GitOps Security Architecture with Zero Trust: Identity-Driven Control Planes for Cloud-Native Deployments
DOI:
https://doi.org/10.32628/CSEIT24102255Keywords:
Zero Trust, GitOps, Kubernetes, Identity Management, Cloud Security, Policy-as-CodeAbstract
The rapid adoption of GitOps has redefined continuous deployment in cloud-native environments, yet prevailing GitOps implementations often rely on implicit trust relationships that conflict with modern Zero Trust security principles. This paper introduces an identity-driven Zero Trust architecture for GitOps-managed Kubernetes deployments, where every deployment action is continuously authenticated, authorized, and validated through explicit identity and policy enforcement. By integrating federated identity, workload-level authentication, and policy-as-code into the GitOps control plane, the proposed approach transforms deployment pipelines into verifiable security enforcement points rather than privileged automation channels. The architecture is validated in a production-scale cloud environment and demonstrates measurable improvements in deployment integrity, policy compliance, and unauthorized access prevention, while preserving the operational efficiency that makes GitOps effective. This work establishes a practical foundation for embedding Zero Trust directly into cloud deployment architectures, advancing secure-by-design principles for modern financial and enterprise cloud platforms.
Downloads
References
Kindervag, J. (2010). "Build Security Into Your Network's DNA: The Zero Trust Network Architecture." Forrester Research, Inc.
Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). "Zero Trust Architecture." NIST Special Publication 800-207, National Institute of Standards and Technology. DOI: https://doi.org/10.6028/NIST.SP.800-207-draft2
Burns, B., & Beda, J. (2019). "Kubernetes: Up and Running: Dive into the Future of Infrastructure." O'Reilly Media, Second Edition.
Sandeep Kamadi. (2022). Proactive Cybersecurity for Enterprise Apis: Leveraging AI-Driven Intrusion Detection Systems in Distributed Java Environments. International Journal of Research in Computer Applications and Information Technology (IJRCAIT), 5(1), 34-52. https://iaeme.com/MasterAdmin/Journal_uploads/IJRCAIT/VOLUME_5_ISSUE_1/IJRCAIT_05_01_004.pdf DOI: https://doi.org/10.34218/IJRCAIT_05_01_004
Beyer, B., Jones, C., Petoff, J., & Murphy, N. R. (2016). "Site Reliability Engineering: How Google Runs Production Systems." O'Reilly Media.
Posta, C. (2020). "Istio in Action: Secure, connect, and observe cloud-native applications." Manning Publications.
Sarhan, A., & Lilien, L. (2019). An Approach to Identity Management in Clouds without Trusted Third Parties. arXiv.
This paper proposes an efficient and privacy-preserving identity management approach for cloud computing that minimizes reliance on trusted intermediaries and supports attribute-based access controls, foundational to identity-centric security models like Zero Trust in cloud contexts.
Shamim, M. S., Bhuiyan, F. A., & Rahman, A. (2020). XI Commandments of Kubernetes Security: A Systematization of Knowledge Related to Kubernetes Security Practices. arXiv.
This work systematizes security practices for Kubernetes, including role-based access control and least-privilege constructs that align with modern Zero Trust deployment approaches in microservices and cloud-native platforms.
J. Thomas and S. Arora, Integrating Zero Trust with GitOps for Secure Cloud Deployments, IEEE Access, vol. 10, pp. 84592–84607, 2022.
P. Anderson and L. Wang, Automating Zero Trust Validation in GitOps Pipelines, in Proc. IEEE Int. Conf. Cloud Eng. (IC2E), 2021, pp. 111–121.
T. Nguyen and X. Luo, Dynamic Policy Enforcement in Cloud-Native CI/CD Systems, IEEE Trans. Cloud Comput., vol. 8, no. 4, pp. 468–479, 2020.
N. M. Joshi and M. Lee, DevSecOps: Integrating Security in DevOps, IEEE Access, vol. 8, pp. 146310–146321, 2020.
M. A. Babar et al., Challenges and Practices in DevOps: A Multivocal Literature Review, IEEE Software, vol. 37, no. 1, pp. 72–80, 2020.
Oleti, Chandra Sekhar. (2022). The future of payments: Building high-throughput transaction systems with AI and Java Microservices. World Journal of Advanced Research and Reviews. 16. 1401-1411. 10.30574/wjarr.2022.16.3.1281. DOI: https://doi.org/10.30574/wjarr.2022.16.3.1281
Sandeep Kamadi. (2022). AI-Powered Rate Engines: Modernizing Financial Forecasting Using Microservices and Predictive Analytics. InternationalJournal of Computer Engineering and Technology (IJCET), 13(2), 220-233. https://iaeme.com/MasterAdmin/Journal_uploads/IJCET/VOLUME_13_ISSUE_2/IJCET_13_02_024.pdf DOI: https://doi.org/10.34218/IJCET_13_02_024
Praveen Kumar Reddy Gujjala. (2022). Enhancing Healthcare Interoperability Through Artificial Intelligence and Machine Learning: A Predictive Analytics Framework for Unified Patient Care. International Journal of Computer Engineering and Technology (IJCET), 13(3), 181-192. https://iaeme.com/Home/issue/IJCET?Volume=13&Issue=3 DOI: https://doi.org/10.34218/IJCET_13_03_018
Bass, L., Weber, I., & Zhu, L. (2015). "DevOps: A Software Architect's Perspective." Addison-Wesley Professional.
Gujjala, Praveen Kumar Reddy. (2022). Data science pipelines in lakehouse architectures: A scalable approach to big data analytics. World Journal of Advanced Research and Reviews. 16. 1412-1425. 10.30574/wjarr.2022.16.3.1305. DOI: https://doi.org/10.30574/wjarr.2022.16.3.1305
Chen, L. (2018). "Microservices: From Design to Deployment." NGINX, Inc.
S. Islam Shamim, F. A. Bhuiyan, A. Rahman, XI Commandments of Kubernetes Security: A Systematization of Knowledge Related to Kubernetes Security Practices, arXiv (2020). DOI: https://doi.org/10.1109/SecDev45635.2020.00025
This foundational paper identifies and systematizes core security practices for Kubernetes deployments, including role-based access control and least-privilege policies relevant to Zero Trust and cloud-native security.
M. Sasson, A. Refaey, A. Shami, Security of Zero Trust Networks in Cloud Computing, Sustainability (2022; draws on research frameworks from 2018–2020).
Although published in 2022, this survey includes key state-of-the-art models and feature comparisons from research conducted in 2018–2020 for zero-trust cloud networks and identity-based access control.
Downloads
Published
Issue
Section
License
Copyright (c) 2024 International Journal of Scientific Research in Computer Science, Engineering and Information Technology
This work is licensed under a Creative Commons Attribution 4.0 International License.
