For government / 03 · DevSecOps
Signed pipelines, locked runners, no surprises — connected or air-gapped. GitLab + ArgoCD + Terraform with Cosign-signed artifacts, SAST/DAST, SBOM generation, and policy gates that block on violation. Air-gapped variants survive DiODE one-way transfer; embedded firmware to k8s — same scanner gates, same signature chain.
Every release follows the same SLSA-aligned path into AWS GovCloud: built on locked runners, signed with Cosign, gated fail-closed on SCAP/STIG, deployed by ArgoCD, and watched by a closed loop that feeds vulnerability management back to the gate. Watch it run.
GitLab CI assembles the build on locked, ephemeral runners.
Air-gapped CI · DiODE-friendly
The signed bundle is the unit of transfer. Low side (commercial / dev) builds hermetically with BuildKit, signs with Cosign keyless OIDC, and bundles via oras with SBOM + attestations. Across a data diode, the high side (cleared, no inbound) ingests, verifies the signature against the Fulcio chain, runs vuln + policy gates that reject unsigned or CVE-breaching artifacts, and ArgoCD reconciles against a git mirror inside the enclave — no internet pulls. Feedback returns out-of-band on its own diode.
One control plane for source, CI, registry, package, and pages.
Runs in-cluster or on-prem. Group-level CI templates are reused across every repo — zero per-repo boilerplate. Runners span docker, dind, shell, and a cleared TS/SCI tier. SAML / OIDC federation with PIV at the admin tier, and the container registry sits behind a Cosign verification gate.
The cluster is whatever git says it is.
ArgoCD reconciles continuously. Progressive rollouts with Argo Rollouts or Flagger — analysis runs on real metrics, with auto-rollback on breach. App-of-apps pattern where environments are folders, not branches. Canary / blue-green / experiment strategies, SLO-driven analysis from Prometheus, and auto-rollback on error-rate or latency breach.
Every artifact has a provenance attestation pointing back to the commit, runner, and build environment.
Admission verifies — if the chain breaks, the deploy doesn't happen. Cosign keyless via Sigstore Fulcio, build provenance per SLSA L3 spec, SBOMs in CycloneDX + SPDX attached as attestations, and Kyverno / Connaisseur reject anything unverified.
The signed bundle is the unit of transfer.
High-side ingest verifies the signature, runs vuln + policy gates, then ArgoCD applies. No inbound from the cleared side — feedback comes back through its own diode. oras-bundled artifacts carry sig + SBOM + attestations, manifest sync runs via a signed Gitea / GitLab mirror on the high side, a Harbor mirror registry keeps base images warm, and Renovate runs low-side proposing bumps with MR review enforced.
One OpenTelemetry collector pipeline — three signals.
Metrics to Prometheus, logs to Loki, traces to Tempo. eBPF (Pixie / Hubble) for what apps don't emit. An OTel collector with an org-wide processor pipeline, a Loki + Prometheus + Tempo + Grafana stack, Pixie for zero-instrumentation deep dives, and an SLO library shared across services.
Same pipeline pattern for embedded — Yocto images get the SAST + SBOM + signing treatment.
OTA updates are verified on-device before swap. Yocto / OpenEmbedded build with reproducible recipes, SWUpdate or RAUC for A/B partitioned OTA, image SBOM via the create-spdx bbclass, and a secure boot chain validated on every image.
Self-hosted control plane, GitOps rollout.
Hermetic-first builds, code-managed config.
SLSA L3 chain, no plaintext secrets.
Three-signal telemetry, eBPF mesh.
In production.
ArgoCD app-of-apps — single reconcile loop, scales to N envs. Renovate auto-bump — CVE patches merged automatically. OpenTelemetry collector — one pipeline, three signals. oras bundle transfer — the air-gap shipping primitive.
Piloting.
Istio Ambient mesh — ztunnel mTLS, no sidecar tax. Pixie eBPF profiling — zero-instrumentation deep dives. Argo Rollouts canary — metric-analysis-driven promotion. Konflux / Pipelines as Code — Tekton-native build platforms.
Watching.
New engagement
A free consultation. Show us your current pipeline — we'll point out where the signing chain breaks, the air-gap leaks, or the manual gates that should be code.
