Listen to this Post
Introduction:
DevSecOps represents the evolution of DevOps where security is no longer a final gate but an integrated thread woven throughout the entire software delivery lifecycle. By embedding security scanning, compliance checks, and vulnerability detection directly into CI/CD pipelines, organizations can identify and remediate risks before they reach production—dramatically reducing the cost and impact of security incidents. This production-style workflow spans Infrastructure as Code (IaC), container orchestration with Kubernetes, cloud platforms like AWS, and comprehensive monitoring stacks, creating a resilient foundation for modern application delivery.
Learning Objectives:
- Build and orchestrate a complete CI/CD pipeline with integrated security scanning (SAST, DAST, dependency scanning, and container vulnerability assessment)
- Deploy and secure Kubernetes clusters on AWS EKS with GitOps-driven continuous delivery using ArgoCD
- Implement production-grade monitoring, observability, and incident response with Prometheus and Grafana
You Should Know:
- CI/CD Pipeline Security Scanning: SAST, Dependency Check & Container Vulnerability Assessment
Modern DevSecOps pipelines integrate multiple security tools at every stage of the build process. Static Application Security Testing (SAST) analyzes source code for vulnerabilities before compilation, dependency scanners check third-party libraries against CVE databases, and container scanners inspect images for OS-level and application-layer vulnerabilities.
Step‑by‑Step Guide:
Linux / macOS – Install and Run Security Scanning Tools:
Install Trivy (container vulnerability scanner) curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin Install SonarQube Scanner (SAST) wget https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-5.0.1.3006-linux.zip unzip sonar-scanner-cli-5.0.1.3006-linux.zip -d /opt/ export PATH=$PATH:/opt/sonar-scanner-5.0.1.3006-linux/bin Install OWASP Dependency Check wget https://github.com/jeremylong/DependencyCheck/releases/download/v9.0.0/dependency-check-9.0.0-release.zip unzip dependency-check-9.0.0-release.zip -d /opt/
Run Security Scans:
Filesystem vulnerability scan with Trivy trivy fs --severity HIGH,CRITICAL --exit-code 1 /path/to/your/code Container image vulnerability scan trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latest SonarQube analysis (requires SonarQube server running) sonar-scanner -Dsonar.projectKey=myapp -Dsonar.sources=. -Dsonar.host.url=http://localhost:9000 -Dsonar.login=your-token OWASP Dependency Check dependency-check --scan /path/to/your/code --format HTML --out report.html
Windows (PowerShell) – Install and Run:
Install Trivy via Chocolatey choco install trivy Run scans trivy fs --severity HIGH,CRITICAL --exit-code 1 C:\path\to\code trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latest
GitHub Actions Workflow (`.github/workflows/security-scan.yml`):
name: DevSecOps Security Scan
on: [push, pull_request]
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
<ul>
<li>name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
scan-ref: '.'
format: 'table'
exit-code: '1'
severity: 'HIGH,CRITICAL'</p></li>
<li><p>name: Run OWASP Dependency Check
uses: dependency-check/Dependency-Check_Action@main
with:
project: 'myapp'
path: '.'
format: 'HTML'</p></li>
<li><p>name: Run Gitleaks (secret scanning)
uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
This pipeline automatically blocks pull requests if HIGH or CRITICAL vulnerabilities are detected, enforcing a “security gate” before any code reaches production.
- Kubernetes Cluster Security Hardening with kube-bench & Trivy Operator
Kubernetes clusters require continuous security posture assessment to ensure compliance with the CIS Kubernetes Benchmark. kube-bench runs automated checks against control plane components, worker nodes, and etcd configurations, while Trivy Operator provides ongoing vulnerability scanning of running containers within the cluster.
