🔐 Zero-Trust GitOps

Kubernetes manifests demonstrating zero-trust architecture with admission control, policy enforcement, and GitOps automation.

🎯 Overview

Production Kubernetes manifests with:

• ✅ Zero-Trust Networking - Default-deny NetworkPolicies
• ✅ Admission Control - Kyverno validates all deployments
• ✅ GitOps - ArgoCD auto-sync from Git
• ✅ Multi-Environment - Dev, Staging, Production with Kustomize
• ✅ Secret Management - External Secrets Operator + AWS Secrets Manager
• ✅ Runtime Security - Falco threat detection

🏗️ Architecture

┌─────────────────────────────────────────────────────────────┐
│                     Git Repository                          │
│  (Source of Truth for Cluster State)                       │
└─────────────────┬───────────────────────────────────────────┘
                  │
        Application push updates image digest
                  │
                  ▼
┌─────────────────────────────────────────────────────────────┐
│                       ArgoCD                                │
│  - Detects changes every 3 minutes                         │
│  - Auto-sync to dev                                        │
│  - Manual sync to staging/production                       │
└─────────────────┬───────────────────────────────────────────┘
                  │
          kubectl apply
                  │
                  ▼
┌─────────────────────────────────────────────────────────────┐
│                  Admission Control                          │
│  Kyverno Validates:                                        │
│  ❌ Block unsigned images                                  │
│  ❌ Block missing SBOM                                     │
│  ❌ Block latest tag                                       │
│  ❌ Block privileged containers                            │
│  ✅ Allow only compliant workloads                         │
└─────────────────┬───────────────────────────────────────────┘
                  │
         If validation passes
                  │
                  ▼
┌─────────────────────────────────────────────────────────────┐
│              Kubernetes Cluster (EKS)                       │
│                                                             │
│  ┌────────────────┐  ┌────────────────┐                   │
│  │   Backend      │  │   Database     │                   │
│  │   (IRSA)       │  │   (StatefulSet)│                   │
│  └────────┬───────┘  └────────┬───────┘                   │
│           │                    │                           │
│           └──── NetworkPolicy ─┘                           │
│                (Zero-Trust)                                │
│                                                             │
│  ┌────────────────────────────────────────────────┐       │
│  │  Falco (Runtime Security)                      │       │
│  │  - Detects shell spawns                        │       │
│  │  - Detects privilege escalation                │       │
│  │  - Alerts to Slack                             │       │
│  └────────────────────────────────────────────────┘       │
└─────────────────────────────────────────────────────────────┘

📁 Repository Structure

.
├── argocd/
│   ├── applications/
│   │   ├── app-of-apps.yaml      # Root application
│   │   ├── backend.yaml
│   │   ├── admin.yaml
│   │   └── platform.yaml
│   └── projects/
│       └── ecommerce.yaml
│
├── base/                          # Kustomize base manifests
│   ├── backend/
│   │   ├── deployment.yaml
│   │   ├── service.yaml
│   │   ├── serviceaccount.yaml   # IRSA annotation
│   │   ├── externalsecret.yaml   # Secrets from AWS
│   │   ├── networkpolicy.yaml    # Zero-trust rules
│   │   └── kustomization.yaml
│   │
│   ├── platform/
│   │   ├── external-secrets/
│   │   ├── kyverno/
│   │   │   ├── verify-images.yaml
│   │   │   ├── require-sbom.yaml
│   │   │   └── security-policies.yaml
│   │   └── falco/
│   │       └── custom-rules.yaml
│   │
│   └── ...
│
└── overlays/                      # Environment-specific
    ├── dev/
    │   └── backend/
    │       ├── kustomization.yaml
    │       └── patches/
    │           ├── replicas.yaml  # 1 replica
    │           └── resources.yaml # Lower limits
    │
    ├── staging/                   # 2 replicas
    └── production/                # 3 replicas + HPA

🔐 Zero-Trust Implementation

Default Deny All Traffic

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Allow Only Required Traffic

# Backend can ONLY talk to:
# - Database (port 5432)
# - Redis (port 6379)
# - External HTTPS (port 443)
# - DNS (port 53)

🛡️ Admission Control Policies

Kyverno Policies

1. Verify Image Signatures

- Block unsigned images
- Verify Cosign signature with GitHub OIDC
- Use Rekor transparency log

2. Require SBOM

- Block images without SBOM attestation
- Support SPDX and CycloneDX formats

3. Security Best Practices

- Require non-root user
- Block latest tag
- Require resource limits
- Block privileged containers
- Require read-only root filesystem

🔄 GitOps Workflow

Development

# Developer pushes code
git push origin main

# CI/CD builds, signs, scans image
# Updates this GitOps repo with new image digest

# ArgoCD detects change (within 3 min)
# Auto-syncs to dev environment

# Kyverno validates signature
# Deployment proceeds

Staging/Production

# Create PR to promote
gh pr create --title "Promote backend to staging"

# Team reviews
# Merge PR

# ArgoCD syncs (manual approval required)
# Canary deployment with Argo Rollouts

🚀 ArgoCD Setup

Install ArgoCD

kubectl create namespace argocd
kubectl apply -n argocd -f \
  https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

Deploy Applications

kubectl apply -f argocd/applications/app-of-apps.yaml

Access UI

# Get admin password
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

# Port forward
kubectl port-forward svc/argocd-server -n argocd 8080:443

📚 Documentation

• ADR-007: GitOps with ArgoCD
• ADR-008: Kyverno vs OPA
• ADR-009: Zero-Trust Networking
• Runbook: Deployment
• Runbook: Rollback

🧪 Testing

Verify NetworkPolicies

# Should FAIL (default deny)
kubectl run test --image=busybox -- wget backend:9000

# Should SUCCEED (after adding label)
kubectl label pod test app=admin
kubectl exec test -- wget backend:9000

Verify Admission Control

# Should FAIL (unsigned)
kubectl run test --image=nginx:latest

# Should SUCCEED (signed)
kubectl run test --image=ACCOUNT.dkr.ecr.REGION.amazonaws.com/backend@sha256:...

📊 Monitoring

ArgoCD Metrics

• Sync success rate
• Sync duration
• Application health status

Kyverno Metrics

• Policy violations
• Admission decisions
• Background scan results

👤 Author

Chetan Patil - Senior DevSecOps Engineer

• Portfolio: chetanpatil.dev
• GitHub: @chetanpatil

---

⭐ Demonstrates production GitOps and zero-trust security