DevSecOps Glossary¶

Quick Reference

Specialized terminology for security teams and DevSecOps practitioners. Each term includes practical context and links to relevant documentation.

Supply Chain Security¶

SLSA (Supply chain Levels for Software Artifacts)¶

SLSA is a security framework. It has four levels for ensuring supply chain integrity. It proves build integrity using cryptographic attestations. This helps prevent tampering.

Related: SLSA Provenance | SLSA Levels | SLSA vs SBOM

Provenance¶

Provenance is cryptographic proof. It shows how a software artifact was built. It records the source commit and build details. Digital signatures prevent tampering. Provenance is required for SLSA Level 2 and higher.

Related: SLSA Provenance | Verification Workflows

Attestation¶

An attestation is a signed statement about software artifacts. It uses cryptographic signatures. This makes verifiable claims about builds, tests, or scans.

Related: SLSA Provenance | Policy Templates

SBOM (Software Bill of Materials)¶

An SBOM is a complete list of all software components. This includes all libraries and dependencies. It helps with vulnerability tracking and license compliance.

Related: SBOM Generation | SLSA vs SBOM

Sigstore¶

Sigstore is an open-source project for signing software.

It provides free code signing. It uses short-lived certificates and maintains transparency logs. No key management is needed. OpenSSF and GitHub Actions use Sigstore.

Related: SLSA Provenance | Container Release

Cosign¶

Cosign is a tool for signing container images.

It is part of Sigstore. Cosign signs container images. It stores these signatures in OCI registries. It also integrates with admission controllers.

Related: Image Signing | Image Verification

Policy & Compliance¶

Policy-as-Code¶

Policy-as-Code involves writing security and compliance policies. These policies are version-controlled, testable, and executable code. Tools like OPA, Kyverno, and Gatekeeper implement this concept.

OPA (Open Policy Agent)¶

OPA is a policy engine. It uses the Rego language. OPA enforces policies across the cloud-native stack. It is often used with Gatekeeper for Kubernetes.

Related: OPA Templates | OPA vs Kyverno

Kyverno¶

Kyverno is a Kubernetes-native policy engine. It validates, mutates, and generates resources using YAML. This enables policy enforcement during local development, CI, and runtime.

Gatekeeper¶

Gatekeeper integrates OPA with Kubernetes. It uses Rego policies. Gatekeeper validates and mutates resources through an admission controller webhook.

Related: OPA Templates | Migration Guide

Admission Controllers¶

Admission controllers are Kubernetes components. They intercept API requests before these requests are saved. This allows for validation and mutation of resources. Kyverno and Gatekeeper are examples of admission controllers.

Related: Policy-as-Code | Runtime Deployment

Scorecard¶

Scorecard is an OpenSSF tool. It measures security best practices. It runs 18 checks and scores each from 0 to 10. High scores show a strong security posture.

Architecture Patterns¶

Hub-and-Spoke¶

Hub-and-Spoke is a centralized distribution pattern. A central hub repository controls many spoke repositories. This provides centralized control for policies across an organization.

Related: GitHub Actions Integration

Three-Stage Design¶

This workflow has three phases: Discovery, Distribution, and Summary. It makes errors visible. Each phase can roll back independently.

Strangler Fig¶

Strangler Fig is an incremental migration pattern. It helps replace old systems. Both old and new systems run in parallel. Traffic gradually shifts to the new system with no downtime.

Separation of Concerns¶

This design principle states that components should have a single responsibility. They should also have clear boundaries. This separates orchestration from business logic. It improves maintainability.

Matrix Distribution¶

Matrix distribution is a CI/CD pattern. It runs operations in parallel. It uses a dynamic set of targets. This enables parallel processing and conditional execution.

Environment Progression¶

Environment progression is a deployment strategy. It moves code through a series of environments (like dev, staging, prod). This validates changes and automates rollbacks.

Efficiency Patterns¶

Idempotency¶

Idempotency is an operation. It can be run multiple times. The result does not change after the initial application. This makes retries safe and automation reliable.

