproduced on a cluster.

    11 min read

    Tested with Kubernetes 1.35 (kind 0.31, 1 control plane + 2 workers), kubectl 1.32 , busybox:1.37 and python:3.13-slim images

  • Observability Prometheus

    Kubernetes Observability with Prometheus, Grafana and Loki

    kube-prometheus-stack, Loki and Alloy on kind, then a workload OOM-killed every two minutes diagnosed from metrics, logs, events.

    21 min read

    Tested with Kubernetes 1.35 (kind 0.31), kube-prometheus-stack 91.4.1 (Prometheus 3.14.0, Grafana 13.2.2, Alertmanager 0.34.0, kube-state-metrics 2.20.0, prometheus-operator 0.94.0) , loki chart 7.3.0 (Loki 3.6.11), alloy chart 1.12.1 (Alloy 1.19.2), Helm 4.1

  • Kubernetes Kubectl

    Kubernetes Scaling, Rollouts and Recovery

    Scale by hand, roll out and roll back with the CI/CD path commands, then let a real HorizontalPodAutoscaler do it under load.

    11 min read

    Tested with Kubernetes 1.35 (kind 0.31), kubectl 1.32 , metrics-server v0.9.0, curlimages/curl:8.14.1 for load

  • Kubernetes Kubectl

    Kubernetes Services, Networking and DNS: Following One Request

    From a Service name through DNS, ClusterIP and EndpointSlice to a pod, with the two mistakes that break the path most often.

    9 min read

    Tested with Kubernetes 1.35 (kind 0.31, kindnet CNI, CoreDNS), kubectl 1.32 , busybox:1.37 and curlimages/curl:8.14.1 images

  • Kubernetes Kubectl

    Kubernetes Workloads and Controllers: Choosing and Reading Them

    Deployment, StatefulSet, DaemonSet, Job and CronJob on a three-node kind cluster, and what each one does when a pod dies.

    10 min read

    Tested with Kubernetes 1.35 (kind 0.31, 1 control plane + 2 workers), kubectl 1.32 , postgres:17-alpine, alpine:3.22 and busybox:1.37 images

  • Cloud Security Observability

    Logging, Audit and Security Visibility: Who Did What, From Where

    Application, infrastructure and audit logs record different things. Kubernetes audit logging turned on, tuned and read.

    13 min read

    Tested with Kubernetes 1.35 (kind 0.31), kubectl 1.32 , Prometheus promtool 3.14.0, nginx 1.31.5, Vault 1.21.4

  • DevOps GitOps

    Platform Engineering Foundations: Defining the Platform Contract

    What an internal platform provides, what it deliberately does not, and the contract between platform and application teams.

    11 min read

    Tested with gitlab-ci-local 4.75.1, Argo CD 3.5.3 , Kyverno 1.19.1, kube-prometheus-stack 91.4.1, Kubernetes 1.35 (kind 0.31)

  • DevOps Kyverno

    Platform Guardrails with Kyverno and GitOps

    Baseline and production policy layers delivered by Argo CD, rolled out audit-first, with scoped expiring exceptions. Run on kind.

    17 min read

    Tested with Kyverno 1.19.1 (chart 3.9.1), Argo CD 3.5.3 , Kubernetes 1.35 (kind 0.31), kubectl 1.32, Gitea 1.24.7

  • Cloud Security Hardening

    Production Cloud Hardening: A Checklist That Connects the Controls

    Identity, exposure, TLS, headers, secrets, patching, logs, backups and recovery as one list with a verification command per line.

    13 min read

    Tested with curl 8.7.1, OpenSSL 3.6.1 , Kubernetes 1.35 (kind 0.31), etcd 3.6.0, Trivy 0.74.0, Checkov 3.3.17

  • CI/CD GitLab CI

    Reusable GitLab CI Templates and Components: A Golden Delivery Path

    A platform-owned pipeline template with inputs, a versioned include, extension points and a five-line consumer, run locally.

    14 min read

    Tested with gitlab-ci-local 4.75.1, Gitea 1.24.7 (as the Git remote) , node:22.23.2-alpine3.24, Trivy 0.74.0, Gitleaks 8.30.1, Docker 29.1

  • DevSecOps Grype

    Scan Images and SBOMs with Grype: From 183 Findings to 3

    Scan the SBOM, read severity and fix data, change the base image and the Dockerfile, and rescan until the gate passes.