Step‑by‑Step Guide:
Run kube-bench as a Kubernetes Job:
Apply the kube-bench job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
Check job completion
kubectl get pods -l job-1ame=kube-bench
View scan results
kubectl logs $(kubectl get pods -l job-1ame=kube-bench -o jsonpath='{.items[bash].metadata.name}')
Install Trivy Operator for Continuous Cluster Scanning:
Install Trivy Operator via Helm helm repo add aquasecurity https://aquasecurity.github.io/helm-charts/ helm repo update helm install trivy-operator aquasecurity/trivy-operator \ --1amespace trivy-system \ --create-1amespace \ --set trivy.ignoreUnfixed=true \ --set vulnerabilityReports.scanner=Trivy
Create a VulnerabilityReport Custom Resource:
apiVersion: aquasecurity.github.io/v1alpha1 kind: VulnerabilityReport metadata: name: myapp-scan spec: imageRef: myregistry/myapp:latest scanner: name: Trivy summary: criticalCount: 0 highCount: 0
Linux Commands to Verify Cluster Security Posture:
Check for Kubernetes API server insecure bindings kubectl get pods -1 kube-system -l component=kube-apiserver -o yaml | grep insecure Verify etcd encryption at rest kubectl get pods -1 kube-system -l component=etcd -o yaml | grep encryption-provider-config List all service accounts with cluster-admin privileges kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.name=="cluster-admin") | .subjects'
CIS Benchmark Remediation Commands (Linux):
Ensure the kubelet client certificate rotation is enabled echo "ROTATE_CERTIFICATES=true" >> /etc/kubernetes/kubelet.conf Set kubelet authentication to Webhook mode sed -i 's/--authorization-mode=AlwaysAllow/--authorization-mode=Webhook/g' /etc/kubernetes/kubelet.conf Restart kubelet systemctl restart kubelet
A comprehensive DevSecOps pipeline should run kube-bench on every cluster update and fail the deployment if any CIS benchmark failures are detected.
- AWS EKS Infrastructure as Code with Terraform Security Hardening
Provisioning AWS EKS clusters through Terraform enables repeatable, auditable infrastructure deployments with security controls baked in from the start—including private subnets, KMS encryption, least-privilege IAM roles, and restricted endpoint access.
Step‑by‑Step Guide:
Terraform Configuration for Secure EKS Cluster (`main.tf`):
provider "aws" {
region = var.region
}
VPC with private subnets only
resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/16"
enable_dns_hostnames = true
}
resource "aws_subnet" "private" {
count = 2
vpc_id = aws_vpc.main.id
cidr_block = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index + 10)
availability_zone = data.aws_availability_zones.available.names[count.index]
map_public_ip_on_launch = false Private nodes - no public IP
}
EKS Cluster with encryption and logging
resource "aws_eks_cluster" "main" {
name = var.cluster_name
role_arn = aws_iam_role.eks_cluster.arn
version = "1.28"
vpc_config {
subnet_ids = aws_subnet.private[].id
endpoint_private_access = true
endpoint_public_access = false Restrict public access
security_group_ids = [aws_security_group.eks.id]
}
encryption_config {
provider {
key_arn = aws_kms_key.eks.arn
}
resources = ["secrets"]
}
enabled_cluster_log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"]
}
KMS key for secret encryption
resource "aws_kms_key" "eks" {
description = "EKS cluster encryption key"
deletion_window_in_days = 7
enable_key_rotation = true
}
Security group with least-privilege rules
resource "aws_security_group" "eks" {
name = "eks-cluster-sg"
description = "Security group for EKS cluster"
vpc_id = aws_vpc.main.id
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = [var.vpc_cidr]
}
}
IAM role for node groups with least privilege
resource "aws_iam_role" "node_group" {
name = "eks-1ode-group-role"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = {
Service = "ec2.amazonaws.com"
}
}]
})
}
Deploy the Infrastructure:
Initialize Terraform terraform init Plan the deployment terraform plan -out=tfplan Apply with auto-approve terraform apply tfplan Configure kubectl aws eks update-kubeconfig --region us-west-2 --1ame my-eks-cluster Verify cluster access kubectl cluster-info kubectl get nodes
AWS CLI Commands for EKS Security Verification:
Verify cluster endpoint configuration
aws eks describe-cluster --1ame my-eks-cluster --query 'cluster.resourcesVpcConfig'
List all EKS clusters with public endpoint enabled (security risk)
aws eks list-clusters --region us-west-2 | xargs -I {} aws eks describe-cluster --1ame {} --query 'cluster.{name:name,publicAccess:resourcesVpcConfig.endpointPublicAccess}'
Check IAM roles attached to node groups
aws eks list-1odegroups --cluster-1ame my-eks-cluster --query 'nodegroups'
- Container Image Hardening: Distroless Images, Hadolint & Cosign Signing
Production container images should minimize attack surface by using distroless base images (no shell, no package manager), enforce Dockerfile best practices with Hadolint, and implement cryptographic signing with Cosign to ensure image provenance and integrity.
