GitOps Security: Securing Your Deployment Pipeline from Commit to Production

Securing the GitOps Pipeline

GitOps uses Git as the single source of truth for infrastructure and application deployments. While GitOps improves auditability and reproducibility, it also means that compromising Git means compromising production.

Security Risks

Repository Compromise

If an attacker gains write access to the Git repo:

• Modify infrastructure definitions
• Inject backdoors into application code
• Change security configurations
• Alter deployment pipelines

Secret Exposure

Secrets accidentally committed to Git:

• Environment variables with credentials
• API keys and tokens
• TLS certificates and private keys
• Database connection strings

Pipeline Manipulation

Altering CI/CD pipeline definitions:

• Inject malicious build steps
• Modify deployment targets
• Disable security scanning
• Add persistence mechanisms

Security Controls

Signed Commits

Require GPG-signed commits for all changes:

git config --global commit.gpgsign true
git config --global user.signingkey KEYID

Branch Protection

• Require pull request reviews for main/production branches
• Require status checks (security scans) to pass
• No force pushes to protected branches
• Require signed commits

Secret Management

Never store secrets in Git:

# BAD: Secret in Git
apiVersion: v1
kind: Secret
data:
  password: cGFzc3dvcmQ=

# GOOD: External secret reference
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
spec:
  secretStoreRef:
    name: vault-backend
  target:
    name: database-credentials
  data:
    - secretKey: password
      remoteRef:
        key: prod/database/password

Drift Detection

Monitor for changes not made through Git:

• Compare actual state against Git-declared state
• Alert on unauthorized manual changes
• Automatically reconcile drift (or alert for review)

Pipeline Security

• Pin pipeline dependencies to specific versions
• Scan pipeline definitions for security issues
• Limit pipeline permissions (no admin access)
• Audit pipeline execution logs

Where SuperClue Fits

SuperClue does not audit CI/CD pipeline configurations. Its AI Code Security Analysis can review the files in a connected GitHub, GitLab, Bitbucket, or Azure DevOps repository, including YAML manifests, for issues such as hardcoded secrets.