Practical engineering notes on building, securing, deploying and operating production infrastructure: Kubernetes, CI/CD, IaC, supply chain security and observability.https://sachinchaurasiya.comenhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/argocd-applicationsets-multi-environment-deliveryhttps://sachinchaurasiya.com/blog/argocd-applicationsets-multi-environment-deliveryReplace hand-copied Argo CD Applications with an ApplicationSet driven by per-environment config files: the Git file generator, templatePatch for automated versus manual sync, AppProject boundaries and deletion policy.Wed, 16 Sep 2026 00:00:00 GMTCI/CDargocdgitopskuberneteskustomizeci-cddeploymenthello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/attestations-and-provenance-with-cosignhttps://sachinchaurasiya.com/blog/attestations-and-provenance-with-cosignTurn the SBOM from part 2 into a Cosign attestation bound to the image digest, verify it and read the predicate back, list what hangs off an image with cosign tree, and see what SLSA build provenance adds.Wed, 16 Sep 2026 00:00:00 GMTDevSecOpscosignsbomsupply-chainprovenancedevsecopssigstorehello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/cloud-identity-and-least-privilegehttps://sachinchaurasiya.com/blog/cloud-identity-and-least-privilegeHuman and workload identities and the credentials that carry them: why static keys are dangerous, how a bound short-lived token differs from a legacy one, how CI assumes a role without a key, and how to scope each one.Wed, 16 Sep 2026 00:00:00 GMTCloud Securityiamleast-privilegerbackubernetesterraformcloud-securitycheckovhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/cloud-network-security-boundarieshttps://sachinchaurasiya.com/blog/cloud-network-security-boundariesDeciding what a cloud workload exposes: public and private subnets, security groups that reference each other instead of address ranges, egress control, TLS and DNS, proven with connection tests on a three-tier layout.Wed, 16 Sep 2026 00:00:00 GMTCloud Securitynetwork-securitycloud-securityterraformdockertlscheckovhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/debugging-kubernetes-workloadshttps://sachinchaurasiya.com/blog/debugging-kubernetes-workloadsA troubleshooting sequence (get, describe, logs, events, exec, port-forward) applied to four broken workloads: a crashing container, a missing image, a missing ConfigMap and an empty Service. Real events, real fixes.Wed, 16 Sep 2026 00:00:00 GMTKuberneteskuberneteskubectldebuggingtroubleshootingdevopsproduction-engineeringhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/generate-an-sbom-with-syfthttps://sachinchaurasiya.com/blog/generate-an-sbom-with-syftRun Syft from its container against a small Node.js image, read the CycloneDX output package by package, see where each one came from, learn what an SBOM does not prove, and store it next to the artifact.Wed, 16 Sep 2026 00:00:00 GMTDevSecOpssbomsyftsupply-chaincontainer-securitydevsecopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/kubernetes-health-resources-and-reliabilityhttps://sachinchaurasiya.com/blog/kubernetes-health-resources-and-reliabilityWhat readiness, liveness and startup probes do (with a failing one of each), how requests decide scheduling and limits decide OOMKilled and throttling, what the cgroup counters show, and how termination grace works.Wed, 16 Sep 2026 00:00:00 GMTKuberneteskuberneteskubectlprobesresourcesdevopsproduction-engineeringhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/kubernetes-observability-prometheus-grafana-lokihttps://sachinchaurasiya.com/blog/kubernetes-observability-prometheus-grafana-lokikube-prometheus-stack, Loki in single-binary mode and Alloy on a kind cluster; the PromQL and LogQL that answer operational questions; low-cardinality log labels; a real OOM restart loop diagnosed end to end.Wed, 16 Sep 2026 00:00:00 GMTObservabilityobservabilityprometheusgrafanalokikubernetesalertingproduction-engineeringhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/kubernetes-scaling-rollouts-and-recoveryhttps://sachinchaurasiya.com/blog/kubernetes-scaling-rollouts-and-recoveryManual scaling, rolling updates and rollback as an operator sees them, and a HorizontalPodAutoscaler on kind with metrics-server: real utilisation figures, a 2-to-6 scale-up under load, and the scale-down window.Wed, 16 Sep 2026 00:00:00 GMTKuberneteskuberneteskubectlautoscalingrollbackdeploymentdevopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/kubernetes-services-networking-and-dnshttps://sachinchaurasiya.com/blog/kubernetes-services-networking-and-dnsHow a request finds a pod: cluster DNS, the Service ClusterIP, the EndpointSlice the selector fills, port versus targetPort, headless Services and Ingress in outline; each inspected on a kind