DevSecOps Pipeline from Scratch: Gates That Block Bad Code
"We want to shift security left. Walk me through how you would build a DevSecOps pipeline from scratch for a Kubernetes-based microservices stack." Naming tools does not answer it. The interviewer wants to know why each layer of the pipeline exists, what it catches, what it misses, and where it blocks a change instead of warning about it. This post builds that answer layer by layer, with…
To build a DevSecOps pipeline from scratch for a Kubernetes-based microservices stack, start by addressing security left from the developer's perspective. The first layer is secrets detection, implemented via a pre-commit hook that scans for keys, tokens and passwords in commits. This step is enforced in CI using gitleaks, a tool that can be skipped if needed, but should be required for production changes.
The second layer is static application security testing (SAST), which examines the code and how it calls libraries for injection flaws and insecure patterns. Implement SAST with every pull request using a job called pr-security. The third layer is software composition analysis (SCA), which identifies known CVEs in direct and transitive dependencies.
SCA also runs on every pull request and checks for vulnerable libraries. The fourth layer is image scanning and signing, performed after the build. This step checks the OS packages and application dependencies inside the container image for CVEs. The build fails if vulnerabilities are found, and only passing images are signed. The final layer is admission control at the Kubernetes API server.
Unsigned images, privileged or root pods are rejected by the API server, blocking changes that have bypassed the previous layers. Following the same workflow for secrets scanning and SAST on pull requests involves using gitleaks as a pre-commit hook and Semgrep for additional checks. Both jobs should be required status checks in branch protection or a ruleset to act as gates for merge.
Finally, Trivy is used for both SCA and image scanning. Trivy fs reads the lockfiles to cover transitive dependencies and scans the container image for CVEs. After building the image, Trivy image scans the OS packages and application dependencies inside it. The signing process uses Cosign to sign an image that already exists in a registry, ensuring the immutable digest is protected.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
