DevSecOps Architecture & Pipeline

Security embedded in every CI/CD stage: Developer → GitHub → [Build & Test → SAST Scan → Dependency Scan → Docker Build → Image Scan → Security Gates] → Registry → GitOps (ArgoCD) → Kubernetes Cluster → Production Monitoring. Secrets via Vault/K8s Secrets. RBAC + Network Policies + Alerting.

Overview

Security in every stage

DevSecOps integrates security practices into every stage of the software development lifecycle rather than treating security as a phase at the end. The principle is "shift left": find and fix security issues when they are cheapest, at the code commit stage, not in production.

The three pillars

People — Security champions, shared responsibility
Process — Security gates in every pipeline stage
Tools — Automated scanning: no human can manually review every commit

Code and dependencies

Pre-commit — Workstation hooks catch secrets before they are committed; IDE plugins highlight vulnerabilities in real time — git-secrets, gitleaks, Snyk IDE plugin — Secrets
Build (SAST) — Analyzes source code without running it — SonarQube (Java/C#/Python/JavaScript), Semgrep (multi-language, custom rules), Checkmarx — SQL injection, XSS, hardcoded credentials, insecure crypto, path traversal
Dependency scan — Identifies known vulnerabilities in open-source libraries — Snyk, OWASP Dependency-Check, npm audit, safety (Python) — CVE IDs with severity (Critical/High/Medium) and fixed versions

Images and policy

Docker Build — Builds the image from source with no secrets in image layers — Multi-stage builds, build args, not ENV for secrets
Image scan — Scans the image filesystem for CVEs in OS packages and application libraries; Critical findings fail the build (configurable thresholds) — Trivy (free, fast, comprehensive), Grype, Aqua Security, Twistlock/Prisma
Policy gates — Evaluate the image or IaC against organizational policies — OPA, Conftest, Checkov
Registry — Stores signed, scanned images; only signed images pass policy gates in the cluster — Sigstore/cosign

Example policies: no root user in the container, images only from an approved registry, resource limits required, no privileged containers.

> [!WARNING] Never pass secrets through ENV in a Dockerfile: they stay in the image layers.

Deploy, cluster and runtime

GitOps deployment (Argo CD) — Declarative manifests in Git; Git is the audit trail for every deployment; no ad-hoc kubectl apply in production
Kubernetes cluster — RBAC (who can do what), NetworkPolicy (segmentation), Pod Security Standards (restrict privileged containers), OPA Gatekeeper (admission policies), secrets management (Vault, External Secrets Operator)
Runtime — Falco watches kernel system calls and alerts on suspicious behavior: unexpected network connections, binaries run outside expected paths, privilege escalation

> [!IMPORTANT] Runtime security is the last line of defense after all static checks: it sees behavior, not known signatures.

Key concepts

Shift Left: Move security checks earlier in the development lifecycle. Finding a SQL injection in a static scan (cost: seconds, no prod impact) vs finding it in a pen test (cost: hours) vs finding it after a breach (cost: catastrophic). Each stage to the left is orders of magnitude cheaper.
SAST (Static Application Security Testing): Analyzes source code without execution. Finds: injection flaws, hardcoded secrets, insecure functions, logic errors. Tools: SonarQube, Semgrep, Checkmarx, Veracode. Runs in CI on every PR. Fast (seconds to minutes).
SCA (Software Composition Analysis): Identifies CVEs in open-source dependencies. Generates an SBOM (Software Bill of Materials). Tools: Snyk, OWASP Dependency-Check, Dependabot, Grype. Critical: most enterprise software is 70–90% open-source by line count.
Image scanning: Scans container image layers for CVEs in OS packages (Ubuntu/Alpine base) and language runtime packages. Trivy is the de facto standard: free, fast, OCI-compliant, integrates with CI/CD, registries, and Kubernetes admission. Fail builds on Critical/High findings.
OPA Gatekeeper: Kubernetes admission controller that evaluates every resource create/update request against Rego policies. Policies: require resource limits, block hostPath mounts, require image digest (not mutable tags), require security labels. Provides guardrails so misconfigured manifests never reach the cluster.
Falco: CNCF runtime security tool. Monitors Linux kernel syscalls via eBPF. Detects: unexpected outbound connections, shell spawned in a container, file read in /etc/shadow, privilege escalation. Sends alerts to SIEM/Slack. Complements static scanning by catching attacks that bypass pre-deployment checks.

When to use it

Designing a new CI/CD pipeline — incorporate security from day one
Security audit of existing pipelines — identify missing security gates
Meeting compliance requirements (SOC2, PCI-DSS, FedRAMP) for software supply chain security
Interview questions about DevSecOps, shift-left, or supply chain security
Onboarding security champions in engineering teams

Interview questions

Design a DevSecOps CI/CD pipeline for a containerized application.
What is the difference between SAST, DAST, and SCA?