LF Live Webinar: Securing CI/CD Pipelines Through Security Gates

### Overview In this Linux Foundation Live Webinar, Alex (Director of Kubernetes at Canonical and contributor to OpenFeature) and Ben (CTO/co-founder at ARMO and Kubescape maintainer) discuss securing CI/CD pipelines through end-to-end security gates. As infrastructure and application deployments become defined by code, misconfigurations and configuration drift represent primary sources of security breaches in Kubernetes and cloud-native environments. The speakers examine how introducing security gates across the development lifecycle enables teams to catch vulnerabilities early, streamline compliance, and unify security visibility.

### Key Topics - **Evolution of the Attack Surface:** As organizations transition to cloud and container orchestration, attack surfaces expand beyond Kubernetes clusters to include container registries, build pipelines, base image provenance, and configuration code. - **Desired State vs. Actual State:** Discrepancies between local development ('the dream') and deployed production clusters ('the reality') arise from testing anomalies, manual cluster modifications (e.g., mixing GitOps, Helm, and client-side kubectl), and configuration drift. - **Multi-Stage Security Gates:** Establishing progressive security gates—spanning local IDE development, pre-commit checks, pull request validations in CI, container registry rescanning, and runtime cluster monitoring. - **Single Pane of Glass and Observability:** The operational risks of managing dozens of disconnected tools, and the benefits of centralizing image vulnerabilities, workload misconfigurations, RBAC, and network exposure into unified platforms like Kubescape and Grafana dashboards.

### Technical Details - **Development and Pre-Commit Checks:** Using IDE extensions (such as in VS Code) to catch insecure configurations immediately (for example, alerting when `hostNetwork: true` is configured on a pod specification). - **Pull Request Automation:** Implementing CI workflows (such as GitHub Actions) executing Kubescape with policies written in Open Policy Agent (OPA) Rego. These gates can output findings through JUnit test annotations to block non-compliant PRs before merge. - **Container Registry Rescanning:** Emphasizing that vulnerability scanning cannot be a one-time build check; registries must be rescanned continuously as new CVEs are published daily against existing base images. - **Cluster Runtime Auditing:** Continuously monitoring running Kubernetes workloads and API server configurations to prevent privilege escalation, detect insecure exposures (such as converting ClusterIP services to LoadBalancers on port 80), and maintain standards such as CIS benchmarks, SOC 2, and HIPAA. - **Tooling Demonstration:** Alex demonstrates inspecting YAML deployments in VS Code, running automated PR checks in a sample repository ('cats'), addressing CLOMonitor ratings for CNCF projects, and integrating cluster data into Kubescape Cloud.

### Takeaways - Shifting security checks left into the developer's workflow reduces remediation costs and prevents security flaws before code reaches production. - Security gates should operate like locks on a river: transparent, automated criteria where builds pass only when all quality and security controls turn green. - Combining developer empowerment with centralized visibility allows organizations and open source maintainers to achieve secure-by-design pipelines without overwhelming engineering velocity.