Amal Mammadov

Git commit signing provides a way to cryptographically associate a commit with a signing key. Without commit signing, a Git commit contains an author name and email address, but those fields alone do not prove that the person shown as the author actually created the commit. Signed commits add an additional verification layer. GitHub can verify a cryptographic signature against a signing key registered with the user’s GitHub account and display successfully verified commits with the Verified status. This guide…

Read More Read More

Secrets are everywhere in modern environments: API keys, database passwords, access tokens, service accounts, SSH keys, certificates, signing keys, cloud credentials, CI/CD tokens, and so on. The problem usually starts when these credentials are treated just as configuration values. Someone creates an API key, puts it into a pipeline variable, another person copies it into a .env file, somebody else uses the same key in another application, and a year later nobody knows where the key is used or who…

Read More Read More

Testing is one of the fundamental components of DevOps and agile development in general. If automation gives DevOps the required speed and agility to deploy software quickly, only through extensive testing will those deployments achieve the required reliability that customers demand. A main tenet of a DevOps practice to achieve system reliability is the shift left principle. If your process for developing and deploying an application is depicted as a series of steps that are listed from left to right,…

Read More Read More

This post will demonstrate how to configure vault and ssh server in order to use OTP for the login to SSH server. Following diagram depicts the process. After we have initialized and unsealed our vault server we need to enable ssh secrets engine with the following command: vault secrets enable ssh Write role to Vault ssh secrets engine. For the test purposes we will allow all IPs Vault write ssh/roles/admin key_type=otp default_user=vaultuser cidr_list=0.0.0.0/0,0.0.0.0/0 Now we need to configure login to…

Read More Read More

Deployment pipelines (or Continuous Delivery pipelines) are the cornerstone of Continuous Delivery as they automate all the stages (build, test, release, etc.) of your software delivery process. There are numerous benefits to using Continuous Deployment pipelines. An automated pipeline allows all stakeholders to monitor the progress, eliminates the overhead of all the manual work, provides quick feedback, and more importantly builds confidence on the code quality. Continuous Delivery Pipeline (CDP) The deployment pipeline run starts with a developer committing source…

Read More Read More

Continuous Integration Continuous Integration is an agile engineering practice originating from the extreme programming methodology. It primarily focuses on automated build and test for every change committed to the version control system by the developers. According to Martin Fowler, “Continuous Integration (CI) is a software development practice where members of a team integrate their work frequently; usually each person integrates at least daily – leading to multiple integrations per day. Each integration is verified by an automated build (including test)…

Read More Read More