- Kit repositories defining deployment templates
- Environment manifests and variable files
- Credentials references for BOSH/UAA/secret stores
- Keep environment-specific values separated from reusable kit logic.
- Treat secret material as external state managed by a dedicated secret backend.
- Review diff output before every deployment action.