DevSecOps Platform

Live Demo Environment — Self-Managed, OSS-Preferred, CSP-Agnostic

Platform Tools

14-Stage Security Pipeline

Every artifact must pass through all gates sequentially. Failure at any gate blocks promotion — no exceptions.

Demo Scenarios

1. Happy Path

Push a change, watch the full pipeline go green — and findings land in DefectDojo.

  1. Open Gitea → edit e.g. src/server.js (a harmless change)
  2. Commit & push to main
  3. Watch Jenkins pipeline go green (14/14 stages)
  4. See deployment sync in ArgoCD
  5. Open DefectDojo — new engagement with all scanner findings

2. Security Gate Block (SAST)

Push dangerous code — the Semgrep gate stops the pipeline.

  1. Open Gitea → add eval(req.query.q) to src/server.js
  2. Commit & push
  3. Jenkins pipeline FAILS at Stage 3 (SAST Gate)
  4. The console log shows the exact rule and line that blocked it
  5. Key message: "Code that doesn't meet the security standard cannot proceed."

3. Findings Hub Walkthrough

One place for every scanner result — the heart of the platform.

  1. Open DefectDojo → Products → demo-app
  2. Each build = one engagement with Semgrep, Gitleaks, Trivy, Checkov and ZAP results
  3. Show severity breakdown, deduplication, and the SQL injection / hardcoded AWS key findings
  4. Key message: "Security results from every tool, aggregated, deduplicated, trending over time."

4. Supply Chain Block (Kyverno)

Deploy an unsigned image — Kyverno rejects it.

  1. SSH into the VM
  2. Run: kubectl run rogue --image=nginx -n demo-app
  3. Kyverno REJECTS — image is not signed with Cosign
  4. Key message: "Without a valid signature, nothing enters the cluster."

5. Runtime Detection (Falco)

Exec into a pod — Falco detects the intrusion.

  1. SSH into the VM
  2. Run: kubectl exec -it deploy/demo-app -n demo-app -- sh
  3. Inside: cat /etc/shadow
  4. Check Grafana for Falco alert
  5. Key message: "Even if something gets through, runtime detection catches it."

Platform Architecture

Key Talking Points

Why not Harbor for container registry?
Harbor's core development was led by VMware's Beijing R&D team (China). In sensitive contexts, software tools must not originate from nations identified as adversarial. Nexus (Sonatype, US) provides equivalent container registry functionality plus support for all other artifact types (Helm, npm, Maven).
Why both Trivy AND Anchore?
Different strengths, layered defense. Anchore = primary gate for container images with a rich policy engine (approved base images, label requirements, custom rules). Trivy = complement covering IaC scanning, filesystem scanning, and license compliance. Not redundant — complementary.
Why not just switch to GitLab?
GitLab could consolidate Jenkins + Jira + GitHub. Listed as a strategic alternative because: migration requires rewriting all pipelines, teams need retraining, GitLab Self-Managed needs 8+ GB RAM. Recommended as a 12-18 month consolidation project, not a Phase 1 action.
Why both Splunk AND Grafana?
Distinct concerns. Splunk = SIEM (security events, compliance audit trail, threat correlation). Grafana + Prometheus + Loki = operational observability (app metrics, logs, SRE dashboards). Splunk licenses by data volume — sending operational metrics to Splunk is expensive and unnecessary.
How does this work air-gapped?
Zarf (Defense Unicorns, US DoD) packages entire stack — container images, Helm charts, configs — into a single archive. Transfer via approved media. Deploy with no internet. Internal Nexus serves all artifacts. Cosign verification uses local keys. Updates are delta packages.
What about SLSA Level 3?
SLSA Level 3 requires: (1) non-falsifiable provenance (Cosign attestation), (2) isolated build environment (ephemeral Jenkins agents), (3) verified dependencies (Syft SBOM + Anchore policy). Our pipeline achieves all three: Cosign + Syft + Anchore + Kyverno = verifiable provenance from source to production.
What about licensing costs?
~80% of the stack is fully open-source (Apache/MIT/MPL). Commercial tools: Splunk (already licensed), Chainguard (already procured), Nessus (per-scanner). Vault BSL = free for internal use. SonarQube Community Edition is free. OSS-first approach minimizes vendor lock-in and procurement overhead.
DevSecOps Platform Demo — Self-Managed, OSS-Preferred, CSP-Agnostic