Revision · Security (DevSecOps)

This part made the case that security as a final gate cannot keep pace with fifty releases a day, then walked the threat surface of a modern delivery system layer by layer — replacing each slow, human, after-the-fact check with an automated one that runs on every change.

What this part covered

• Shift-left is an economic argument — a flaw caught in a pull request costs a conversation while the same flaw in production costs an incident, so moving checks to pre-commit hooks and early pipeline stages is cheapest, at the price of a false-positive tax you must manage.
• Secrets belong in a store, not in git — a secret in a repo, env file, or baked image is a breach waiting to happen; a central access-controlled store, encryption at rest, dynamic short-lived credentials, and SOPS/Sealed Secrets for GitOps make “who has the password?” answerable.
• Supply chain turns “trust me” into “verify me” — most of what runs is code you didn’t write, so SBOMs list what’s inside, provenance/attestation records where it came from, and signing plus verification (including keyless) stop a tampered dependency or image from slipping through.
• Scanning finds known vulnerabilities before they ship — scanners cross-reference code and images against CVE feeds and gate both CI and admission, with base-image minimalism as the cheapest fix and CVE-noise-vs-real-risk as the eternal trade-off.
• Least privilege spans humans, workloads, and traffic — RBAC says who can do what, workload identity says which pod is which, and NetworkPolicy turns a flat network into default-deny, moving the cluster toward zero-trust.
• Compliance as code makes audits continuous — manual audits prove the rules held once, on the day someone checked; OPA/Rego policy enforced at admission (as guardrails or gates) enforces them on every change and produces continuous audit evidence.

The takeaway

Taken together, these pages let you look at the delivery pipeline from earlier parts and point to exactly where each class of attack is caught — and why catching it there, automatically, is what makes shipping fifty times a day safe instead of reckless. None of the tools (Vault, Trivy, cosign, OPA) is DevSecOps; the throughline is the decision that security is a shared responsibility enforced by automation that can stop the line before a bad change reaches production. That closes the delivery machine this book set out to build: fast, observable, and secure by default.