Secrets
Credentials out of source and out of images: workload identity, secret managers, and rotation that applications actually survive.
Credentials, API keys, private keys, certificates and tokens must not live in source control or in images — because both are copied, cached and retained far beyond the systems you control.
A secret manager is a store with access control, versioning, audit and encryption at rest — and the product details differ enough between providers that a working design is not portable without re-verification.
The primitive that removes the first secret: the platform attests what a workload is, that attestation is exchanged for a short-lived credential, and no static key exists anywhere for an attacker to find.
Old, then new alongside old, then a transition window, then old revoked — and the application must tolerate the change, because one that reads a secret at boot and caches it forever breaks the moment you rotate.
CI holds credentials for everything and executes code that anyone can propose — which makes it the highest-value target in the delivery path and the one most often protected by conventions rather than controls.
The characteristic secret failure is a crash loop with an error that does not mention secrets at all — which is why secret resolution belongs in startup validation, where it can fail loudly and name what is missing.