cluster, mistakes included.Wed, 16 Sep 2026 00:00:00 GMTKuberneteskuberneteskubectlservicesnetworkingdnsdevopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/kubernetes-workloads-and-controllershttps://sachinchaurasiya.com/blog/kubernetes-workloads-and-controllersDeployments, StatefulSets, DaemonSets, Jobs and CronJobs on a real three-node cluster: what kubectl reports, what happens when you delete a pod of each kind, why a DaemonSet skips the control plane, and which to use.Wed, 16 Sep 2026 00:00:00 GMTKuberneteskuberneteskubectldeploymentsstatefulsetsdevopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/logging-audit-and-security-visibilityhttps://sachinchaurasiya.com/blog/logging-audit-and-security-visibilityApplication, infrastructure and audit logs and what each answers; Kubernetes API audit logging enabled on a real cluster, tuned from lease noise to the events that matter, and read for denied and privileged requests.Wed, 16 Sep 2026 00:00:00 GMTCloud Securityobservabilityaudit-loggingkubernetesloggingprometheuscloud-securityhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/platform-engineering-foundations-the-platform-contracthttps://sachinchaurasiya.com/blog/platform-engineering-foundations-the-platform-contractThe operating model behind the CI templates, ApplicationSets, Kyverno guardrails and observability stack on this site: what a team hands over, what the platform returns, where the golden path ends and enforcement begins.Wed, 16 Sep 2026 00:00:00 GMTDevOpsdevopsgitopsci-cdkubernetesproduction-engineeringargocdkyvernohello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/platform-guardrails-with-kyverno-and-gitopshttps://sachinchaurasiya.com/blog/platform-guardrails-with-kyverno-and-gitopsKyverno as a platform guardrail system: baseline and production policy layers keyed on namespace labels, delivered by Argo CD from one repository, rolled out audit-first, with scoped expiring exceptions.Wed, 16 Sep 2026 00:00:00 GMTDevOpskyvernoargocdgitopskubernetespolicy-as-codedevopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/production-cloud-hardening-checklisthttps://sachinchaurasiya.com/blog/production-cloud-hardening-checklistThe hardening checklist for a cloud-hosted production workload, built from parts 1 to 4 and the existing edge, container and Kubernetes articles: each control with the command that proves it and the gap it covers.Wed, 16 Sep 2026 00:00:00 GMTCloud Securitycloud-securityhardeningtlssecurity-headerscloudflarekubernetesbackupshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/reusable-gitlab-ci-templates-and-componentshttps://sachinchaurasiya.com/blog/reusable-gitlab-ci-templates-and-componentsOne platform-owned GitLab CI template instead of a pipeline per repository: spec:inputs with validation, a consumer that includes it by project and tag, extension points, versioning, and what a consumer can override.Wed, 16 Sep 2026 00:00:00 GMTCI/CDgitlab-cici-cddevopstrivygitleaksdevsecopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/scan-images-and-sboms-with-grypehttps://sachinchaurasiya.com/blog/scan-images-and-sboms-with-grypeGrype against the SBOM from part 2: 183 matches read by severity, ecosystem and fix state; two Dockerfile changes that take it to 3; exit-code behaviour for CI; and how to triage what remains.Wed, 16 Sep 2026 00:00:00 GMTDevSecOpsgrypesbomscasupply-chaincontainer-securitydevsecopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/secrets-and-configuration-securityhttps://sachinchaurasiya.com/blog/secrets-and-configuration-securityThe secrets lifecycle for a cloud workload: credentials recovered from image history and deleted layers, a build that leaves nothing behind, Secrets in etcd before and after encryption at rest, rotation, and Vault TTLs.Wed, 16 Sep 2026 00:00:00 GMTCloud Securitysecrets-managementvaultkubernetesdockertrivygitleakscloud-securityhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/sign-and-verify-container-images-with-cosignhttps://sachinchaurasiya.com/blog/sign-and-verify-container-images-with-cosignCosign with a key pair against a local registry: why the digest is the identity; signing and verifying; a moved tag failing verification while the digest passes; keyless signing as configuration; where the check goes.Wed, 16 Sep 2026 00:00:00 GMTDevSecOpscosignsupply-chaincontainer-securitydevsecopssigstorehello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/understanding-the-software-supply-chainhttps://sachinchaurasiya.com/blog/understanding-the-software-supply-chainThe delivery chain from source through dependencies, build, artifact, image, registry and deployment; where each link can be compromised; and the control for each, from lockfiles and SBOMs to signing by digest.Wed, 16 Sep 2026 00:00:00 