    11 min read

    Tested with Grype 0.118.0 (anchore/grype image, DB schema v6, built 2026-09-15), Syft 1.51.1 , node:22.20.0-alpine3.22 and node:22.23.2-alpine3.24 images, Docker 29.1

  • Cloud Security Secrets Management

    Secrets and Configuration Security: Images, Kubernetes, Vault and Rotation

    Where a credential leaks on its way to a running process, what a Kubernetes Secret really stores, and what a secret manager adds.

    14 min read

    Tested with Docker 29.1 (BuildKit), Trivy 0.74.0 , Gitleaks 8.30.1, Kubernetes 1.35 (kind 0.31), etcd 3.6.0, Vault 1.21.4

  • DevSecOps Cosign

    Sign and Verify Container Images with Cosign

    Sign an image by digest, verify it, move the tag to a different image and watch verification fail, then place the check in CI.

    9 min read

    Tested with Cosign 3.1.3 (ghcr.io/sigstore/cosign/cosign image), registry:2 (Docker Distribution) , Docker 29.1

  • DevSecOps Supply Chain

    Understanding the Software Supply Chain

    Where compromise enters between source and a running container, and which control applies at each step.

    9 min read

    Tested with Syft 1.51.1, Grype 0.118.0 , Cosign 3.1.3, Docker 29.1

  • CI/CD GitLab CI

    CI/CD Fundamentals: How a Pipeline Actually Runs

    Stages, jobs, runners, artifacts and environments, shown on a real pipeline you can run on your laptop.

    11 min read

    Tested with gitlab-ci-local 4.75.1, node:22.20.0-alpine3.22 image , Docker 29.1

  • Infrastructure as Code Checkov

    IaC Security in CI/CD: Gates, Exceptions and Baselines

    A merge-request pipeline that blocks insecure Terraform, tolerates the known debt, and cannot be quietly bypassed.

    12 min read

    Tested with Checkov 3.3.17 (bridgecrew/checkov image), Terraform 1.14.9 (hashicorp/terraform:1.14 image) , gitlab-ci-local 4.75.1, Docker 29.1

  • Infrastructure as Code Checkov

    Scan Infrastructure as Code with Checkov

    Scan a deliberately insecure Terraform configuration, read the findings, fix them, and prove the fix with a second scan.

    12 min read

    Tested with Checkov 3.3.17 (bridgecrew/checkov image), Terraform 1.14.9 , Docker 29.1

  • Docker Container Security

    Building Minimal Container Images with Multi-Stage Builds

    One Go service built two ways, then compared on size, packages, scanner findings and the user it runs as.

    12 min read

    Tested with Docker 29.1.5, Trivy 0.68.2 , Go 1.27.1, distroless static-debian13

  • CI/CD Argo CD

    GitOps Deployment with Argo CD

    Install Argo CD, model applications, enable automated sync and make Git the only way to change the cluster.

    9 min read

    Tested with Argo CD 3.5.2, Kubernetes 1.35 (kind 0.31)

  • Kubernetes Kubernetes Security

    Kubernetes Security Checklist for Production Clusters

    Control plane, workloads, network, secrets, supply chain and runtime, each with a command that verifies it.

    10 min read

    Tested with Kubernetes 1.35 (kind 0.31), kubectl 1.32 , jq 1.8

  • DevSecOps Gitleaks

    Secrets Detection with Gitleaks

    Gitleaks in pre-commit hooks and CI, tuned rules and allowlists, and what to do when a secret has already leaked.

    8 min read

    Tested with Gitleaks 8.30.1, Git 2.50 , GitLab.com Secret Detection template

  • Security Tools Trivy

    Container Image Scanning with Trivy

    What Trivy finds in an image, how to make the findings actionable, and how to wire it into CI.

    9 min read

    Tested with Trivy 0.68.2, Docker 29 , GitLab.com shared runners

  • CI/CD Jenkins

    Building a Secure CI/CD Pipeline with Jenkins

    A declarative pipeline with secrets scanning, SAST, image scanning and least-privilege credentials.

    9 min read

    Tested with Jenkins 2.568.3 LTS (declarative linter), Gitleaks 8.30 , Trivy 0.68

Showing all 36 articles.