2 posts tagged with "gitops"

The GPG lock that should never have existed

September 4, 2026 · 6 min read

System Administrator

A fleet of about ten VMs that deploy themselves via ansible-pull every 30 minutes. Every so often, one of them stops converging, stuck on a gpg: waiting for lock or SQL library used incorrectly error. The cause: a task importing a GPG key that nothing used anymore, somewhere in a shared role run by every VM.

Diagram showing two paths in the pipeline: a dead path that imports a GPG key and ends in an orphaned lock, and the real path that verifies an SSH signature and runs the playbook

GitOps without Vault: reducing blast radius by verifying instead of storing

August 27, 2026 · 12 min read

BENE Maël

System Administrator

Deploying a fleet of VMs with no central server pushing configuration, no secrets vault permanently exposed, and a simple question asked on every cycle: "was what I'm about to execute signed by someone authorized?" This post describes the pull-based GitOps architecture I built around that question, and why it mechanically shrinks the attack surface compared to a classic push model.

Diagram of the ansible-pull pipeline: a VM fetches the Git repository, verifies the tag signature before any execution, runs the playbook only if verification passes, otherwise aborts without executing anything