GMTDevSecOpssupply-chainsbomcosigndevsecopscontainer-securityhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/building-reliable-cicd-pipelineshttps://sachinchaurasiya.com/blog/building-reliable-cicd-pipelinesMake a pipeline produce the same result every time and fail usefully: pinned images and lockfiles, a cache keyed on the lockfile, artifacts versus caches, needs, retries and timeouts, and build kept apart from deploy.Tue, 15 Sep 2026 00:00:00 GMTCI/CDci-cdgitlab-ciartifactsreproducible-buildsdevopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/cicd-fundamentals-how-a-pipeline-runshttps://sachinchaurasiya.com/blog/cicd-fundamentals-how-a-pipeline-runsWhat a delivery pipeline does between a push and a deployment: stages and jobs, runners, checkout, build, test, artifacts, environments and promotion, with a GitLab CI pipeline you can execute locally and watch fail.Tue, 15 Sep 2026 00:00:00 GMTCI/CDci-cdgitlab-ciartifactsdeploymentdevopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/deployment-strategies-rolling-blue-green-canaryhttps://sachinchaurasiya.com/blog/deployment-strategies-rolling-blue-green-canaryRolling updates, blue/green switches and canary releases built from plain Deployments and Services on a kind cluster, with the health checks, gates and promotion steps that decide when each one is right.Tue, 15 Sep 2026 00:00:00 GMTCI/CDdeploymentkubernetesci-cdcanaryblue-greendevopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/iac-security-in-cicdhttps://sachinchaurasiya.com/blog/iac-security-in-cicdPut Checkov in front of terraform plan: a GitLab CI job on every merge request, a baseline so only new findings fail, a pass/fail policy by check ID, exceptions with reasons, reports in the MR, and branch protection.Tue, 15 Sep 2026 00:00:00 GMTInfrastructure as Codecheckovterraformgitlab-ciiacinfrastructure-as-codepolicy-as-codeci-cddevsecopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/rollback-and-recovery-for-deploymentshttps://sachinchaurasiya.com/blog/rollback-and-recovery-for-deploymentsMake rollback a deploy, not a rebuild: immutable artifacts and image digests, a failed rollout detected with rollout status and conditions, kubectl rollout undo on a real failure, and migrations planned separately.Tue, 15 Sep 2026 00:00:00 GMTCI/CDrollbackkubernetesci-cddeploymentartifactsdevopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/scan-terraform-with-checkovhttps://sachinchaurasiya.com/blog/scan-terraform-with-checkovRun Checkov against Terraform with a public database, an open security group and an unprotected bucket; read the 22 findings and why they matter; fix them; then record the rest as documented skips.Tue, 15 Sep 2026 00:00:00 GMTInfrastructure as Codecheckovterraformiacinfrastructure-as-codepolicy-as-codeawsdevsecopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/secure-terraform-foundationshttps://sachinchaurasiya.com/blog/secure-terraform-foundationsThe security foundations of a Terraform repository: pinned versions with a committed lock file, remote state with locking and access control, secrets kept out of source, least-privilege plan and apply roles.Tue, 15 Sep 2026 00:00:00 GMTInfrastructure as Codeterraformiacinfrastructure-as-codesecrets-managementawsdevsecopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/building-minimal-container-images-with-multi-stage-buildshttps://sachinchaurasiya.com/blog/building-minimal-container-images-with-multi-stage-buildsBuild the same Go service as a single-stage image and as a multi-stage image on a distroless base, then compare size, package count, scanner findings and the user it runs as.Tue, 01 Sep 2026 00:00:00 GMTDockerdockercontainer-securitytrivygosupply-chainhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/gitlab-ci-devsecops-pipelinehttps://sachinchaurasiya.com/blog/gitlab-ci-devsecops-pipelineThe GitLab pipeline that gated this site while it ran CI: frozen installs, parallel quality gates, Trivy with SAST and secret detection, artifact verification, and one deployment owner behind protected main.Tue, 18 Aug 2026 00:00:00 GMTCI/CDgitlab-cici-cddevsecopstrivysemgrepgitleakscloudflaresupply-chainhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/gitops-deployment-with-argo-cdhttps://sachinchaurasiya.com/blog/gitops-deployment-with-argo-cdInstall Argo CD, model applications and projects, enable automated sync with pruning and self-heal, and lock the control plane down so Git really is the only way to change the cluster.Tue, 04 Aug 2026 00:00:00 GMTCI/CDargocdgitopskuberneteshelmci-cdhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/hardening-a-static-site-on-cloudflarehttps://sachinchaurasiya.com/blog/hardening-a-static-site-on-cloudflareThe security configuration behind this site: a per-page Content Security Policy with script hashes and no