Securing GitOps
summary
GitOps security centers on four concrete controls: lock down the GitOps engine (use Argo CD and Flux, run as a dedicated service account, restrict namespaces), harden repositories (branch protection, fork/pull workflow, HA and backups), validate content (linting, schema checks, policy engines like OPA/kyverno), and stop leaking secrets (never store secrets in plain text — use Vault/CyberArk/AWS/Azure and Argo/Flux integrations). Kubernetes secrets are only base64; enforce least privilege and continuous monitoring.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:38GitOps Evolution
- 1:09Securing GitOps Principles
- 1:23Common Security Practices
- 2:00Securing your GitOps Engine
- 4:57Restrict the GitOps Engine
- 5:35Secure Your GitOps Content
- 7:49Security is Continuous
related talks
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
43mSecuring Secrets in the GitOps Era
28mGitOps and CI/CD: Maintaining Security in the Age of Automation
29m100,000 Different Ways to Manage Secrets in GitOps
46mSecuring Secrets in the GitOps era
30mDeclarative by Default, Secure by Design: GitOps as a Control Plane for Governance
34mSecure by Default with GitOps - A Guide to OPA with Argo CD
28mManaging GitOps as a Platform Service