Thanks for sharing! I definitely hadn't seen that plugin. We definitely use helm, even though I hate it lol. I will take a look when I get around to looking at external secrets since I still haven't had a chance to (you know how it goes... priorities made up by some random PM or whatever)

best way:

$(pwd)/ngnix.conf:<container path>

Be really careful when building images that require secrets for build configuration. Secrets can be passed in as build args, but you MUST UNSET THEM IN THE DOCKERFILE and then repass them in as environment variables at runtime (or else you are leaking your secrets with your image).

Also, image != container. Image is the thing you publish to a registry (e.g. dockerhub). Container is an instance of an image.

This is a great explanation, thank you.

I deal mainly with authorization and I'm not sure I've ever had the differences explained this simply (so I incorrectly lump them together)

I rebase my dev branches on main to get rid of garbage commit messages due to me being lazy.

Squash and merge PRs into main, no merge commits allowed.

I think there are reasonable arguments for allowing rebase and merge to main, but it often doesn't apply for me.

Merge commits in main will break a lot of out of the box GitOps tools.

Sometimes the audit is unavoidable. Recently went through one, and my first thought was "wait, people still use oracle jdk?". Thankfully not my job to deal with, but I guess some companies never migrated off which blows my mind, but, to each their own I guess. Oracle is coming around looking for a paydays.