unsafe-inline, hardening headers served from Workers static assets, and the zone settings that back them up.Tue, 21 Jul 2026 00:00:00 GMTCloud Securitycloudflaretlscspsecurity-headersastroedge-securityhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/labs/enforce-pod-security-with-psa-and-kyvernohttps://sachinchaurasiya.com/labs/enforce-pod-security-with-psa-and-kyvernoOn a kind cluster, turn on the restricted Pod Security profile for a namespace, watch it reject a default pod, then add a Kyverno ValidatingPolicy in Audit mode, read the PolicyReport, and switch it to Deny.Tue, 07 Jul 2026 00:00:00 GMTLabskuberneteskyvernokubernetes-securityadmission-controlpod-securityhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/kyverno-policies-for-kubernetes-securityhttps://sachinchaurasiya.com/blog/kyverno-policies-for-kubernetes-securityInstall Kyverno 1.19, write CEL-based ValidatingPolicy, MutatingPolicy and GeneratingPolicy resources for non-root pods, image tags, allowed registries and default-deny networking, and roll them out audit-first.Tue, 30 Jun 2026 00:00:00 GMTKuberneteskyvernokuberneteskubernetes-securityadmission-controlpolicy-as-codenetwork-securityhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/labs/generate-an-sbom-with-syft-and-scan-it-with-grypehttps://sachinchaurasiya.com/labs/generate-an-sbom-with-syft-and-scan-it-with-grypeProduce CycloneDX and SPDX bills of materials for a container image without a Docker socket, scan the SBOM with Grype, gate on fixable findings only, and see why the SBOM is worth keeping after the release.Tue, 23 Jun 2026 00:00:00 GMTLabssbomsyftgrypesupply-chaincontainer-securityhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/labs/least-privilege-kubernetes-rbac-for-a-deployerhttps://sachinchaurasiya.com/labs/least-privilege-kubernetes-rbac-for-a-deployerCreate a service account that can roll out Deployments in one namespace and nothing else, prove the boundary with impersonation and a real short-lived token, and audit the cluster for wildcard roles and anonymous access.Tue, 16 Jun 2026 00:00:00 GMTLabskubernetesrbackubernetes-securityleast-privilegehello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/kubernetes-security-checklisthttps://sachinchaurasiya.com/blog/kubernetes-security-checklistA layered checklist — control plane, workloads, network, secrets, supply chain and runtime — with the manifests and commands to verify each control rather than just tick it.Tue, 09 Jun 2026 00:00:00 GMTKuberneteskuberneteskubernetes-securityrbackyvernofalconetwork-securitysecrets-managementhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/labs/scan-git-repositories-with-gitleakshttps://sachinchaurasiya.com/labs/scan-git-repositories-with-gitleaksSeed a repository with realistic fake secrets, catch them with Gitleaks in history and working-tree modes, ignore a confirmed false positive by fingerprint, and block the next one at commit time.Tue, 02 Jun 2026 00:00:00 GMTLabsgitleakssecrets-managementdevsecopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/secrets-detection-with-gitleakshttps://sachinchaurasiya.com/blog/secrets-detection-with-gitleaksStop credentials from reaching Git: run Gitleaks in pre-commit hooks and CI, tune rules and allowlists, handle findings without leaking them further, and decide when history rewriting is worth it.Tue, 26 May 2026 00:00:00 GMTDevSecOpsgitleakssecrets-managementgitlab-cisupply-chaindevsecopshello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/labs/secure-docker-images-with-trivyhttps://sachinchaurasiya.com/labs/secure-docker-images-with-trivyBuild a deliberately weak image, scan it with Trivy, and rebuild it until the gate for fixable HIGH and CRITICAL findings passes: current base, non-root user, patched packages, no pip in the runtime image.Tue, 19 May 2026 00:00:00 GMTLabstrivydockercontainer-securityhello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/container-image-scanning-with-trivyhttps://sachinchaurasiya.com/blog/container-image-scanning-with-trivyHow Trivy finds OS and application vulnerabilities, secrets and misconfigurations in container images, how to make the results actionable, and how to wire it into CI without slowing builds down.Tue, 12 May 2026 00:00:00 GMTSecurity Toolstrivydockercontainer-securityscasbomgitlab-cihello@sachinchaurasiya.com (Sachin Chaurasiya)https://sachinchaurasiya.com/blog/building-a-secure-cicd-pipeline-with-jenkinshttps://sachinchaurasiya.com/blog/building-a-secure-cicd-pipeline-with-jenkinsA declarative Jenkins pipeline with secrets scanning, SAST, image scanning and least-privilege credential handling — and the agent, plugin and Docker decisions that keep it that way.Thu, 07 May 2026 00:00:00 GMTCI/CDjenkinsci-cddevsecopstrivygitleakssemgrepdockerhello@sachinchaurasiya.com (Sachin Chaurasiya)