OpenBao PKI & Secrets Pipeline#
A zero-static-credential secrets infrastructure for a multi-site production environment. GitLab CI pipelines authenticate via JWT federation — tokens are validated against project and ref, so lateral movement between pipelines is impossible by design. Host certificate issuance is fully automated: a JWT login mints a short-lived bootstrap certificate, Ansible delivers a response-wrapped AppRole secret-id, and OpenBao Agent on each host manages its own renewal. Policies are templated to constrain each host to its own names. The result is a PKI and secrets layer that requires no manual intervention and leaves no long-lived credentials anywhere in the pipeline.
Terraform RKE2 Module#
A Terraform module for provisioning production RKE2 clusters on Proxmox through Rancher. Provider responsibilities are cleanly separated: rancher2 defines the cluster, the kubernetes provider handles node taints and labels post-registration. Module inputs cover the full operational surface — network CIDRs, control-plane hardening arguments (kube-apiserver and kubelet), etcd backup configuration, private registry mirrors for air-gapped operation, and upgrade strategy. Every node pool uses taints and node affinity together, enforcing workload placement without relying on convention.
Packer Template Pipeline#
A CI pipeline for building, testing, and promoting Debian VM templates on Proxmox. Templates are versioned; a dedicated clone test stage runs against the real Terraform module — not a simplified test fixture — before a template is eligible for promotion. Goss checks run at both build time and clone time for consistency. The pipeline enforces hygiene that’s easy to miss manually: initramfs built with required virtio and storage modules (verified by lsinitramfs), serial console configured for Proxmox xterm.js, old kernels purged before the final snapshot. A template that passes is one that will actually boot and behave correctly when Terraform clones it.
DNS as Code#
Zone management for a production environment through a hidden BIND primary, with OctoDNS and Terraform as the only write sources — no manual edits, no GSS-TSIG dynamic updates. DNSSEC uses BIND inline signing with keys stored in OpenBao. Dynamic records (machine identity, SSH, monitoring, logging endpoints) live in a dedicated dyn.corp. zone updated by Terraform over RFC 2136. Static production service records are explicit entries in the root zone managed through OctoDNS and Git. The separation keeps machine-identity churn isolated from production DNS and makes both zones independently auditable.
Ansible Execution Environment#
A minimal, auditable Ansible execution environment for GitLab CI. Built on python:3.13-slim-trixie with only ansible-core and a small set of critical collections baked in — everything else installs per-job against a uv cache keyed on lockfile hashes, with --require-hashes enforced throughout. A .pth file layers the job virtualenv over the baked one; Ansible runs as python -m ansible to avoid shebang resolution issues. Cache policy is pull-push only on a dedicated warmup job, with protected-branch caches kept separate. The design means every production pipeline run is fully reproducible and the cache can’t be used as an injection vector.