Work Avoidance¶

Work avoidance uses patterns to skip unnecessary work. It uses techniques like change detection and caching. This reduces runtime and cost.

Check-Before-Act¶

This is the most common idempotency pattern. It checks if a resource exists before creating it. This avoids errors and redundant work. However, it is subject to race conditions.

Tombstone Markers¶

Tombstone markers are a work-avoidance technique. They leave a marker (like a file) after a task is done. This allows later runs to skip the operation.

Related: Tombstone Markers

Content Hashing¶

Content hashing is a change-detection technique. It uses cryptographic hashes. This determines if content has changed. It helps avoid unnecessary processing.

Related: Content Hashing | Cache-Based Skip

Caching¶

Caching means storing the results of expensive operations. These results can be reused later. Effective cache invalidation is critical for this pattern.

Related: Cache Considerations | Cache-Based Skip

CI/CD & Automation¶

GitHub Actions¶

GitHub Actions is GitHub's CI/CD platform. It automates workflows. Workflows are triggered by events. Jobs run in parallel, and steps execute commands.

GitHub Apps¶

GitHub Apps are applications at the organization level. They provide a secure and auditable machine identity. They also have higher rate limits. This is critical for operations across multiple repositories.

Argo Workflows¶

Argo Workflows is a Kubernetes-native workflow engine. It uses YAML to define complex, container-based workflows. It supports retries, error handling, and templates.

Argo Events¶

Argo Events is an event-driven workflow automation framework for Kubernetes. It connects different systems. It uses event sources and sensors to trigger reactive workflows.

Release-Please¶

Release-Please is an automated versioning tool. It generates changelogs and creates release pull requests. It also tags releases based on Conventional Commit messages.

Pre-commit Hooks¶

Pre-commit hooks are Git hooks. They run before a commit is created. They provide fast feedback by blocking secrets and other violations. This prevents them from entering the codebase.

Related: Pre-commit Hooks | Pre-commit Patterns

Reusable Workflows¶

Reusable workflows are parameterized GitHub Actions workflows. Other workflows can call them. This centralizes logic and allows reuse across many repositories.

Conventional Commits¶

Conventional Commits use a structured message format (e.g., 'type(scope): description'). This format enables automation for changelog generation and version bumps.

WorkflowTemplate¶

A WorkflowTemplate is a reusable Argo Workflow definition. It can be parameterized. Other workflows can reference it. This helps compose complex pipelines in Kubernetes.

Security & Hardening¶

Zero Trust¶

Zero Trust means no implicit trust.

Every request needs verification. Network location does not matter. Verification happens at every layer.

Related: Secure-by-Design

Defense in Depth¶

Defense in Depth uses multiple security layers.

Each layer adds protection. The layers work independently. A single breach cannot destroy everything.

Related: Defense in Depth

Least Privilege¶

Least Privilege means giving only the minimum permissions needed.

This limits damage from breaches. It is required for good security.

Related: Least Privilege

Fail Secure¶

Fail Secure means failures default to safe states.

When controls fail, access is denied. This prevents bypass. Kubernetes uses 'failurePolicy: Fail'.

Related: Fail Secure | Integration

Branch Protection¶

Branch protection consists of GitHub rules. These rules enforce security on branches.

It requires code review and blocks force pushes. It also requires status checks. Drift is common, but automated enforcement fixes it.

Commit Signing¶

Commit signing provides cryptographic proof of authorship.

Git author fields are easy to forge. GPG signatures prove who made a commit. This is required for audits.

Related: Commit Signing | Implementation Roadmap

Workload Identity¶

Workload Identity enables cloud authentication without static keys.

Containers use JWT tokens instead of static keys. These tokens rotate automatically. This removes a large attack surface.

Related: Workload Identity | Migration Guide

GKE Hardening¶

GKE Hardening improves security for Google Kubernetes Engine.

It includes private clusters, Workload Identity, Binary Authorization, and Infrastructure as Code.

Missing a Term?

If you find terminology not defined here, please open an issue.

Related: Roadmap | Patterns | Blog