OIDC & Workload Identity
GitLab OIDC federation with GCP workload identity — CI pipelines impersonate scoped service accounts without long-lived keys.
End-to-End Security
Private GKE Autopilot, NetworkPolicy default-deny, Gateway HTTPS, cert-manager DNS-01, and proxy-subnet ingress controls.
Golden Path Templates
Cookiecutter generator scaffolds bootstrap + app repos with Helm, GitLab CI, and Terraform — repeatable onboarding in minutes.
AI Code Review (GitLab Duo)
GitLab Duo AI code review on merge requests — automated security and quality feedback before changes reach production.
Terraform Bootstrap
Provision Artifact Registry, CI service accounts, WIF bindings, and GKE IAM — infrastructure ready before first deploy.
Platform Helm
cert-manager, external-dns, cluster issuers, and gateway ingress policies — shared platform capabilities for every app.