SEO: add FAQ sections to 5 /what-is/ pages, reword polluted question headings (#20840)

* SEO: add FAQ sections to 5 /what-is/ pages, reword polluted question headings

Adds a deliberate "## Frequently asked questions" section to the 5 largest
no-FAQ /what-is/ pages (what-is-secrets-management, what-is-devops-automation,
what-are-kubernetes-secrets, what-is-a-circleci-secret, what-is-ci-cd),
sourced from real 90-day Google Search Console query data on each URL.

Correction to the originating card: these pages were NOT excluded from
FAQPage schema. The graph-builder.html collector auto-qualifies every
`type: what-is` page with zero front-matter flag or template change, and
faq-entity.html harvests ANY `## ...?` / `### ...?` heading anywhere in the
page body, not just a dedicated FAQ section. All 5 pages already had
question-shaped narrative headings and were therefore already emitting
FAQPage schema, just with oversized/polluted answers (some over 4,000
characters, since a narrative section's bullet list or sub-heading kept
getting swallowed into the answer text before this repo's answer-boundary
fix in a companion PR).

Per STYLE-GUIDE.md (headings should not end in punctuation except inside a
dedicated FAQ section), rewords the subset of existing narrative headings
whose extracted answers were still oversized after the boundary fix, to
plain statement form. Checked for inbound anchor links to each renamed
heading's slug before renaming; none were found.

Every new FAQ answer is pure prose (no lists/tables/code/sub-headings),
answer-first, 40-80 words, and avoids duplicating an answer already given
verbatim elsewhere on the page.

* Apply suggestions from code review

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

---------

Co-authored-by: workprentice <257153108+workprentice@users.noreply.github.com>
Co-authored-by: Cam Soper <csoper@pulumi.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: 4 people

content/what-is/what-are-kubernetes-secrets.md

@@ -15,7 +15,7 @@ Kubernetes, or K8s, is an open-source container orchestration platform designed
 
 Kubernetes Secrets, or [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) for short, are a built-in Kubernetes solution to manage the lifecycle of secrets, which are sensitive data such as passwords, API keys, and tokens. These secrets are consumed by containerized applications directly, to prevent the exposure of sensitive data in code, Docker images, or configuration files.
 
-## Why use Kubernetes Secrets?
+## Reasons to use Kubernetes Secrets
 
 Manual secrets management is prone to introducing errors and poses high-lift operational challenges. At the same time, the absence of a dedicated secret management solution means carrying a higher risk of accidental data leaks or unauthorized access to private information. One should never use ConfigMaps to hold secrets. Kubernetes Secrets come into play by providing an integrated mechanism for the secure storage and distribution of sensitive data to pods.
 
@@ -267,3 +267,21 @@ To address these challenges, you may consider using external secret management t
 The thing to internalize is that a Kubernetes Secret is a storage and distribution primitive, not an encryption boundary. Base64 is encoding, namespace-scoped RBAC is the only built-in access control, and there is no versioning, rotation, or audit trail in the box. Treating the native Secret as "secure by default" is where most real exposures start. The practical decision is not whether to use Kubernetes Secrets, but what you layer on top: encryption at rest in etcd, tight RBAC, and an external system when you need rotation, cross-namespace sharing, or an audit history.
 
 For encrypting values so they never appear in plain text in your state file, see Pulumi's [Secrets Management guide](/blog/managing-secrets-with-pulumi/). The [Pulumi community on Slack](https://slack.pulumi.com/) is open for questions and discussion.
+
+## Frequently asked questions
+
+### What is a Kubernetes Secret used for?
+
+A Kubernetes Secret holds small amounts of sensitive data, such as passwords, tokens, and keys, separately from application code and pod specifications. Rather than hard-coding credentials into a container image or manifest, an app references a Secret by name and Kubernetes injects the value as an environment variable or mounted file at runtime.
+
+### How secure are Kubernetes Secrets?
+
+Kubernetes Secrets are base64-encoded by default, not encrypted, so anyone with cluster or etcd access can trivially decode them. Real security depends on what you layer on top: enabling encryption at rest for etcd, restricting access with RBAC and namespaces, and rotating values regularly. Treat the native Secret object as a storage primitive, not a security boundary.
+
+### What is the difference between a Kubernetes Secret and a ConfigMap?
+
+A Kubernetes Secret is for sensitive data, like passwords, tokens, and certificates, while a ConfigMap is for non-sensitive configuration, like environment settings or feature flags. Both expose data to pods the same way, as environment variables or mounted files, but Secrets receive additional handling, such as base64 encoding and tighter RBAC defaults, that ConfigMaps do not.
+
+### How do you manage secrets in Kubernetes with infrastructure as code?
+
+With Pulumi, you manage Kubernetes Secrets as native resources in a real language, TypeScript, Python, Go, C#, or Java, using the Kubernetes provider's `Secret` resource alongside encrypted Pulumi config or ESC for the underlying values. This keeps sensitive data out of source control, lets you test and preview changes before applying them, and ties secret creation into the same CI/CD workflow as the rest of your infrastructure.

