DevSecOps School

Introduction & Overview In the fast-evolving landscape of software development, DevSecOps integrates security practices into every phase of the software development lifecycle (SDLC), ensuring that security is not an afterthought but a core component of development and operations. Doppler, a modern secret management platform, plays a pivotal role in this paradigm by providing a secure,…

Introduction & Overview What is TruffleHog? TruffleHog is an open-source security tool designed to detect and mitigate the accidental exposure of sensitive information, such as API keys, passwords, and cryptographic keys, in code repositories, cloud storage, CI/CD pipelines, and other environments. By scanning for secrets using regular expressions and entropy-based analysis, TruffleHog helps organizations prevent…

Introduction & Overview What is Gitleaks? Gitleaks is an open-source Static Application Security Testing (SAST) tool designed to detect and prevent the accidental inclusion of sensitive information, such as passwords, API keys, tokens, and private keys, in Git repositories. By scanning code, commits, and repository histories, Gitleaks identifies hardcoded secrets that could lead to security…

Introduction & Overview Namespaces are a fundamental concept in modern DevSecOps, particularly within containerized environments like Kubernetes. They enable resource isolation, access control, and streamlined management of applications and services. This tutorial provides an in-depth exploration of Kubernetes namespaces, their role in DevSecOps, and practical guidance for implementation. This guide covers: What is Namespaces? Definition…

Introduction & Overview The Sidecar Pattern is a design approach widely used in cloud-native architectures to enhance application functionality by deploying auxiliary services alongside primary containers. In DevSecOps, which integrates security into the DevOps lifecycle, the Sidecar Pattern is pivotal for embedding security, observability, and operational capabilities seamlessly into application workflows. This tutorial provides a…

Introduction & Overview Image scanning is a cornerstone of DevSecOps, ensuring that container images used in software development and deployment are secure, compliant, and free from vulnerabilities. This tutorial provides an in-depth exploration of image scanning, its role in the DevSecOps lifecycle, and practical guidance for implementation. Designed for developers, security engineers, and DevOps professionals,…

Introduction & Overview Container hardening is a critical security practice in modern software development, particularly within the DevSecOps framework, where security is integrated into every phase of the development lifecycle. This tutorial provides a comprehensive guide to container hardening, exploring its principles, implementation, and real-world applications. Designed for developers, security engineers, and DevOps professionals, it…

Introduction & Overview What are Admission Controllers? Admission Controllers are Kubernetes plugins that intercept and process requests to the Kubernetes API server before objects (e.g., pods, deployments) are persisted. They enforce policies, validate configurations, or mutate resources to ensure compliance with organizational standards. History or Background Introduced in Kubernetes 1.0 (2015), Admission Controllers have evolved…

Introduction & Overview What is OPA (Open Policy Agent)? Open Policy Agent (OPA) is an open-source, general-purpose policy engine that enables unified, context-aware policy enforcement across the software stack. It allows organizations to define and enforce policies as code, ensuring compliance, security, and operational consistency in modern cloud-native environments. History or Background OPA was created…