Compliance Without the Chaos: Building It Right Into Your DevOps...
summary
Claim: bake compliance checks into CI/CD so audits stop derailing sprints. Practical recipe: GitHub + Jenkins build images, push to a designated registry, enforce policies in Kubernetes via OPA Gatekeeper hooked to the admission controller, emit decision logs into a central store, and serialize events into a compliance data lake for evidence chaining. Example wins: a handful of Python scripts already cut manual evidence collection time, Halyard/Spinnaker logs map to change-management controls, and continuous scans plus scaled evidence generation make audits repeatable rather than chaotic.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker intro
- 1:06Speaker background and motivation
- 3:12What is GRC and compliance focus
- 5:45Compliance team workflows
- 8:13Goal of compliance without chaos
- 8:35DevOps pipeline overview
- 10:21Kubernetes infrastructure details
- 11:48Compliance in vs of the pipeline
- 13:32Two compliance concepts explained
- 15:38Kubernetes config management example
- 19:51Spre deployment compliance example
- 22:47Compliance tooling requirements
- 27:23Evidence collection and audit logic
- 28:49Summary and key takeaways
- 29:10Q&A session
related talks
22mKeynote Session: Compliance at the Point of Change: Security and Dev..
05mHow To Automate Compliance If You Aren't Chuck Norris
33mCompliance as Code - Lessons Learned From Regulated Organizations
29mAn Unlikely Happy Couple - DevOps and IT Audit?
30mAutomating Governance - Dear Security, Compliance, & Auditors We’re Sorry. Love DevOps
37mDevOps - The Automation of Compliance
29mPanel Discussion: Ask an Auditor Anything: DevOps Compliance
22mPutting Governance Into your DevOps Processes