diff --git a/public/blog/authentik-sso-2fa.webp b/public/blog/authentik-sso-2fa.webp index 05c4948..36e4f50 100644 Binary files a/public/blog/authentik-sso-2fa.webp and b/public/blog/authentik-sso-2fa.webp differ diff --git a/public/blog/init-gating-gpu-readiness.webp b/public/blog/init-gating-gpu-readiness.webp index 8481ee2..4b52c02 100644 Binary files a/public/blog/init-gating-gpu-readiness.webp and b/public/blog/init-gating-gpu-readiness.webp differ diff --git a/public/blog/outbound-only-exposure.webp b/public/blog/outbound-only-exposure.webp index 613a299..76981ae 100644 Binary files a/public/blog/outbound-only-exposure.webp and b/public/blog/outbound-only-exposure.webp differ diff --git a/public/blog/secret-zero.webp b/public/blog/secret-zero.webp index d7af77c..e45cb3c 100644 Binary files a/public/blog/secret-zero.webp and b/public/blog/secret-zero.webp differ diff --git a/public/blog/shipping-this-site.webp b/public/blog/shipping-this-site.webp index 21abd87..a46f3cc 100644 Binary files a/public/blog/shipping-this-site.webp and b/public/blog/shipping-this-site.webp differ diff --git a/public/blog/workload-least-privilege.webp b/public/blog/workload-least-privilege.webp index 7be538d..d0b9695 100644 Binary files a/public/blog/workload-least-privilege.webp and b/public/blog/workload-least-privilege.webp differ diff --git a/public/diagrams/secret-zero.svg b/public/diagrams/secret-zero.svg new file mode 100644 index 0000000..b67d4ea --- /dev/null +++ b/public/diagrams/secret-zero.svg @@ -0,0 +1,71 @@ + + + + + Secret zero: the seed outside GitOps + one out-of-band credential unlocks the store — the repo only ever holds pointers + + + + + + + Infisical + the real values + + + + real values + (authed by secret zero) + + + + in git — pointers, never values + + + + out-of-band + + + + secret zero + read-only · per-cluster + applied by hand · never in git + + + + ClusterSecretStore + store URL + ref → secret zero + wires the cluster up + + + + ExternalSecret ×N + a pointer per app + a name, never a value + + + + Kubernetes Secret + materialised in-cluster + kept in sync by ESO + + + + + + + + + + + + unlocks + + references + + resolves + + + Exactly one credential lives outside GitOps — read-only, per-cluster, the seed the whole tree grows from. Everything else is just a pointer. + diff --git a/src/components/PostList.astro b/src/components/PostList.astro index 6868396..40027d9 100644 --- a/src/components/PostList.astro +++ b/src/components/PostList.astro @@ -16,7 +16,7 @@ const { posts } = Astro.props; {post.data.hero && (
- +
)}
diff --git a/src/content/blog/secret-zero.md b/src/content/blog/secret-zero.md index a1e3bf2..8a5b84f 100644 --- a/src/content/blog/secret-zero.md +++ b/src/content/blog/secret-zero.md @@ -41,7 +41,7 @@ From there the dam breaks in the good way: every app's `ExternalSecret` resolves the `Secret` in sync, and your repo stays a map of *names*, not values. -![Secret-zero bootstrap chain](/diagrams/secret-zero.svg) +![Secret-zero bootstrap chain](/diagrams/secret-zero.svg?v=1) ## The discipline around the one exception diff --git a/src/pages/blog/[slug].astro b/src/pages/blog/[slug].astro index 704d04b..8811595 100644 --- a/src/pages/blog/[slug].astro +++ b/src/pages/blog/[slug].astro @@ -36,7 +36,7 @@ const { Content } = await render(entry); {entry.data.hero && (