https://github.com/airkine/devsecops-sandbox
DevSecOps lab with GitOps, Kyverno, FluxCD, and secure Kubernetes workloads.
https://github.com/airkine/devsecops-sandbox
azure cicd devsecops docker fluxcd gitops go kind kubernetes kyverno sops
Last synced: 9 months ago
JSON representation
DevSecOps lab with GitOps, Kyverno, FluxCD, and secure Kubernetes workloads.
- Host: GitHub
- URL: https://github.com/airkine/devsecops-sandbox
- Owner: airkine
- Created: 2025-04-09T21:19:50.000Z (9 months ago)
- Default Branch: main
- Last Pushed: 2025-04-09T21:45:01.000Z (9 months ago)
- Last Synced: 2025-04-09T22:31:23.285Z (9 months ago)
- Topics: azure, cicd, devsecops, docker, fluxcd, gitops, go, kind, kubernetes, kyverno, sops
- Language: Shell
- Homepage:
- Size: 77.1 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
## 🚀 DevSecOps Demo Lab
This is a **Kubernetes-based DevSecOps demo environment** built for showcasing modern GitOps, security, and infrastructure best practices.
> 🔒 Designed for **SOC2-style compliance**, **secure-by-default Kubernetes**, and **GitOps automation** with real-world tools.
---
### 🧰 Tech Stack
- **FluxCD** – GitOps continuous delivery
- **Kyverno** – Kubernetes policy enforcement
- **cert-manager** – TLS management with self-signed & CA issuers
- **External Secrets Operator** – Secure secrets management (Azure)
- **Prometheus + Grafana** – Observability stack
- **NGINX Ingress Controller** – Routing with optional TLS
- **SOPS** – Secret encryption at rest
- **Go + PostgreSQL app** – Sample microservice + database deployment
---
### ✅ What This Demo Proves
- 🔁 GitOps-first infra using Flux
- 🛡️ Pod security policies with Kyverno
- 🔐 TLS and secret handling with cert-manager + ESO
- 📈 Monitoring via Prometheus + Grafana
- 🧪 CI validation of manifests using `kubeconform`
- 🧱 Docker security best practices (non-root, pinned versions)
- 🛠️ Custom Go app + DB deployment for hands-on realism
---
### 📦 Local Development
You can run everything locally using [kind](https://kind.sigs.k8s.io/) and [Flux bootstrap](https://fluxcd.io/flux/installation/). Setup instructions are in the `kind_deployment/README.md`.