Empowering The Guardians Of Your Code Kingdom
summary
Claims concrete changes: replace weekend credential backdoors with a pull not push deployment model, move final deploy authority into a single GitOps controller (examples: ArgoCD, Flux), enforce fine-grained decisions via Open Policy Agent using Rego, and centralize policy/data with an OPAL server-client so agents everywhere can ask PDPs. Use static analysis (eg. semgrep) as attribute scoring on PRs, treat >=50 deployment points and seven microservices as launch facilities, and make pipelines immutable and auditable.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 1:08OWASP Top 10 evolution
- 3:40Legacy deployment risks
- 5:07Modern code organization
- 8:39Why DevSecOps isn't enough
- 9:21What is GitOps and why it matters
- 12:07GitOps with Kubernetes
- 13:32Inversion of control in deployments
- 14:35GitOps best practices
- 15:40Git infrastructure as code
- 16:44Avoiding deployment backdoors
- 17:09Single responsibility in CI/CD
- 19:15Policy engines for CI/CD
- 20:19Policy engines in cloud-native
- 21:02Open Policy Agent role
- 22:06Policy rules and decisions
- 23:11How policy engines decide
- 24:12Permission models for CI/CD
- 26:01Attribute-based access control
- 27:04Static analysis for decisions
- 28:50Scoring PRs with static analysis
- 30:14Policy engines and GitOps controllers
- 30:57OPAL for policy management
- 32:46OPAL architecture and flow
- 33:29Security action question
- 33:49Q&A
related talks
18mDevOps All the Things: Creating a Pipeline to Validate Your OPA Policies
30mGitops with Policy As Code and OPA
30mDeclarative by Default, Secure by Design: GitOps as a Control Plane for Governance
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
15mSecuring your Deployments using a Policy Driven Approach
31mSelf Healing GitOps: Continuous, Secure GitOps Using Argo CD, Helm and OPA
17mOpen Policy Agent Intro