GitOps Security: Enforcing Policy as Code in Flux and ArgoCD

Step 3: Configure CI/CD Pipeline Validation

# Complete GitHub Actions workflow
# .github/workflows/gitops-security.yml
name: GitOps Security Validation

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  validate-policies:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install tools
        run: |
          # Install Conftest
          wget -q https://github.com/open-policy-agent/conftest/releases/download/v0.45.0/conftest_0.45.0_Linux_x86_64.tar.gz
          tar xzf conftest_0.45.0_Linux_x86_64.tar.gz
          sudo mv conftest /usr/local/bin/
          
          # Install kubeval
          wget -q https://github.com/instrumenta/kubeval/releases/latest/download/kubeval-linux-amd64.tar.gz
          tar xzf kubeval-linux-amd64.tar.gz
          sudo mv kubeval /usr/local/bin/
          
          # Install Flux CLI
          curl -s https://fluxcd.io/install.sh | sudo bash
      
      - name: Validate Kubernetes Syntax
        run: |
          find . -name '*.yaml' -o -name '*.yml' | \
          xargs kubeval --strict --ignore-missing-schemas
      
      - name: Run OPA Policy Tests
        run: |
          conftest test clusters/ apps/ \
            --policy policy/ \
            --all-namespaces \
            --fail-on-warn
      
      - name: Validate Flux Resources
        run: |
          flux diff kustomization flux-system \
            --path ./clusters/production \
            --kustomization-file ./clusters/production/flux-system/kustomization.yaml
      
      - name: Scan for Secrets
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
      
      - name: Container Image Scanning
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
      
      - name: Upload Trivy Results
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

Step 4: Set Up Monitoring and Alerting

# Deploy Falco for runtime security
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update
helm install falco falcosecurity/falco \
  --namespace falco-system \
  --create-namespace \
  --set falcosidekick.enabled=true \
  --set falcosidekick.webui.enabled=true

# Custom Falco rule for GitOps
cat <
        kevt and 
        ka.target.namespace = "flux-system" and
        (ka.verb in (create, delete, patch)) and
        not ka.user.name startswith "system:serviceaccount:flux-system"
      output: >
        Unauthorized modification to Flux resource
        (user=%ka.user.name resource=%ka.target.name namespace=%ka.target.namespace verb=%ka.verb)
      priority: WARNING
      source: k8s_audit
      tags: [gitops, flux, security]
EOF

# Set up Prometheus alerts
cat < 0
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "Flux reconciliation failed"
          description: "{{ $labels.kind }}/{{ $labels.name }} in {{ $labels.namespace }} failed reconciliation"
      
      - alert: PolicyViolationDetected
        expr: |
          increase(gatekeeper_violations_total[5m]) > 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Policy violation detected"
          description: "Gatekeeper detected {{ $value }} policy violations in the last 5 minutes"
EOF