Bảo mật Pipeline DevOps 2026: Thực tiễn DevSecOps và Câu hỏi Phỏng vấn

# Cấu hình HashiCorp Vault trong pipeline GitLab CI
variables:
  VAULT_ADDR: "https://vault.company.com:8200"

stages:
  - authenticate
  - build
  - deploy

vault_auth:
  stage: authenticate
  script:
    - export VAULT_TOKEN=$(vault write -field=token auth/jwt/login role=ci-role jwt=$CI_JOB_JWT)
    - vault kv get -field=password secret/database/prod > /tmp/db_password
  artifacts:
    paths:
      - /tmp/db_password
    expire_in: 5 minutes

# GitHub Actions workflow với quét bảo mật toàn diện
name: Security Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  sast-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run Semgrep SAST
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/secrets
            p/owasp-top-ten
          generateSarif: true
      
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

  container-scan:
    runs-on: ubuntu-latest
    needs: [sast-scan]
    steps:
      - uses: actions/checkout@v4
      
      - name: Build container image
        run: docker build -t app:${{ github.sha }} .
      
      - name: Scan container image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'app:${{ github.sha }}'
          format: 'sarif'
          severity: 'CRITICAL,HIGH,MEDIUM'

# Cấu hình Terraform với các thực tiễn bảo mật tốt nhất
resource "aws_s3_bucket" "secure_bucket" {
  bucket = "company-secure-data-bucket"

  # Checkov: CKV_AWS_18 - Ensure S3 bucket has access logging enabled
  logging {
    target_bucket = aws_s3_bucket.log_bucket.id
    target_prefix = "log/"
  }
}

resource "aws_s3_bucket_versioning" "secure_bucket" {
  bucket = aws_s3_bucket.secure_bucket.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "secure_bucket" {
  bucket = aws_s3_bucket.secure_bucket.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.bucket_key.arn
    }
    bucket_key_enabled = true
  }
}

resource "aws_s3_bucket_public_access_block" "secure_bucket" {
  bucket = aws_s3_bucket.secure_bucket.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# Quét Terraform files để tìm vấn đề bảo mật
checkov -d ./terraform --framework terraform \
  --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_21 \
  --output sarif --output-file checkov-results.sarif

# Quét Kubernetes manifests
checkov -d ./k8s --framework kubernetes \
  --soft-fail-on LOW \
  --hard-fail-on CRITICAL,HIGH

# SLSA Level 3 compliant build với GitHub Actions
name: SLSA Build

on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
      
      - name: Build artifact
        id: build
        run: |
          npm ci --ignore-scripts
          npm run build
          sha256sum dist/app.js | awk '{print $1}' > digest.txt
          echo "digest=$(cat digest.txt)" >> $GITHUB_OUTPUT
      
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: build-artifact
          path: dist/

  provenance:
    needs: build
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
    with:
      base64-subjects: |
        ${{ needs.build.outputs.digest }} dist/app.js

# Kubernetes Pod Security với Falco rules
apiVersion: v1
kind: ConfigMap
metadata:
  name: falco-rules
  namespace: falco-system
data:
  custom-rules.yaml: |
    - rule: Detect Crypto Mining
      desc: Detect crypto mining processes
      condition: >
        spawned_process and 
        (proc.name in (crypto_miner_names) or
         proc.cmdline contains "stratum+tcp" or
         proc.cmdline contains "pool.")
      output: >
        Crypto mining detected 
        (user=%user.name command=%proc.cmdline container=%container.name)
      priority: CRITICAL
      tags: [crypto, mining, security]

    - rule: Sensitive File Access
      desc: Detect access to sensitive files
      condition: >
        open_read and 
        fd.name in (/etc/shadow, /etc/passwd, /etc/sudoers)
      output: >
        Sensitive file accessed 
        (file=%fd.name user=%user.name container=%container.name)
      priority: WARNING

# Gatekeeper ConstraintTemplate cho container security
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredsecuritycontext
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredSecurityContext
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredsecuritycontext

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.securityContext.runAsNonRoot
          msg := sprintf("Container %v must set runAsNonRoot to true", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.securityContext.readOnlyRootFilesystem
          msg := sprintf("Container %v must use read-only root filesystem", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          container.securityContext.privileged == true
          msg := sprintf("Container %v must not run in privileged mode", [container.name])
        }

# Script để tính toán security metrics
import json
from datetime import datetime, timedelta

def calculate_mttr(incidents: list) -> float:
    """Calculate Mean Time To Remediate for security issues"""
    remediation_times = []
    for incident in incidents:
        detected = datetime.fromisoformat(incident['detected_at'])
        resolved = datetime.fromisoformat(incident['resolved_at'])
        remediation_times.append((resolved - detected).total_seconds() / 3600)
    return sum(remediation_times) / len(remediation_times) if remediation_times else 0

def vulnerability_escape_rate(total_vulns: int, escaped_vulns: int) -> float:
    """Calculate percentage of vulnerabilities reaching production"""
    return (escaped_vulns / total_vulns * 100) if total_vulns > 0 else 0

def security_coverage(pipelines_with_security: int, total_pipelines: int) -> float:
    """Calculate percentage of pipelines with security scanning"""
    return (pipelines_with_security / total_pipelines * 100) if total_pipelines > 0 else 0