EnvSecOps: The Obviously Painful Path Forward

Turning “Check the Bag” into a Working System

The idea was simple: verify the bag, not the badge.

The hard part is turning that into a system someone can actually build.

This is the actionable roadmap — not a manifesto, not another “zero-trust” slide.

It’s the pragmatic route to the world described in Check the Bag: a unified model where credentials are issued only if the environment proves itself clean.

Task 1 — Identity & Attestation

Goal: unify workload and environment identity under one auditable standard.

• Evaluate SPIFFE/SPIRE as the Identity Control Plane for all non-human workloads.


• SPIRE becomes the source of truth for what runs where, and under what evidence.


• Attestation plugins can integrate OS, hardware, and custom attributes (like the Nix or devcontainer signature from Task 2).


• Every service, job, or build agent receives its identity through SPIRE issuance.

Outcome: a cryptographically provable binding between a workload and its attested environment.

Task 2 — Reproducible Environments

Goal: make “the bag” reproducible and attestable.

• Stand up a PoC comparing Nix and DevContainers for reproducible dev/runtime environments.


• The output must be deterministic: a Nix closure hash or a signed devcontainer manifest.


• Feed that hash into SPIRE’s attestation selector — so credentials can only be issued if the environment matches a known, reproducible build.


• Document developer workflow friction early; this is where usability sinks most pilots.

Outcome: every environment can prove exactly what it is — not just who’s using it.

Task 3 — Policy

Goal: codify trust decisions in one place.

• Adopt Open Policy Agent (OPA) as the global Policy Decision Point (PDP).


• All attestation, identity, and credential issuance checks route through OPA.


• 
  

  OPA policies evaluate:

  
  
  
  
  
  • whether an environment is in policy,
  
  
  • whether its attestation is valid,
  
  
  • and what privileges the resulting identity should get.
  
  
  
  
  
  




• Extend existing CI/CD gates with conftest for developer feedback loops.

Outcome: the organization’s trust logic is versioned, testable, and enforced everywhere.

Task 4 — Provenance

Goal: link build outputs to their attested inputs.

• Require Sigstore signing for all build artifacts.


• Integrate Sigstore’s Rekor log and Fulcio CA for transparent verification.


• 
  

  Use SLSA v1.0 as the minimum compliance level; pipelines must produce signed provenance linking:

  
  
  
  
  
  • the SPIRE-attested environment (from Task 1–2),
  
  
  • the OPA-approved policy decision (Task 3),
  
  
  • and the final artifact digest.
  
  
  
  
  
  




• Store provenance as evidence, not paperwork.

Outcome: an end-to-end chain of custody — from developer environment to running workload.

Putting It Together

This stack isn’t speculative — it’s all open, CNCF-anchored, and proven at scale.

What’s missing isn’t tech; it’s discipline and integration glue.

Why This Is the Path Forward

Because the opposite has already failed.

• Secrets rotate but drift remains.


• Tokens expire but trust persists unearned.


• “Zero-trust” dashboards glow while production runs on :latest.

This model replaces vibes with verification.

It’s painful, yes — but every painful system you build now prevents a post-incident rebuild later.

RC = 0

You don’t need another framework.

You need fewer excuses.

Identity, Environment, Policy, Provenance — that’s the whole playbook.

Pin them, wire them, and stop pretending automation is trust.