Step‑by‑Step Guide:
Multi-Stage Distroless Dockerfile:
Stage 1: Build (full SDK) FROM golang:1.22-alpine AS builder WORKDIR /app COPY go.mod go.sum ./ RUN go mod download COPY . . RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /app/server ./cmd/server Stage 2: Runtime (distroless - no shell, no package manager) FROM gcr.io/distroless/static-debian12:nonroot COPY --from=builder /app/server /server USER nonroot:nonroot ENTRYPOINT ["/server"]
Hadolint Dockerfile Linting (Linux/macOS):
Install Hadolint brew install hadolint macOS or docker run --rm -i hadolint/hadolint < Dockerfile Run linting hadolint Dockerfile Example output: Dockerfile:3 DL3008 Pin versions in apt-get install Dockerfile:7 DL3006 Always tag the version of the image
Hadolint Configuration (`.hadolint.yaml`):
ignored: - DL3018 Accept unpinned apk in build stage only failure-threshold: error
Cosign Image Signing (Keyless OIDC):
Install Cosign curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64" sudo mv cosign-linux-amd64 /usr/local/bin/cosign sudo chmod +x /usr/local/bin/cosign Sign the container image (keyless with OIDC) cosign sign ghcr.io/your-username/myapp:latest Verify the signature cosign verify ghcr.io/your-username/myapp:latest --certificate-identity=your-email --certificate-oidc-issuer=https://accounts.google.com
Windows PowerShell Commands:
Install Hadolint via Chocolatey choco install hadolint Run Hadolint hadolint Dockerfile Install Cosign via Scoop scoop install cosign Sign image cosign sign ghcr.io/your-username/myapp:latest
GitHub Actions Container Hardening Workflow:
- name: Lint Dockerfile uses: hadolint/[email protected] with: dockerfile: Dockerfile <ul> <li>name: Build distroless image run: docker build -t ghcr.io/${{ github.repository }}/myapp:${{ github.sha }} .</p></li> <li><p>name: Run Trivy vulnerability scan uses: aquasecurity/trivy-action@master with: image-ref: ghcr.io/${{ github.repository }}/myapp:${{ github.sha }} format: 'table' exit-code: '1' severity: 'HIGH,CRITICAL'</p></li> <li><p>name: Sign image with Cosign run: | cosign sign ghcr.io/${{ github.repository }}/myapp:${{ github.sha }}
5. Monitoring & Observability with Prometheus and Grafana
Production-grade monitoring provides real-time visibility into application performance, infrastructure health, and security events. Prometheus collects metrics from Kubernetes nodes and application pods, while Grafana visualizes these metrics through customizable dashboards.
