Adventures in Production with GitOps, Secure Pipelines & Compliance - Brandon Lum & Ricardo Aravena
summary
A concrete pipeline shows GitOps with security wired in: a Tekton CI on a local cluster clones a Flask repo, runs Python Safety static checks, builds a container with a Kaniko/Jib-style step, scans with Trivy and Aqua, encrypts and signs the image, and pushes to a registry. The demo verifies encryption by inspecting blob entropy so the image is actually unreadable. The stack also maps in-toto attestations, OPA policies and SPIRE identity for compliance.
AI-written summary · about
chapters (9)
- 0:00Introduction to GitOps
- 1:24GitOps infrastructure
- 3:06Security and compliance
- 4:26DevSecOps tools
- 10:42Building a secure pipeline
- 13:32CI/CD orchestration
- 15:47Tekton pipeline demo
- 21:41Production pipelines
- 23:51Future trends and takeaways
related talks
30mAdventures in Production with GitOps, Secure Pipelines & Compliance
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
41mBeyond Guidelines - Designing & Implementing Robust Build Pipelines
34mFrom Code to Deployment: A Deep Dive into Pipelines as Code
35mGitOps in Action
10mIt's Time We Start Securing Our CICD Pipelines
26mEmpowering SRE with GitOps
23mBuilding a Secure By-Design Pipeline with an Open-Source Stack