Everything You Should Be Doing, But Aren’t: DevSecOps for K8s Workflows
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Friday, 2020-11-20· at 16:00· Intrado Virtual Event Platform,·
summary
Shows a concrete DevSecOps scaffold that scales CI/CD across microservices by separating pipeline business logic from tool implementations using the Jenkins Template Engine on Jenkins + Helm in GKE. Demonstrates static and dependency scanning (SonarQube, OSS scanners), image scanning, OWASP ZAP and Lighthouse reports, and runtime detection with Falco (demo kills a pod and sends an alert to Slack via Falco Sidekick). Enforces manifest-level policies with Open Policy Agent/Gatekeeper (namespace creation blocked until required label is present).
AI-written summary · about
chapters (13)
- 0:00Start
- 0:58What Is Devsecops
- 2:31How To Build a Pipeline
- 2:46Automate How To Run some Unit Tests in a Pull Request
- 6:42The Business Process To Get Code from a Developer's Laptop to Production
- 8:07Pipeline Template
- 10:42Hierarchical Pipeline Configuration Files
- 12:17Unit Testing
- 13:00Static Code Analysis
- 14:13Dynamic Application Security Testing
- 19:58Governance to Your Kubernetes Manifest
- 20:38Constraint Templates
- 22:41Common Use Cases for Opa
related talks
35mBuilding Reusable DevSecOps Pipelines on a Secure Kubernetes Platform
39mControlled Mayhem With Cloud Native Security Pipelines
32mBuilding a Secure By-Design Pipeline with an Open Source Stack
43mSecurity in DevOps Strategies
25mDecoupling DevSecOps from CI/CD Pipelines
23mBuilding a Secure By-Design Pipeline with an Open-Source Stack- 32mBuilding a Secure By-Design Pipeline with an Open Source Stack
45mSecure All the Things: From IaC to Kubernetes