Kubernetes DevSecOps – End-to-End Security from Code to Runtime

Project Overview

Complete DevSecOps implementation spanning application code, container images, infrastructure, Kubernetes policies, runtime detection, and dynamic application testing.

This project demonstrates security controls integrated throughout the software delivery lifecycle rather than treated as a final security check.

The implementation uses OTel Labs as the instrumented application and OTel Labs Platform for infrastructure, Kubernetes, CI/CD, and security controls.

Builds on the OTel on EKS infrastructure foundation.

Security Layers

Security is implemented across seven distinct layers:

mermaid

Architecture

mermaid

Scanning & Detection

mermaid

Repositories

Application Repository: ◉ otel-labs

  • Source code for Node.js, Python, and Go services
  • Application security scanning (Gitleaks, Semgrep, Trivy)
  • Container image builds and publishing to GHCR

Platform Repository: ◉ otel-labs-platform

  • Terraform infrastructure (EKS, VPC, networking)
  • Kubernetes manifests and ArgoCD applications
  • Kyverno security policies and exceptions
  • Infrastructure and configuration scanning
  • OWASP ZAP DAST configuration

Components

Application Layer Security

ToolPurpose
GitleaksSecret detection in code and Git history
SemgrepSAST — insecure coding patterns
DependabotAutomated dependency updates

Artifact & Infrastructure Layer

ToolPurpose
Trivy FSSCA — dependency vulnerability scanning
Trivy ImageContainer image vulnerability scanning
Trivy ConfigTerraform and Kubernetes configuration scanning

Kubernetes & Runtime Layer

ToolPurpose
KyvernoAdmission control and security policy enforcement
FalcoRuntime behavior detection and alerting
OWASP ZAPDynamic application security testing

Findings Management

ToolPurpose
GitHub SecurityCentralized SARIF findings in GitHub
DefectDojoCentralized vulnerability management across all scanners

Key Features

✅ Application Security — Gitleaks, Semgrep, Trivy scanning across multiple languages (Node.js, Python, Go)

✅ Infrastructure as Code Scanning — Terraform and Kubernetes manifest validation

✅ Kubernetes Admission Control — Kyverno policies enforcing image tags, resource limits, trusted registries

✅ Policy Exceptions — Scoped exceptions for legitimate platform workloads

✅ Runtime Security — Falco detecting suspicious process execution and file access

✅ Dynamic Testing — OWASP ZAP scanning deployed applications

✅ Centralized Findings — DefectDojo aggregating results from all security tools

✅ GitOps Integration — Security scanning triggered by GitHub Actions, results fed to DefectDojo

Workflow

mermaid

Deployment

Prerequisites

  • AWS account with EKS permissions
  • kubectl configured
  • GitHub repositories set up
  • DefectDojo instance (local or cloud)

Bootstrap

Provision the infrastructure:

bash
cd terraform
terraform init
terraform plan
terraform apply

The bootstrap script automatically installs:

  • ArgoCD
  • Kyverno
  • Falco

Configure Security Workflows

Set GitHub Actions secrets in both repositories:

text
DEFECTDOJO_URL
DEFECTDOJO_API_KEY

Deploy Applications

Applications deploy via ArgoCD using the GitOps pattern:

bash
kubectl apply -f k8s/argo-apps/root-app.yml

Or individually:

bash
kubectl apply -f k8s/argo-apps/kyverno-policy.yml
kubectl apply -f k8s/argo-apps/traefik-app.yml
kubectl apply -f k8s/argo-apps/node-frontend-app.yml
# ... etc

End-to-End Flow

mermaid

Blog Post

For a detailed walkthrough of the complete implementation, architecture decisions, and hands-on examples, see:

End-to-End DevSecOps on EKS: Code, Containers, Kubernetes & Runtime Security

The blog covers:

  • Application security scanning (Gitleaks, Semgrep, Trivy)
  • Infrastructure scanning (Trivy Config)
  • Kyverno concepts and policy enforcement
  • Falco runtime detection with practical examples
  • OWASP ZAP dynamic testing
  • DefectDojo centralized findings management
  • End-to-end deployment and setup

Implementation Status

mermaid

Completed

  • ✅ Gitleaks secret scanning (application + platform repos)
  • ✅ Semgrep SAST analysis
  • ✅ Dependabot dependency updates
  • ✅ Trivy filesystem scanning (SCA)
  • ✅ Trivy container image scanning
  • ✅ Trivy configuration scanning (Terraform + Kubernetes)
  • ✅ GitHub Security integration (SARIF uploads)
  • ✅ DefectDojo centralized findings management
  • ✅ Kyverno admission policies (image tags, resource limits, trusted registries)
  • ✅ Kyverno policy exceptions (scoped exemptions)
  • ✅ Falco runtime security with FalcoSidekick
  • ✅ OWASP ZAP DAST integration
  • ✅ End-to-end workflow validation
  • ✅ Comprehensive blog documentation

Infrastructure foundation and observability setup: OTel on EKS