Ultimate DevSecOps Bootcamp by School of Devops

Establish two environments for DevSecOps: a remote Linux dev environment and a Kubernetes-based CI/CD deployment, using cloud options such as Google Cloud with free credits.

Set up a Google Cloud project and enable the Kubernetes API. Create a standard GKE cluster with the rapid channel's latest version and three nodes, using kubectl via Cloud Shell.

Configure firewall rules for a Kubernetes cluster on GKE to expose apps to the outside world by editing VPC firewall settings, allowing all protocols and ports for a training environment.

Launch a Linux development environment on Google Compute Engine by creating a Ubuntu 20.04 LTS VM with Docker and Docker Compose installed via a startup script; configure SSH keys.

Set up the Google Cloud SDK and kubectl in your development Linux environment to manage a GKE cluster and validate connectivity with kubectl get nodes.

Install helm to manage Kubernetes resources, then deploy and validate nginx from Artifact Hub, watch for load balancer creation, and uninstall cleanly using the release name.

Build a simple devops pipeline for a sample application using Jenkins on Kubernetes, deployed via a Helm chart, and learn the Jenkins file with build, test, and package stages.

Deploy Jenkins as a Kubernetes native continuous integration platform using helm in a dedicated namespace. Configure custom values, validate kubectl, and retrieve the external ip, node port, and administrator password.

Install essential plugins in Jenkins, including Blue Ocean and configuration as code. Set the administrator password from the admin console and restart Jenkins to apply changes.

Analyze how a declarative Jenkins pipeline runs on Kubernetes to build, test, and package a Java Maven project, producing a jar/war and preparing a Docker image for registry deployment.

Fork the demo project, connect to Jenkins Blue Ocean, and launch a Kubernetes native pipeline that builds, tests, and packages from the Jenkins file.

Kaniko builds container images inside a container without privileges, avoiding docker daemon and dind. Configure Jenkins CI to mount secret registry credentials to produce OCI-compliant images published to a registry.

Add a Kaneko build and publish stage to the Jenkins pipeline, using Kubernetes secrets to mount registry credentials, with parallel packaging and Docker Hub validation, later moving to OCI builds.

Learn how to secure your supply chain by scanning components and libraries, assessing licenses and legal risks, and integrating supply-chain practices into your DevOps pipeline.

Explore the OWASP dependency checker with a Maven-based Java app, run via docker or locally, scan dependencies for CVEs, view reports, and integrate into a Jenkins DevSecOps pipeline.

Explore using Pi reader as a Python software composition analysis tool in dockerized development, including pip installation, a base python image, and vulnerability auto fixes.

Add a software composition analysis stage to continuous integration pipeline by converting the test stage to static analysis and integrating a Maven-based dependency checker in Jenkins, with parallel unit tests.

Learn to add a license scanner with license finder, scan Maven, npm, and pip dependencies, enforce an allowed-license whitelist, and integrate safely into Jenkins pipelines.

Learn to install dependency tracker, a software bill of materials tool using cyclone dd, by provisioning a temporary node pool, deploying with helm, configuring an ingress, and troubleshooting readiness.

Troubleshoot kubernetes resource issues in the dependency tracker by diagnosing a pending pod due to memory and cpu limits, then adjust values with helm and access via ingress.

Connect Jenkins with Dependency Tracker by configuring an API key with permissions for project creation, upload policy violation analysis, and vulnerability analysis, and install the OWASP Dependency Track plugin.

Add a sbom stage to the pipeline that generates a software bill of materials using cyclone dd and ds formats, publishes reports to the dependency tracker, and archives html artifacts.

Learn to safely clean up dependency tracker after a build by commenting the publisher in Jenkins, uninstalling with Helm, and removing the temporary node pool and branches.

Learn how sast uses static analysis to shift tests left, catch vulnerabilities early, and secure code, dependencies, and libraries in the devops pipeline.

Discover slscan.io as an open source, all-in-one static analysis tool that scans code and dependencies, detects CVEs, generates SBOMs, and can file issues or PRs in CI pipelines.

Add a SAST stage to the pipeline by configuring a containerized build agent and updating the Jenkins file, then run SSL scans on the Java app and its dependencies.

Configure the dependency checker in pom.xml to fail the build when vulnerabilities exceed a cvss score of 8.0, enabling the sast stage to halt on critical issues.

Fix the json-smart dependency issue by updating the spring-boot version in pom.xml, run automated continuous integration with security scans, and address licensing problems flagged by the latest dependency update.

Learn to update the license approval list for OSS dependencies, validate with the license checker, and integrate SAST results into a DevSecOps pipeline with whitelisting and branch cleanup.

Secure your container images by scanning for vulnerabilities, updating base images, and mitigating risks, while applying security best practices in dockerfiles to optimize size and safety in production environments.

lint docker images with Docle, compare with Headland and Docker bench for security, scan created images in ci, publish to registry, and fix issues like non-root users and unnecessary files.

Learn to use Trivy to analyze container images, file systems, and configurations for vulnerabilities, compare image versions, and enforce CI builds with exit codes to keep images patched.

Learn how to mitigate Dockerfile vulnerabilities by building a multi-stage Dockerfile, running as non-root, and using minimal, certified base images with health checks.

