Container Security, 2nd Edition

Chapter 9. Infrastructure as Code and GitOps

Software runs on computers, and when there are several computers involved, we start using the term infrastructure to describe not just the machines themselves but also the networking that connects them and devices such as storage that are available to those computers. The way that this infrastructure is set up has a bearing on security.

This book focuses on container security, so I won’t go into details about the broad topics of network and computer security. But in the cloud deployments where containers typically run in production, the tools and processes used to set up the infrastructure can have a strong influence on the security outcomes for those containers. In this chapter, I’ll start by talking briefly about infrastructure as code, and then go on to describe how this approach set the foundations for GitOps, which in turn has some very significant security characteristics.

IaC

When you are going to run software in “the cloud,” you will need to provision some infrastructure to run it on, whether that involves spinning up virtual machines or configuring bare metal machines. You’ll want to choose the operating system(s) to deploy on those machines and connect them together, perhaps with a virtual private cloud (VPC) to isolate them from other machines and users. You might also want to set up access to cloud services like databases or messaging frameworks that your software is going to access. In a public cloud environment, the infrastructure ...