Securing and Testing Your CI/CD Pipeline

In the previous chapters, we looked at Continuous Integration (CI) and Continuous Deployment/Delivery (CD) with GitOps as the central concept. Both concepts and the tooling surrounding them help us deliver better software faster. However, one of the most critical aspects of technology is security and quality assurance. Though security was not considered in DevOps’ initial days, with the advent of DevSecOps, modern DevOps now places a great emphasis on it. In this chapter, we’ll try to understand the concepts surrounding container applications’ security and testing and how to apply them within CI and CD.

In this chapter, we’re going to cover the following main topics:

• Securing and testing CI/CD pipelines
• Revisiting the Blog Application
• Container vulnerability scanning
• Managing secrets
• Binary authorization
• Release gating with pull requests and deploying our application in production
...