DevSecOps & GitOps Workflows

Problem

Security checks were being performed manually or late in the delivery cycle, leading to delayed releases and fragmented visibility over vulnerabilities across the infrastructure.

My Role

I architected and implemented an automated security pipeline that shifted checks left, integrating scanning tools directly into the deployment workflow and aggregating the results into a single pane of glass.

Constraints

The solution needed to be deployed on-premises using Proxmox. It also had to avoid paralyzing developer velocity; security findings needed to be informative and triaged, rather than blindly blocking every deployment.

Implementation & Decisions

I implemented a GitOps workflow centered around Gitea and ArgoCD for continuous delivery.

• Changes committed to the repository triggered automated CI pipelines.
• Scanning Tools: Integrated Trivy for container image scanning, Snyk for dependency analysis, and Gitleaks to prevent hardcoded secrets from entering the codebase.
• Aggregation: All security findings were programmatically pushed to DefectDojo. This provided a centralized dashboard for security triage.

Deployment decisions depended on explicit organizational policies evaluated during the CI phase. Findings were categorized by severity, ensuring only critical, fixable vulnerabilities triggered a hard block, while others were recorded for triage.

Troubleshooting

Initial implementations generated high volumes of false positives, particularly from legacy dependencies. I tuned the scanning configurations and established baseline ignore-lists in DefectDojo to filter out accepted risks and focus the team on actionable findings.

Validation & Outcome

The GitOps pipeline successfully enforced infrastructure state matching the repository while ensuring all deployed artifacts had a documented security posture. The integration of DefectDojo significantly reduced the manual overhead of tracking security debt.

Lessons

Context is crucial in DevSecOps. A finding is only as valuable as its actionability. Integrating the scanners was the easy part; the real engineering challenge was tuning the pipeline to empower developers rather than frustrate them.

Relevant Links