Secure Your GitOps - How to Implement a Robust Security Strategy
summary
Intuit runs 350+ clusters using GitOps and describes concrete controls: CI uses short‑lived creds, image registry enforces immutable tags and scans with Twistlock/Prisma Cloud, Git deployment repos require branch protection, PR reviews and automated checks, and admission via OPA admission webhook blocks untrusted registries and enforces signed images. Secrets use sealed-secrets and Vault or external managers, operators run with least privilege (no cluster-admin), multi‑tenant setups restrict namespaces and ban cluster‑scoped resources, and GitOps infrastructure has DR and audit logging.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:57GitOps Operator Security Pattern
- 2:51What Do You Need To Secure?
- 3:50Securing the CI/CD Pipeline
- 4:26Securing the Container Registry
- 5:32Securing the Git Repository
- 8:50Securing the Kubernetes Cluster
- 11:02Securing Secrets
- 12:40Securing the GitOps Operator
- 14:53GitOps Multi-tenant Management
related talks
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
29m100,000 Different Ways to Manage Secrets in GitOps
28mGitOps and CI/CD: Maintaining Security in the Age of Automation
43mSecuring Secrets in the GitOps Era
46mSecuring Secrets in the GitOps era
22mGitOps - The Magic Key to Cloud Native Security
29mSecuring secrets in the GitOps era
27mGitOps, Kubernetes, and Secret Management: Don't Bake in a Tent!