Step‑by‑Step Guide:
Install Prometheus and Grafana via Helm:
Add Helm repositories helm repo add prometheus-community https://prometheus-community.github.io/helm-charts helm repo add grafana https://grafana.github.io/helm-charts helm repo update Install Prometheus stack helm install prometheus prometheus-community/kube-prometheus-stack \ --1amespace monitoring \ --create-1amespace \ --set prometheus.prometheusSpec.retention=7d \ --set grafana.adminPassword=secure-password Verify installations kubectl get pods -1 monitoring kubectl get svc -1 monitoring
Access Grafana Dashboard:
Port-forward Grafana service kubectl port-forward -1 monitoring svc/prometheus-grafana 3000:80 Open browser to http://localhost:3000 Default credentials: admin / secure-password (or the password you set)
PromQL Queries for Security Monitoring:
Container restarts (potential crash or security issue)
rate(kube_pod_container_status_restarts_total[bash])
Pods with elevated CPU usage (potential crypto-mining)
sum(rate(container_cpu_usage_seconds_total[bash])) by (pod)
Unauthorized API access attempts
sum(rate(apiserver_audit_event_total{verb=~"create|update|delete", user!~"system:."}[bash]))
Node memory pressure
(node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) 100 < 20
Linux Commands for Monitoring Setup:
Check Node Exporter metrics curl http://localhost:9100/metrics | grep node_ Verify Prometheus targets kubectl get --raw /api/v1/namespaces/monitoring/services/prometheus-prometheus:9090/proxy/api/v1/targets | jq '.data.activeTargets[].labels' Query Prometheus API for alerts curl -G 'http://localhost:9090/api/v1/alerts' | jq '.data.alerts[] | select(.state=="firing")'
What Undercode Say:
- Security is a continuous thread, not a gated process – DevSecOps succeeds when security scanning, vulnerability detection, and compliance checks are embedded at every stage from code commit to production runtime, not bolted on at the end.
- Automation enables scale – Manual security reviews cannot keep pace with modern deployment frequencies. Automated SAST, dependency scanning, container vulnerability assessment, and infrastructure compliance checks must be integrated directly into CI/CD pipelines to catch issues before they reach production.
- Shift-left security reduces costs – Identifying and remediating vulnerabilities during development costs significantly less than patching production incidents. Tools like Trivy, SonarQube, and OWASP Dependency Check should run on every pull request.
- GitOps provides auditability – Using ArgoCD for GitOps-based Kubernetes deployments ensures that every change is version-controlled, auditable, and automatically synchronized with the desired cluster state.
- Monitoring is your early warning system – Prometheus and Grafana provide real-time visibility into security events, resource utilization, and anomaly detection, enabling rapid incident response before issues escalate.
Prediction:
- -1 Increased sophistication of supply chain attacks – As organizations adopt DevSecOps practices, attackers will increasingly target CI/CD pipelines, container registries, and third-party dependencies. The compromise of GitHub Actions workflows and open-source packages will become more prevalent, requiring enhanced pipeline security controls.
- +1 Wider adoption of zero-trust CI/CD – OIDC-based authentication, short-lived credentials, and least-privilege IAM roles will become standard practice in DevSecOps pipelines, eliminating the need for long-lived API tokens stored as secrets.
- +1 AI-powered security scanning – Machine learning models will augment traditional SAST and dependency scanning, reducing false positives and identifying complex vulnerability patterns that rule-based scanners miss.
- -1 Compliance burden intensifies – As Kubernetes and cloud-1ative adoption grows, regulatory requirements (SOC2, HIPAA, GDPR) will demand more rigorous continuous compliance monitoring, increasing operational overhead for security teams.
- +1 Distroless and minimal images become default – The 99.7% reduction in attack surface achieved by distroless images will drive widespread adoption, with organizations moving away from full OS base images in production.
- -1 Toolchain fragmentation – The rapid proliferation of DevSecOps tools (Trivy, kube-bench, Checkov, Semgrep, Gitleaks, etc.) will create integration complexity, requiring standardized pipelines and centralized policy management.
- +1 GitOps as the security control plane – ArgoCD and Flux will evolve beyond deployment tools to become the central control plane for security policy enforcement, configuration drift detection, and automated remediation.
- -1 Shortage of DevSecOps talent – The demand for professionals who understand security, cloud, Kubernetes, and CI/CD will continue to outpace supply, driving higher salaries and increased investment in training and upskilling programs.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Adityajaiswal7 Devops – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