content/what-is/what-is-a-circleci-secret.md

@@ -10,7 +10,7 @@ authors: ["diana-esteves"]
 
 [CircleCI](https://circleci.com/) is an agile, continuous integration/continuous deployment ([CI/CD](/what-is/what-is-ci-cd/)) platform. It aims to automate software development processes for faster, more reliable releases. CircleCI secrets empower developers to safeguard critical data while streamlining workflows.
 
-## What is a CircleCI secret?
+## CircleCI secrets, defined
 
 CircleCI secrets are sensitive information that must be protected to guarantee the safe and reliable building and deployment of applications within your CI/CD pipeline. They can include API tokens, SSH keys, and environment variables containing credentials. These are to be hidden from the public and protected with access control to maintain security and integrity. In CircleCI, secrets are used within the configuration of continuous integration and delivery pipelines to allow automated processes to interact securely with other services, repositories, and infrastructure. Managing these secrets is crucial to prevent unauthorized access and potential security breaches.
 
@@ -161,6 +161,24 @@ Using CircleCI secrets comes with particular challenges and considerations that
 
 Addressing these challenges and considerations requires a thoughtful approach to [secrets management](/what-is/what-is-secrets-management/), clear communication within the development team, and a commitment to maintaining security best practices throughout the CI/CD pipeline. Regular reviews and updates to your secret management strategy will help ensure a secure and efficient development process.
 
+## Frequently asked questions
+
+### What is a CircleCI secret?
+
+A CircleCI secret is an encrypted environment variable or credential, such as an API token, SSH key, or password, stored in a CircleCI project's or context's settings rather than in code. CircleCI injects it into build jobs at runtime so pipelines can authenticate with external services without exposing the underlying value in configuration files, logs, or version control.
+
+### What is CircleCI used for?
+
+CircleCI is a continuous integration and continuous delivery (CI/CD) platform used to automate the build, test, and deployment stages of the software release process. Teams configure pipelines that trigger on code changes, run automated test suites, and deploy validated builds to staging or production environments, reducing manual effort and catching issues earlier in development.
+
+### What are CircleCI's key features?
+
+CircleCI's headline capabilities include contexts, which let teams share secrets securely across multiple projects and pipelines without duplicating them; orbs, reusable packages of configuration that simplify integrating third-party tools; and parallelism with configurable resource classes, which split test suites across multiple containers to shorten build times on larger codebases.
+
+### How did the CircleCI breach demonstrate the risks of long-lived secrets?
+
+In January 2023, CircleCI disclosed a security incident in which an attacker gained access to its internal systems. CircleCI advised all customers to immediately rotate every secret and token stored in the platform as a precaution. The episode illustrated why static, long-lived secrets are risky: a single compromised store can expose credentials across many pipelines, which is why short-lived, frequently rotated, or dynamically issued secrets are preferable.
+
 ## Conclusion
 
 CircleCI secrets solve storage and access, but they leave you holding long-lived credentials that someone has to track, rotate, and audit as your contexts multiply. The more durable move is to remove the secret from the loop entirely: use OIDC so CircleCI exchanges a short-lived, job-scoped token at runtime instead of reading a stored key. Treat stored secrets as the exception you actively work to eliminate, not the default you accumulate.

content/what-is/what-is-ci-cd.md

@@ -37,7 +37,7 @@ You may have also heard the phrase "continuous deployment." Continuous deploymen
 
 To add continuous deployment to our Hello World example, we'd take the latest Docker image tag and deploy it in a running container so that end users can take advantage of the new code changes. However, let's first learn about pipelines before we show you how to do so.
 
