GitOps in Modern Security-Compliant Environments
summary
UserTesting applies GitOps across IaC and app delivery using monorepo Terraform modules, ArgoCD and ArgoCD + GitHub Actions for CI/CD, and ECR + Helm for images. Each environment lives in its own AWS account with cross-account KMS, IRSA, mTLS and S3/Dynamo for TF state. Modules get validated by test account instantiation (deploy and destroy); CI runs tflint, trivy and policy checks, auto-generates semantic tags from conventional commits, and creates PRs to promote dev→staging→prod with manual apply for production. 75 of the Fortune 100 are customers; three capsules (networking, engineering, runtime).
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 2:26User Testing use case
- 7:24Infrastructure as Code goals
- 10:40Repository and module structure
- 14:14Deployment pipelines
- 17:04Application CI/CD flow
- 22:08GitOps integration summary
- 23:54Security and traceability
- 24:36Next steps and challenges
- 26:26Q&A session
related talks
22mGitOps - The Magic Key to Cloud Native Security
28mGitOps and CI/CD: Maintaining Security in the Age of Automation
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
16mSecure Your GitOps - How to Implement a Robust Security Strategy
37mSecure Multi-Tenant GitOps Application & Infrastructure Rollouts At Adobe
09mSecuring GitOps
21mContinuous Delivery: The Missing Piece in the GitOps-OCI Security Puzzle
30mDeclarative by Default, Secure by Design: GitOps as a Control Plane for Governance