Refactor the dockerfile into a two-stage build, from stage zero to stage one, using openjdk and maven images to minimize vulnerabilities through docker scan and trivy.

Learn to run containerized apps as a non-root user by creating and switching to an unprivileged user in a multi-stage Alpine Linux-based Dockerfile, and enforce non-root policy in Kubernetes.

Learn to add docker health checks to your image, configure interval, timeout, start period, and retries, and validate health with curl to localhost:8080, enabling quick detection of issues in production.

Add image analysis to the CI pipeline after packaging, running linting and vulnerability scanning with Trivy and Docle on the built OCI image before publishing to the registry.

Deploy a securely built container image to a Kubernetes environment and continuously test it with dynamic scans and penetration tests, then perform dast-based runtime security assessments.

Deploy Argo CD, a Kubernetes native GitOps tool, by creating the Argo CD namespace, deploying resources, patching the service to a node port, and logging in as admin with bcrypt.

Install the Argo CD CLI, log into the Argo CD server, and use commands to list projects, accounts, and apps for RBAC and deployment management.

Explain how Kubernetes uses pods as the unit of deployment, then use replication controllers, deployments, and replica sets to ensure high availability and scalability, with services enabling DNS-based discovery.

Generate Kubernetes deployment manifests and a service using kubectl create with dry-run to output yaml. Commit the files to a feature branch, push, and deploy with Argo CD after testing.

Learn to deploy with the Argo CD UI by creating a project, configuring source and destinations, and then create an app to deploy to the dev namespace with manual sync.

authorizes Jenkins to trigger remote deployments securely using Argo CD RBAC policies, by creating a restricted Jenkins user with an API key and read-only, sync-only access.

Configure Jenkins to remotely trigger Argo CD deployments by using a secret text credential, setting the Argo server URL, and integrating an Argo CD CLI deploy stage.

Automate DAST scanning with ZAP to perform dynamic penetration testing on the dev URL via a Jenkins DevSecOps pipeline, uncovering vulnerabilities and a minor header issue.

Learn how to implement compliance as code using Inspec and infrastructure as code to enforce security benchmarks like CIS, across systems and Kubernetes, within a continuous secops pipeline using Ansible.

Demonstrates compliance as code with Inspec on a Linux server, including installing Inspec, creating a profile, writing controls, using exec to run scans, and validating SSH and port checks.

Explore the devsec hardening framework to automate baseline security tests and mitigations with inspect profiles and inspec, covering linux, kubernetes, and common apps against cis benchmarks.

Configure the ssh pipeline steps plugin in Jenkins to run remote commands and scripts via ssh keys and credentials, enabling automated compliance checks and secure remote operations.

Debug SSH authentication in a Jenkins pipeline by verifying non-root access with sudo, correct public/private key setup, and accurate Google Cloud SSH configuration, enabling secure remote login and compliance scans.

Fork the Secops repository, configure Jenkins to trigger remote compliance scans over SSH with the SSH pipeline step, and automate failure and mitigation using infrastructure as code (Ansible) and Inspec.

Explore implementing a DevSecOps hardening framework by using Inspec to scan Linux baseline compliance and automatically mitigate issues with Ansible playbooks, inventories, and Jenkins integration.

Enforce compliance with ansible using the devsecops hardening collection from ansible galaxy. Apply OS hardening and other roles via a playbook to achieve automated remediation through infrastructure as code.

Modify InSpec controls to exclude squashfs from the unused file system test, updating the Linux baseline and adjusting exit codes for CI by commenting the line and re-running InSpec.

Orchestrate a daily compliance pipeline by integrating Inspec checks with Ansible enforcement in Jenkins, pulling updates, and applying policies to ensure automated governance through infrastructure as a code.

Learn to secure Kubernetes deployments by scanning for CIS benchmarks, applying RBAC and network policies, and hardening deployment and pod specs within a CI/CD pipeline.

Set up a single-node kubernetes environment by configuring docker and cgroups, installing kubectl, kubelet, and kubeadm, initializing the master, tainting the master to run pods for security.

Run CIS benchmark scans on a single-node Kubernetes cluster using Inspec and kube-bench, clone the repo, and launch scans to produce a remediation-focused vulnerability report.

Explore Kube Hunter, Aqua Security's pen-testing tool, to identify vulnerabilities in a running Kubernetes cluster via remote, in-cluster, and pod-based scans and assess exposed API versions and insider risks.

Scan Kubernetes deployment manifests with cube seq to identify security issues and mitigations in DevSecOps pipeline, including not running as root and read only file system for deployments and pods.

Add resource definitions to the deployment by setting cpu and memory requests and limits, using 50 millicores and 128 Mi to 256 Mi, per cube scan for security and balance.

Configure the security context for a pod in Kubernetes by dropping unnecessary capabilities, enforcing non-root containers, using a read-only root file system, and iteratively improving the cube scan score.

Apply a read-only root filesystem by mounting an ephemeral empty directory volume for /temp, map it in the container, and iteratively enhance security through devsecops workflows.

Explore seccomp profiles that restrict syscalls in containers and how enabling the runtime default profile in Kubernetes enhances container security.

Set runAsUser to 11000 to avoid uid conflicts, and use a dedicated service account with a name and auto mount service account token false in the pod spec.