DevSecOps Pipeline – Release and Deploy Stage
This domain covers getting a verified artifact into an environment safely: deployment strategy, infrastructure as code, policy enforcement, secret delivery and supply chain provenance.
Core rules
- Progressive delivery: canary releases shift a small percentage of traffic, compare error rate and latency against baseline, then widen or roll back automatically. Blue/green keeps two full environments and switches traffic, which requires backward-compatible database changes. Feature flags decouple deploy from release.
- IaC scanning and policy as code: Terraform, Kubernetes manifests and Helm charts are scanned for misconfiguration before apply (Checkov, tfsec, kube-linter), and admission control (OPA/Gatekeeper, Kyverno) blocks non-compliant workloads at the cluster boundary.
- Secrets at deploy time: inject short-lived credentials from a vault or via workload identity; never bake secrets into images, manifests or repo variables in plaintext.
- Supply chain integrity: provenance attestations (SLSA levels), signed images verified by the admission controller, and dependency verification prevent deploying an artifact nobody built.
- Separation of duties survives automation: the pipeline identity that deploys cannot also approve its own policy change.
- Rollback plan: rollback or roll-forward must be tested, and schema changes must be backward compatible for at least one release window.
Worked example
A new API version deploys as a 5% canary for ten minutes. Automated analysis shows p95 latency up 40% and 5xx rate up from 0.2% to 1.1% on canary pods only. Correct reasoning: thresholds were defined before deployment (error rate > 1% or p95 > 1.5× baseline triggers abort), so the controller halts the rollout and reverts traffic without waiting for a human. Had the team skipped pre-defined thresholds, a human would have debated the numbers while all users were affected. Post-incident, the config change that caused it is caught by the IaC policy check added to the pipeline.
Traps that cost marks
- Storing deploy credentials in plaintext CI variables or inside container images.
- Treating IaC as trusted because it is code - it needs scanning and admission control just like application code.
- Blue/green without a database migration strategy, causing failures on switchback.
- Leaving permanent manual approval gates that were meant to be temporary; they become the bottleneck and get bypassed.
- Deploying artifacts by tag rather than digest, allowing a mutated image to slip through.
- Skipping the rollback rehearsal and discovering it fails during the incident.