Безопасность в DevOps: Shift Left

1# SonarQube
2sonar-scanner -Dsonar.projectKey=myapp -Dsonar.sources=src
3
4# ESLint Security
5npm install eslint-plugin-security

1# .github/workflows/security.yml
2name: Security Scan
3
4on: [push, pull_request]
5
6jobs:
7  sast:
8    runs-on: ubuntu-latest
9    steps:
10    - uses: actions/checkout@v4
11    
12    - name: Initialize CodeQL
13      uses: github/codeql-action/init@v2
14      with:
15        languages: javascript
16    
17    - name: Perform CodeQL Analysis
18      uses: github/codeql-action/analyze@v2

1# .github/workflows/dast.yml
2name: DAST Scan
3
4jobs:
5  dast:
6    runs-on: ubuntu-latest
7    steps:
8    - name: ZAP Scan
9      uses: zaproxy/action-full-scan@v0.8.0
10      with:
11        target: 'https://staging.example.com'

1# Сканирование образа
2trivy image myapp:latest
3
4# Сканирование файловой системы
5trivy fs .
6
7# Сканирование в CI/CD
8trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest

1# Сканирование на уязвимости
2docker scout cves myapp:latest
3
4# Рекомендации
5docker scout recommendations myapp:latest

1# Установка Vault
2vault server -dev
3
4# Сохранение секрета
5vault kv put secret/myapp/db password="secret123"
6
7# Получение секрета
8vault kv get -field=password secret/myapp/db

1apiVersion: bitnami.com/v1alpha1
2kind: SealedSecret
3metadata:
4  name: myapp-secret
5spec:
6  encryptedData:
7    DB_PASSWORD: AgBy3i4OJSWK+PiTySYZZA9rO43cGDEq...

1# Установка
2npm install -g snyk
3
4# Проверка зависимостей
5snyk test
6
7# Мониторинг
8snyk monitor

1# .github/dependabot.yml
2version: 2
3updates:
4  - package-ecosystem: "npm"
5    directory: "/"
6    schedule:
7      interval: "weekly"
8    open-pull-requests-limit: 10

1# deny.rego
2package kubernetes.admission
3
4deny[msg] {
5    input.request.kind.kind == "Pod"
6    container := input.request.object.spec.containers[_]
7    not startswith(container.image, "registry.example.com/")
8    msg := sprintf("Image %v is not from trusted registry", [container.image])
9}

1.env
2*.pem
3*.key
4credentials.json

1# Установка
2git clone https://github.com/awslabs/git-secrets.git
3cd git-secrets && make install
4
5# Регистрация
6git secrets --install
7git secrets --register-aws

1name: Security Pipeline
2
3on: [push, pull_request]
4
5jobs:
6  security:
7    runs-on: ubuntu-latest
8    steps:
9    - uses: actions/checkout@v4
10    
11    - name: SAST
12      run: npm run lint && npm run typecheck
13    
14    - name: Dependency Scan
15      run: npx snyk test
16    
17    - name: Container Scan
18      run: trivy image myapp:latest
19    
20    - name: Secret Scan
21      run: trufflehog filesystem . --only-verified