The GitOps Security Champion repository provides a set of best practices, guidelines, and tools designed to help security engineers and DevOps teams implement secure GitOps workflows. With GitOps becoming a standard for managing infrastructure and application deployments, securing these processes is essential to mitigate security risks. This repository provides foundational practices to secure GitOps environments, covering everything from access control to software provenance verification.
Explore the complete GitOps Security Champion.
The repository is structured around individual best practices, each in its own folder. A central README offers an overview of all recommendations, while each practice has a dedicated README with detailed guidance. This structure makes it easy for users to navigate and implement the practices that best suit their needs.
We encourage contributions to make this repository as practical and comprehensive as possible. You can contribute in the following ways:
- Contributing Resources and Documentation: If you have expertise in GitOps security or notice areas where documentation can be improved or expanded, submit a pull request with your suggestions.
- Creating Examples and Tools: Real-world examples, scripts, or tools that demonstrate the implementation of best practices will be highly beneficial to users.
- Reporting Issues: If you encounter any issues or inaccuracies, please submit an issue with a detailed description.
- Fork the Repository: Begin by forking this repository to your GitHub account.
- Create a New Branch: Create a branch for your contribution (e.g., feature/best-practice-x).
- Submit a Pull Request: Once your changes are ready, submit a pull request with a clear description of your contributions. Please refer to our CONTRIBUTING.md file for more details.