Skip to content

Phase 3: DevSecOps & Supply Chain Security

📖 Deep-Dive Index

1. Secret Management & Scanning

  • Git Security: TruffleHog, Talisman pre-commit hooks to block secrets.
  • Runtime Secrets: External Secrets Operator (ESO) syncing AWS Secrets Manager to Kubernetes Secrets. HashiCorp Vault.

2. Software Supply Chain (SBOMs & Scanning)

  • Container Scanning: Trivy, Grype. Differentiating between OS-level CVEs and application-dependency CVEs.
  • SBOMs: Generating Software Bill of Materials using Syft (SPDX vs CycloneDX formats).
  • Cryptographic Signing: Sigstore/Cosign. Keyless signing via OIDC.

3. Kubernetes Admission Control

  • Dynamic Admission Webhooks: Mutating vs Validating webhooks.
  • Kyverno / OPA Gatekeeper: Writing policies to enforce security standards at the Kubernetes API level before pods are scheduled.

🛠️ Job-Essential Exercises

  1. The Vulnerable Build CI Pipeline:
  2. Write a GitHub Action that builds a Docker image. Add a step to run Trivy. Introduce an outdated dependency (e.g., an old Log4j or Express.js version). Ensure Trivy breaks the pipeline.
  3. The Cryptographic Supply Chain:
  4. Once the image passes Trivy, add a GitHub Action step to sign the Docker image using Cosign. Push the signed image to Amazon ECR or GitHub Container Registry.
  5. The Admission Shield:
  6. Install Kyverno on a Kubernetes cluster. Write a ClusterPolicy that blocks any pod deployment if the container image does not possess a valid Cosign signature from your public key. Try to kubectl apply an unsigned NGINX image and watch the API reject it.