Secure by Design: Embedding DevSecOps into Your GitOps Workflows
summary
Shows a concrete GitOps architecture: central Argo CD management for 25+ clusters, 85% fewer CVEs after adding image signing and scans. CI pipelines run Semgrep/Checkov/Bandit and Trivy/Aqua before pushing images; images are cosigned and admission controllers enforce Kyverno and Falco policies. Repo layout keeps cluster policies in a target-revision branch, protected branches and pre-commit secret scanning block bad PRs, and OIDC short‑lived creds replace long‑lived service principals for tighter supply‑chain controls.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:40Agenda
- 4:05Why GitOps isnt secure
- 8:27DevSecOps
- 13:06Policy Controls
- 15:58Target Revision
- 22:46Summary
related talks
34mSecure by Default with GitOps - A Guide to OPA with Argo CD
16mSecure Your GitOps - How to Implement a Robust Security Strategy
09mSecuring GitOps
28mGitOps and CI/CD: Maintaining Security in the Age of Automation
22mGitOps - The Magic Key to Cloud Native Security
26mSecuring GitOps Supply Chain with Sigstore and Kyverno
25mPolicy-Based GitOps: How Policies Can Help Secure and Automate GitOps...
21mContinuous Delivery: The Missing Piece in the GitOps-OCI Security Puzzle