article
Drift repair in a deploy went looking for root on my hypervisor
A self-repairing deploy step grabbed my Proxmox host's root key whenever it saw drift, despite docs saying a human runs it. I swapped it for a token that can only run guest commands on one VM, pinned the API certificate before the token is ever sent, and banned the old path in the deploy scan.
Read more 5m read