Building Reusable DevSecOps Pipelines on a Secure Kubernetes Platform
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 10:55· Ballroom Sec 20AB - San Diego Convention Center, Upper Level·
summary
Centralized, tool‑agnostic pipeline templates plus modular libraries replace 60 copied Jenkinsfiles and cut new pipeline development from about 4–6 months to 4–6 days, a reported 97% reduction when reusing existing integrations. The system uses the Jenkins Templating Engine to load build/scan/deploy libraries, enforces org security steps (image and dependency scans, DAST), and pairs runtime detection with Falco using BPF, Kubernetes audit rules and playbooks that can isolate or kill compromised pods in milliseconds.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:41Vulnerability Lifecycle
- 1:35DevSecOps
- 4:13CISCD
- 7:17How can we make this go faster
- 8:44Centralized DevOps
- 10:54Jenkins Templating Engine
- 16:12Benefits
- 17:41Defense indepth
- 19:06What is Falco
- 19:58Incubation
- 21:52Architecture
- 22:33BPF Instrumentation
- 23:22BPF Architecture
- 24:09BPF Rules
- 25:49Metadata
- 26:20Metadata Example
- 27:21Kubernetes Audit Logging
- 29:23Kubernetes Audit Rule
- 30:46Installing Kubernetes
- 31:09Kubernetes Response Engine
- 32:23Falco Demo
- 34:06Recap
related talks
26mEverything You Should Be Doing, But Aren’t: DevSecOps for K8s Workflows
45mBecoming a Plumber: Building Deployment Pipelines
32mBuilding a Secure By-Design Pipeline with an Open Source Stack- 32mBuilding a Secure By-Design Pipeline with an Open Source Stack
13mEvolution of containers in continuous integration
43mBuilding a Secure DevOps Pipeline
39mControlled Mayhem With Cloud Native Security Pipelines
56mContinuous Deployment Pipeline in Kubernetes