Security

Environment-stable table ownership: surviving cross-environment restore with IAM database auth

Cloud SQL IAM database auth breaks cross-environment restores because table ownership encodes a per-environment service account. Make ownership environment-independent by owning every table as cloudsqlsuperuser.

Test your guardrails: policy-as-code that you actually verify

Policy-as-code that’s never tested usually fails open — it waves violations through and no one notices. How to test guardrails so they both deny when they must and pass when they must.

Use GKE Connect Gateway to protect your private control plane

Reach a private GKE cluster’s API server without a bastion or authorized-networks — using the GKE-native Connect Gateway, with GCP IAM outside the gateway and Kubernetes RBAC inside.

One GitHub App, two auth models: repo credentials, webhooks, and SSO for Argo CD

Argo CD needs three different things from GitHub — repo reads, webhook delivery, and human SSO. How a single GitHub App covers all three with short-lived installation tokens instead of a leak-prone PAT.