Shawn Hsiao

Improve secrets-unseale RBAC configuration to avoid cluster-wide read/write of secret objects

2

If I understand it correctly, the controller does not make any assumption that it can read secrets cluster-wide. The current installed cluster role 'secrets-unsealer' is written such that the controller...

**Overview** Passport issues stamps for github connected account, but the trust_bonus score does not include it. Maybe it is redundant but having a stamp that has no effect seems odd....

How to safely deploy stacks using AlbToFargate into the same VPC

5

This is not necessarily a bug but it is not clear to me what the best practices are. Because AlbToFargate (and other constructs) attaches service endpoint (e.g., ecr, ddb) into...