The following files contain sensitive information and are protected by .gitignore:

• .argocd-credentials - Argo CD login credentials
• terraform/terraform.tfvars - OpenStack API credentials
• .env files - Environment variables

• terraform/cpouta_key.pem - Auto-generated SSH private key
• Any *.pem or *.key files

• terraform/*.tfstate - Contains resource IDs and sensitive data
• terraform/*.tfstate.backup - Backup of state files

Before committing to Git, verify sensitive files are ignored:

# Check if sensitive files are tracked
git status

# Verify .gitignore is working
git check-ignore .argocd-credentials
git check-ignore terraform/cpouta_key.pem
git check-ignore terraform/terraform.tfvars

All three commands should return the filename if properly ignored.

After deployment, consider:

• Changing the Argo CD admin password
• Rotating OpenStack API credentials periodically

• The SSH key cpouta_key.pem is auto-generated by Terraform
• Keep it secure and don't share it
• Use -i flag when SSHing: ssh -i terraform/cpouta_key.pem ubuntu@<IP>

• Security groups restrict access by IP (0.0.0.0/0 by default)
• Consider restricting to your IP range for production
• Update terraform/network_and_secgroups.tf to limit access

• Change the default admin password after first login
• Use RBAC to create limited users
• Enable SSO if available

• Never force-add ignored files: git add -f <file> ❌
• Review files before committing: git diff --staged
• Use .gitignore consistently across environments

1. Don't just delete and recommit - secrets remain in Git history
2. Remove from history:

   git filter-branch --force --index-filter \
     "git rm --cached --ignore-unmatch <FILE>" \
     --prune-empty --tag-name-filter cat -- --all

3. Rotate the compromised credentials immediately
4. Force push (if remote exists): git push --force --all

Before committing:

• .gitignore exists in root
• No *.pem or *.key files staged
• No terraform.tfvars staged
• No .argocd-credentials staged
• No *.tfstate files staged
• Run git status to verify

These files are safe and should be committed:

• ✅ terraform/*.tf files (except *.tfvars)
• ✅ deploy-k8s-cluster.ps1
• ✅ README.md, QUICKSTART.md, SECURITY.md
• ✅ .gitignore
• ✅ ansible-reference-backup/*.yml (playbooks only)

If you discover a security issue:

1. Rotate affected credentials immediately
2. Update the relevant services
3. Review access logs for suspicious activity