-### What is a CI/CD pipeline?
+### What a CI/CD pipeline looks like
 
 The sequential nature of continuous integration, delivery, and deployment practices creates a symbolic pipeline, hence the CI/CD pipeline.
 
@@ -81,6 +81,24 @@ For a detailed exploration and steps to implement CI/CD and DevOps practices, re
 
 * **Version control**: Learn about version control systems supported by Pulumi in our [version control documentation](https://www.pulumi.com/docs/intro/concepts/state/#backends).
 
+## Frequently asked questions
+
+### What is CI/CD?
+
+CI/CD stands for continuous integration and continuous delivery (or deployment), a methodology that automates how code moves from a shared repository into production. Continuous integration merges and tests code changes frequently, while continuous delivery/deployment automates the release process so validated changes reach users quickly, reliably, and with minimal manual intervention.
+
+### What is a CI/CD pipeline?
+
+A CI/CD pipeline is the automated sequence of stages a code change passes through on its way to production: build, test, and deploy. Each commit triggers the pipeline, which compiles the code, runs unit and integration tests, and, if those pass, packages and releases the change, often with security scans, approvals, or notifications added along the way.
+
+### What is the difference between continuous delivery and continuous deployment?
+
+Continuous delivery automates every release step but stops just short of production, requiring a manual approval before the change ships. Continuous deployment removes that gate entirely: any change that passes automated tests deploys straight to production without human sign-off. Both assume the codebase is always in a releasable state; they differ only in whether a person decides when releases happen.
+
+### What is a continuous integration platform?
+
+A continuous integration platform is the tooling that runs your automated builds and tests whenever code changes, such as GitHub Actions, GitLab CI, CircleCI, or Jenkins. For infrastructure specifically, Pulumi integrates with these CI/CD platforms, and Pulumi Deployments extends that model by running infrastructure previews, tests, and updates directly from your existing CI/CD workflows.
+
 ## Learn more
 
 With Pulumi, you can create, deploy, and manage infrastructure on any cloud using the programming languages and tools you already know. [Get started today](/docs/get-started/).

content/what-is/what-is-devops-automation.md

@@ -42,13 +42,13 @@ DevOps automation refers to integrating technologies that minimize manual interv
 
 In this article, we'll unravel how automation not only accelerates software delivery but also fosters a culture of collaboration, innovation, and continuous improvement. Whether you're a novice exploring DevOps for the first time or an expert seeking to refine your automation strategies, this guide provides a holistic overview of the DevOps automation landscape.
 
-## What is DevOps Automation?
+## Understanding DevOps automation
 
 DevOps, a fusion of "development" and "operations," is both a cultural movement and a philosophy that emphasizes the collaboration between software developers and IT operations teams. The core idea behind DevOps is to break down silos, enhance communication, and streamline processes to deliver software faster, more reliably, and with improved quality. It represents a shift from traditional software development and infrastructure management processes, encouraging rapid, iterative work cycles and shared responsibility for the end product's performance and reliability.
 
 At the heart of the DevOps paradigm is automation. DevOps automation aims to reduce the manual overhead in tasks such as code integration, testing, deployment, and infrastructure provisioning. By automating these processes, organizations can achieve more frequent deployments, reduce human error, and ensure consistent environments from development to production. This not only accelerates software delivery but also fosters collaboration by integrating the efforts of different teams through shared tooling and processes. The idea is to allow teams to focus on delivering value rather than getting bogged down with repetitive tasks.
 
-## Why is DevOps Automation important?
+## Why DevOps automation matters
 
 In today's fast-paced digital world, agility and responsiveness have become critical for businesses to stay competitive. DevOps automation, in essence, serves as the backbone for this agility. Without automation, organizations would find it challenging to maintain the pace of modern software delivery, respond to market changes, and ensure top-notch service quality. Moreover, as the complexity of IT environments continues to grow – with microservices, cloud-native architectures, and intricate deployment topologies – manual processes become increasingly error-prone and unsustainable. DevOps automation bridges this gap by creating streamlined, repeatable, and scalable processes that drive innovation without compromising reliability.
 
