GitOps and CI/CD: Maintaining Security in the Age of Automation
Talkat ArgoCon Europe 2023 · on Tuesday, 2023-04-18· at 16:50· Elicium Building | Elicium Ballroom 1 [Argo CD]·
summary
Explains concrete controls and outcomes: lock down Git repos, require peer review and authenticated service accounts, and prefer immutable image tags so deployments are auditable. Describes Red Hat SRE’s Log4j response—automated GitOps PRs roll patches to production in hours (eight-hour war room) versus much slower past incidents. Recommends specific tools and patterns: Argo CD pull model, Clair scanning, external-secrets operator, and emerging VEX machine-readable CVEs.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:26Bi-weekly Red Hat streams
- 2:29GitOps and Argo CD adoption
- 5:18GitOps automation and security
- 7:04Security in DevSecOps
- 8:55Shift left and supply chain security
- 12:29Software supply chain problem
- 14:53Securing repositories and vendors
- 16:59Argo CD pull model security
- 18:23Scanning tools and negative testing
- 20:56Log4j CVE response
- 23:43Security moving target
- 24:49Closing remarks
related talks
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
09mSecuring GitOps
16mSecure Your GitOps - How to Implement a Robust Security Strategy
55mGitOps, Fostering Next-Generation Operations Teams
35mGitOps - the holy grail of devops
33mGitOps in Modern Security-Compliant Environments
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
21mContinuous Delivery: The Missing Piece in the GitOps-OCI Security Puzzle