Thoughtworks · Client engagement · Germany

Daimler AG

Secrets management and CI/CD on OpenShift

Case focus

Shared credentials, delivery workflows and the teams operating them.

My roleDevOps Team Lead

Project participationNov 2020 – May 2021

EnvironmentOpenShift · Vault · GoCD · Nexus

01 / Role & scope

Supporting a shared delivery environment.

As DevOps Team Lead on a Daimler engagement, I worked on shared credential management, CI/CD and OpenShift delivery. I migrated the existing gopass-based credential workflow to HashiCorp Vault and implemented GoCD Pipeline-as-Code with Nexus-based container management.

My work also included platform and delivery support, coordinating service migrations, operating documentation and handover. The changes needed to fit the teams using the platform across development, test and production.

02 / Credential migration

Moving shared credentials from gopass to Vault.

The existing credential workflow had become slow as the user base grew. In our setup, updates involved re-encrypting stored secrets and pushing changes to Git. Encryption and upload time made password synchronisation a lengthy operation.

I migrated the credential system to a highly available HashiCorp Vault deployment on OpenShift, reducing password synchronisation from over an hour to seconds for more than 200 users.

Before migration: Over 1 hour
After migration: Seconds
Users supported: 200+

Choosing around the access workflow.

Speed was one part of the decision. Adding users, removing access when people left and managing shared secrets also mattered. Vault offered a central service with access controls and CLI/API interfaces suited to the Kubernetes-based environment.

The Vault service used active and standby replicas with PostgreSQL storage. This made credential access a platform service, with its own availability, storage and access-management responsibilities.

03 / Pipeline-as-Code

Making build and deployment steps explicit.

I implemented GoCD Pipeline-as-Code and Nexus-based container management to support automated delivery across environments. Pipeline definitions moved into versioned files, with reusable templates and helpers for application builds and OpenShift deployment.

The work included local validation of pipeline YAML and staged service migrations to the updated delivery environment. Build and deployment remained distinct steps, making it easier to see where a change had reached and where a failure occurred.

Git source · GoCD pipeline definitions

GoCD buildBuild application artifacts.
NexusStore versioned artifacts.
OpenShiftBuild and tag images; apply deployment configuration.
Rollout checkTrack deployment completion.

VaultApplication secrets supplied during deployment.

GoCD orchestrates build and deployment; Nexus stores artifacts and Vault provides application credentials.

Build: Separate API and UI paths used Gradle or npm helpers, OpenShift binary builds and pipeline labels for image tags.
Deploy: Templates and helpers prepared configuration and application secrets before starting an OpenShift DeploymentConfig rollout.
Check: Rollout-status checks made deployment progress visible in the pipeline.

04 / Team & operations

Helping teams adopt and operate the changes.

The work extended beyond configuring Vault and pipelines. I coordinated migration timing with service teams, supported delivery work and maintained practical material for colleagues taking over the environment.

Coordinate: Share migration plans, track service-by-service progress and identify work needing review or agreement.
Support: Help teams with pipelines and platform access, including provision of a development/test host for another team’s Kubernetes work.
Transfer: Bring together operating instructions, platform references, open decisions and ownership tasks for handover, alongside DevOps guild sharing.

The engagement combined a faster credential workflow with repeatable delivery and the coordination needed to keep those shared services usable by other teams.