@@ -60,7 +60,7 @@ In today's fast-paced digital world, agility and responsiveness have become crit
 * **Scalability:** Automation allows businesses to adapt to changing loads and demands easily. Whether it's scaling infrastructure during traffic spikes or managing complex deployment patterns, automation ensures systems remain responsive and resilient.
 * **Cost Efficiency:** By eliminating manual overhead, reducing errors, and accelerating delivery, organizations can achieve significant cost savings. Moreover, quick feedback loops ensure that defects are detected early, further reducing the costs associated with late-stage error rectification.
 
-## What types of DevOps processes can/should be automated?
+## DevOps processes that can be automated
 
 * **Continuous Integration (CI):** This is the practice of frequently merging code changes into a central repository. Automated tests are run to ensure new changes don't introduce errors. It's essential for catching issues early and streamlining code integration.
 * **Continuous Delivery/Deployment (CD):** Once code passes the CI phase, it can be automatically deployed to various environments (staging, production). Continuous Delivery ensures the code is always in a deployable state, while Continuous Deployment automates the deployment to production.
@@ -72,7 +72,7 @@ In today's fast-paced digital world, agility and responsiveness have become crit
 
 By automating these processes, DevOps teams can ensure consistency, reliability, and efficiency throughout the software development lifecycle, while also freeing up time for more value-added tasks and innovations.
 
-## What does effective DevOps automation look like?
+## Characteristics of effective DevOps automation
 
 Effective DevOps automation transcends merely stringing together a series of tools and scripts. At its core, it represents a seamless fusion of culture, process, and technology. Culturally, teams are aligned in their goals, fostering an environment of transparency, continuous learning, and shared responsibility.
 
@@ -127,6 +127,24 @@ By adhering to these best practices, teams can maximize the benefits of [DevOps
 
 Embarking on the journey of DevOps automation can seem daunting given its expansive nature, but it's pivotal to start with a clear understanding of your organization's needs and pain points. Begin by identifying repetitive tasks, bottlenecks, and areas prone to human error, then prioritize them for automation. As you work through this, consider embracing tools like [Pulumi](https://www.pulumi.com/), which stands out for its unique approach to Infrastructure as Code. Pulumi allows you to define and manage infrastructure using popular programming languages you're already familiar with, thereby seamlessly integrating into existing development workflows. By leveraging such tools, and fostering a culture of collaboration and continuous improvement, organizations can unlock the full potential of DevOps automation, driving efficiency, reliability, and innovation in their software delivery processes.
 
+## Frequently asked questions
+
+### What is DevOps automation?
+
+DevOps automation is the use of tools and scripts to carry out software delivery and infrastructure tasks, such as building, testing, deploying, and provisioning, without manual, repetitive human effort. It applies automation across the entire development lifecycle so teams can ship changes faster, with fewer errors, and with consistent, repeatable results from development through to production.
+
+### What is automation in DevOps?
+
+Automation in DevOps refers specifically to the mechanisms, such as scripts, pipelines, and tooling, that DevOps teams use to execute the broader DevOps philosophy of collaboration and continuous delivery. Where DevOps is the cultural and organizational practice, automation is the practical machinery that makes that practice repeatable, measurable, and scalable across teams and environments.
+
+### What does DevOps automate?
+
+DevOps automation typically covers CI/CD pipelines that build and release code, automated testing that validates changes before they ship, infrastructure provisioning that stands up and configures cloud resources, and monitoring that watches applications in production. Configuration management and incident remediation are also commonly automated, reducing manual handoffs at nearly every stage of the delivery lifecycle.
+
+### What is a DevOps automation platform?
+
+A DevOps automation platform brings these individual automations, CI/CD, provisioning, testing, monitoring, into one coherent system teams can use consistently. Pulumi contributes to that platform picture through infrastructure as code written in real programming languages, policy as code for guardrails, and self-service delivery via an internal developer platform, letting infrastructure automation plug into the same workflows as application code.
+
 ## Conclusion
 
 The point worth holding onto is that DevOps automation isn't a checklist of tools to bolt together. Its value comes from removing the manual handoffs between people, so a change can move from a developer's machine to production without anyone stopping to glue steps together by hand. That's why the KPIs that matter measure flow and recovery rather than tool count: you're optimizing how reliably work moves through the system, not how many scripts you've written. Treat automation as the thing that lets your teams spend their attention on decisions only humans can make, and the rest of the practice tends to fall into place.