--- title: Observability and Security | Shopware Community Hub description: >- Learn how observability, CI/CD security checks, Kubernetes Secrets, and RBAC help teams operate Shopware projects with clearer signals and safer access. canonical_url: >- https://hub.shopware.comhttps://hub.shopware.com/learn/course/observability-and-security --- # Observability and Security # Observability and Security Running Shopware in production is not only about shipping containers. Teams also need to understand what the running system is doing, notice security risks before they become delivery problems, and control which workloads can access sensitive values. This course connects those operational concerns in one flow. You start with observability, build a local metrics, logs, and traces setup, move into CI/CD security checks, and then learn how Kubernetes Secrets, ServiceAccounts, and RBAC protect sensitive runtime values. The Kubernetes-specific parts of this course are most relevant when your team operates workloads in Kubernetes. Managed hosting and PaaS projects still need observability, dependency checks, secret handling, and access control, but the concrete tools may come from the provider or platform instead of Kubernetes objects. The learning flow moves from visibility to control: - First, you learn which signals help teams understand a running Shopware project. - Then, you run a local observability stack and verify metrics, logs, and traces. - Then, you learn how CI/CD security checks make image and dependency risks visible. - Then, you add practical GitHub Actions workflows for those security checks. - Finally, you learn how Kubernetes Secrets, ServiceAccounts, and RBAC limit exposure inside the cluster. - Understand how metrics, logs, traces, alerts, and dashboards help teams operate Shopware projects. - Build and verify a local observability stack with Grafana, Prometheus, Loki, Tempo, Promtail, and OpenTelemetry. - Understand how container scanning, dependency audits, scheduled scans, and security gates fit into CI/CD. - Create practical GitHub Actions workflows for image scanning, dependency audits, scheduled checks, and blocking gates. - Learn how Kubernetes Secrets, ServiceAccounts, RBAC, and least privilege protect sensitive runtime values. - Create and verify a Kubernetes Secret consumed by a demo workload. ## Learning Approach This course alternates between mental models and practical labs. The theory units answer the "why" and "where" questions: - Which observability signals matter in a Shopware project? - Which CI/CD checks make image and dependency risks visible? - Where should sensitive runtime values live? - Which identity and permission model should a workload use? The practical labs then make those ideas visible: - You run a local observability stack and inspect metrics, logs, and traces in Grafana. - You create dedicated GitHub Actions workflows for image scans, dependency audits, scheduled checks, and a blocking security gate. - You create a Kubernetes Secret and verify how a running Pod consumes it. The examples use Docker Compose, Grafana, Prometheus, Loki, Tempo, Promtail, the OpenTelemetry Collector, GitHub Actions, Trivy, Composer, npm, Kubernetes Secrets, and `kubectl`. By the end of the course, you will not only know the tools, but also how the operating model connects: observability makes runtime behavior visible, CI/CD security checks keep image and dependency risks visible, and Kubernetes access control limits how sensitive values reach workloads. Ready to connect observability, security checks, and Kubernetes access control in one operational flow? Then start with Unit 1 and follow the course from runtime signals to safer workload permissions. ## Learning Units ## Units - [Observability for Shopware Projects](https://hub.shopware.com/learn/unit/observability-for-shopware-projects): Learn how observability uses metrics, logs, traces, and alerts to make running Shopware projects easier to understand and operate. - [Practical Lab: Running a Local Observability Stack for Shopware](https://hub.shopware.com/learn/unit/practical-lab-running-a-local-observability-stack-for-shopware): Build and verify a local Shopware observability stack with Docker Compose, Grafana, Prometheus, Loki, Tempo, Promtail, and OpenTelemetry. - [Security in CI/CD](https://hub.shopware.com/learn/unit/security-in-cicd): Learn how CI/CD security checks make image and dependency risks visible before and after Shopware changes reach production. - [Practical Lab: Adding Security Scanning With GitHub Actions](https://hub.shopware.com/learn/unit/practical-lab-adding-security-scanning-with-github-actions): Create GitHub Actions workflows for container scanning, dependency audits, scheduled checks, and blocking security gates in a Shopware project. - [Managing Secrets and Access in Kubernetes](https://hub.shopware.com/learn/unit/managing-secrets-and-access-in-kubernetes): Learn how Kubernetes Secrets, ServiceAccounts, and RBAC protect sensitive values and limit access for Shopware workloads. - [Practical Lab: Creating and Consuming Kubernetes Secrets](https://hub.shopware.com/learn/unit/practical-lab-creating-and-consuming-kubernetes-secrets): Create a Kubernetes Secret with dummy Shopware database values, consume it from a demo workload, and verify the injected values. - [Practical Lab: Syncing External Secrets Into Kubernetes](https://hub.shopware.com/learn/unit/practical-lab-syncing-external-secrets-into-kubernetes): Replace a manually created Kubernetes Secret with a Secret synced from a local Vault-style source and verify the existing workload still works.