Security
Certificates, TLS, secrets and access policies: the security work that keeps production quietly safe.
6 posts
- The certificates expired on schedule. The alert fired for a week — into nowhereA kubeadm cluster lost its control plane exactly one year after install. The expiry alert had been firing for seven days, but Alertmanager only had a null receiver.
- A production certificate expired and nobody noticed: the front proxy covered for itEvery public host returned 200 while the cluster served an expired wildcard. A proxy with its own TLS hid the outage; the real finding was the missing expiry alert.
- Basic auth vanished on port 80 after an Ingress to Gateway API migrationEvery status was green and my own curl returned 401. Yet the WordPress login was open to the world: Gateway API binds a policy to one listener, while Ingress annotations covered every port.
- A star in the middle of a Vault path is not a wildcardA dead token took down a secrets operator. Reissuing it exposed an older bug: 27 Vault policies used * mid-path, silently denied what they declared, and hid an over-privilege.
- Moving Vault from Shamir to transit auto-unseal, and the four traps on the wayEvery Vault pod restart came back sealed and froze secret sync behind it. How we added a transit auto-unseal provider, migrated a three-node raft cluster, and what bit us.
- "Vault keeps sealing itself" — no, it just never unsealsA Vault pod sat at Ready 0/1 for days while raft quorum quietly held on two peers. Nothing was sealing it: Shamir seal without auto-unseal leaves every restart sealed.