DevSecOps cheat sheet
Use this cheat sheet as a quick reference for the key recommendations when you adopt Continuous Delivery DevSecOps. Each item has a short statement and a link to the corresponding documentation.
Get started
| Recommendation | What to do | Learn more |
|---|---|---|
| Use supported pipeline versions | Use the v10 or v11 pipeline version. The v9 version is no longer supported. |
Select a specific version branch or tag, Improving compliance pipeline performance |
| Adopt the complete DevSecOps spectrum | Set up continuous integration (CI), continuous deployment (CD), and continuous compliance (CC) together, rather than a subset. | CI pipeline, CD pipeline, CC pipeline |
| Follow the toolchain best practices | Start from the practices that each reference toolchain (CI, CI for IaC, CD, CC) already implements. | Best practices for DevSecOps toolchains |
| Onboard your own application | Bring your application to DevSecOps with the inferred pipeline configuration instead of writing the configuration from scratch. | Bringing your own app to DevSecOps, Creating a pipeline with Inferred DevSecOps configuration |
| Use a PR pipeline | Run the PR pipeline on every pull request to catch issues before merge. | Pull request pipeline |
Evidence and traceability
| Recommendation | What to do | Learn more |
|---|---|---|
| Reuse evidence | Opt in to evidence reuse so that PR and CI pipelines skip scans and tests when the content did not change. | Reuse of evidence across PR and CI pipelines |
| Use Object Storage as the evidence locker | Store evidence only in IBM Cloud Object Storage buckets. | Using IBM Cloud Object Storage buckets as an evidence locker, Configuring IBM Cloud Object Storage for storing evidence |
| Collect evidence in the PR pipeline | Set collect-evidence-in-pr to collect evidence and manage issues for pull requests. |
Enable evidence collection in PR pipeline |
| Gate deployments on evidence | Know why a deployment is blocked, and configure evidence checks for your deployment topology. | Validating evidence |
| Keep peer review on | Keep peer-review-compliance set to 1 so that merged pull requests are checked for peer review. |
Peer review compliance |
| Enable PR traceability | Set the deployment-traceability flag so that merged PRs are labeled with the environment they were deployed to. |
Enabling deployment traceability |
| Automate change management | Let the CD pipeline create, approve, and close change requests with the deployment evidence attached. | Automated change management |
| Generate a software bill of materials | Produce SBOMs for each built microservice and keep them with the evidence. | Software Bill Of Materials |
Security and compliance
| Recommendation | What to do | Learn more |
|---|---|---|
| Manage issues | Set the incident-assignees and incident-labels properties in the CI and CC pipelines so that incident issues have owners and labels. |
Assigning incident issues to users, Labeling incident issues, Pipeline parameters |
| Track due dates on issues | Use due dates and custom grace periods on incident issues, and extend them only through the documented process. | Managing due dates for incident issues, Extending the due date of an incident issue |
| Close fixed issues automatically | Keep opt-in-auto-close at its default of 1 so that issues close when the vulnerability is no longer detected. |
Use case 4: automatically closing fixed issues |
| Auto-remediate security issues | Turn on auto-remediation in the CC pipeline (opt-in-cra-auto-remediation) so that fix PRs are opened for vulnerable packages. |
Automatically remediating vulnerabilities |
| Pick your scanners | Review the supported scanning tools and configure the ones that fit your stack. | Supported scanning tools, Configuring detect-secrets scans |
| Sign your artifacts | Configure signing properties so that the CI pipeline signs images, and sign non-image artifacts too. The CD pipeline blocks unsigned artifacts. | Generating a GPG key, Signing non-image artifacts |
| Vault your secrets | Keep secrets in a vault and link them to the toolchain, rather than pasting values. | Managing secrets in your toolchains, Using secrets integrations in your toolchains |
| Apply least-privilege access | Grant the Pipeline Administrator and Pipeline Runner roles only the IAM access that each role needs. | Managing IAM access for cloud resources |
Customization and operations
| Recommendation | What to do | Learn more |
|---|---|---|
| Customize processes in a controlled way | Use one-pipeline-config-repo for your pipeline configuration and custom scripts. Reuse the common script tools that are provided in the compliance base image. |
Working with default and custom scripts, Understanding Commons Scripts in DevSecOps |
| Organize your repositories | Plan your application, shared configuration, inventory, and issues repositories before you create toolchains. | DevSecOps repositories considerations |
| Choose a deployment model | Decide between push-based and pull-based deployment for your clusters. | Deployment models |
| Manage the inventory | Promote inventory changes through branches and partition the inventory for the CC pipeline when you have many artifacts. | Understanding inventory for DevSecOps, Partitioning inventory for CC pipeline |
| Develop pipeline changes in development mode | Test .pipeline-config.yaml changes with the simplified pipeline. Development mode skips compliance tasks and collects no evidence, so switch back for real runs. |
Running pipelines in development mode |
| Run several apps from one toolchain | Configure the CI and PR pipelines for multiple application repositories. | Configuring multiple apps on one CI toolchain |
| Get notified | Add Event Notifications to the toolchain and set event-notifications to 1. |
Event Notifications for DevSecOps pipelines |
| Troubleshoot with debug mode | Turn on pipeline-debug to get more detail when a run fails. |
Pipeline parameters, Troubleshooting, FAQ |