Cloud Security
Identity boundaries, network exposure, workload protection and edge security for cloud-hosted systems.
Human and workload identities and the credentials that carry them: why static keys are dangerous, how a bound short-lived token differs from a legacy one, how CI assumes a role without a key, and how to scope each one.
Deciding what a cloud workload exposes: public and private subnets, security groups that reference each other instead of address ranges, egress control, TLS and DNS, proven with connection tests on a three-tier layout.
Application, infrastructure and audit logs and what each answers; Kubernetes API audit logging enabled on a real cluster, tuned from lease noise to the events that matter, and read for denied and privileged requests.
The hardening checklist for a cloud-hosted production workload, built from parts 1 to 4 and the existing edge, container and Kubernetes articles: each control with the command that proves it and the gap it covers.
The secrets lifecycle for a cloud workload: credentials recovered from image history and deleted layers, a build that leaves nothing behind, Secrets in etcd before and after encryption at rest, rotation, and Vault TTLs.
The GitLab pipeline that gated this site while it ran CI: frozen installs, parallel quality gates, Trivy with SAST and secret detection, artifact verification, and one deployment owner behind protected main.
The security configuration behind this site: a per-page Content Security Policy with script hashes and no unsafe-inline, hardening headers served from Workers static assets, and the zone settings that back them up.
Install Kyverno 1.19, write CEL-based ValidatingPolicy, MutatingPolicy and GeneratingPolicy resources for non-root pods, image tags, allowed registries and default-deny networking, and roll them out audit-first.
A layered checklist — control plane, workloads, network, secrets, supply chain and runtime — with the manifests and commands to verify each control rather than just tick it.