<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-gitops-security
description: >-
  Secure GitOps pipelines including ArgoCD and Flux RBAC, signed commits and
  images, secret management in Git repos, drift reconciliation controls, and
  supply chain integrity for continuous deployment workflows.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - gitops
  - argocd
  - flux
  - supply-chain
  - signed-commits
  - rbac
  - continuous-deployment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Implementing GitOps Security

## Overview

GitOps pipelines manage infrastructure declaratively through Git but introduce
risks — unauthorized repo access, unsigned images, exposed secrets in manifests,
and drift from desired state. This skill covers securing ArgoCD/Flux deployments,
enforcing signed commits, and protecting the supply chain.

Mode: `[MODE: ARCHITECT]` — GitOps security design. `[MODE: BLUE]` — GitOps hardening.

## Prerequisites

| Requirement | Details |
|---|---|
| ArgoCD >= 2.10 or Flux >= 2.2 | Required |
| Cosign for image signing | Required |
| GPG or Sigstore for commit signing | Required |
| kubectl with cluster access | Required |

## Key Concepts

### ArgoCD RBAC Hardening

```yaml
# ArgoCD RBAC ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    p, role:developer, applications, get, */*, allow
    p, role:developer, applications, sync, */*, allow
    p, role:admin, applications, *, */*, allow
    p, role:admin, clusters, *, *, allow
    g, dev-team, role:developer
    g, platform-team, role:admin
```

### Enforce Image Verification in ArgoCD

```bash
# Configure ArgoCD to verify image signatures
cat <<YAML | kubectl apply -f -
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  source:
    repoURL: https://github.com/org/manifests.git
    targetRevision: main
    path: k8s/
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - Validate=true
    - CreateNamespace=false
YAML

# Verify image with Cosign before deploy
cosign verify --key cosign.pub registry.example.com/app:v1.0
```

### Git Commit Signing

```bash
# Configure GPG signing
git config --global commit.gpgsign true
git config --global user.signingkey KEY_ID

# Verify signed commits
git log --show-signature -1

# Enforce signed commits via branch protection (GitHub API)
gh api repos/ORG/REPO/branches/main/protection -X PUT \
  -f required_signatures=true
```

### Detect Secrets in Git Repos

```bash
# Scan for secrets with gitleaks
gitleaks detect --source=. --report-format=json --report-path=gitleaks.json

# Scan Git history
gitleaks detect --source=. --log-opts="--all" --report-format=json

# truffleHog scan
trufflehog git file://. --json
```

### Flux Security Configuration

```yaml
# Flux GitRepository with verification
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: app-manifests
  namespace: flux-system
spec:
  url: https://github.com/org/manifests.git
  ref:
    branch: main
  interval: 1m
  verify:
    provider: cosign
    secretRef:
      name: cosign-pub-key
```

## Workflow

```bash
node scripts/agent.js --action audit --tool argocd --output /tmp/gitops-audit.json
cat /tmp/gitops-audit.json | jq '.findings[]'
```

## Detection

```yaml
title: Gitops Security Detection
id: 13fd82b9-7b51-402e-b750-09e37fb273e8
status: experimental
description: Detects suspicious activity related to implementing gitops security techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Gitops Security Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] ArgoCD RBAC restricts admin to platform team only
- [ ] Image signatures verified before deployment
- [ ] Git commits signed and branch protection enforced
- [ ] No secrets in Git repos (gitleaks clean)
- [ ] Automated sync with selfHeal and prune enabled
- [ ] Flux/ArgoCD audit logs forwarded to SIEM

## References

- [ArgoCD Security Best Practices](https://argo-cd.readthedocs.io/en/stable/operator-manual/security/)
- [Flux Security](https://fluxcd.io/flux/security/)
- [Sigstore — Software Supply Chain Security](https://www.sigstore.dev/)
