DevSecOps with GitLab
Develop securely & deploy automatically
Every commit becomes an automated, tested, and traceable release. Security is not an afterthought here, but rather an integral part of the CI/CD pipeline.
From Commit to Release
Every change automatically goes through build, test, and deployment. No more manual piecing together.
Security in the Pipeline
Scans for code, dependencies, and containers run automatically. Security is shifting to the left (Shift Left).
A platform
Code, CI/CD, registry, and permissions—all in one place in GitLab, rather than scattered, siloed solutions.
Traceable & auditable
Every step is logged: who made which change, when, and how it was deployed.
All the way to the workplace
Pipelines are integrated with the target environment—often Kubernetes—and deployments run in a reproducible manner rather than manually.
All in one place
Consulting, setup, and operation—including as a managed service through NETWAYS Managed Services—and training for your team provided by NETWAYS.
Every manual step is a risk
If releases involve manual work and security isn’t addressed until the very end, every deployment becomes a risk and the supply chain remains opaque.
Manual, error-prone releases
Manual deployments—each one a little different. This takes time and leads to errors that aren’t noticed until the production stage.
Safety Comes Too Late
Security checks only at the end—or not at all: Vulnerabilities in code and dependencies don’t become apparent until it gets costly.
Disconnected, Stand-Alone Solutions
Code here, pipelines there, tickets somewhere else. Without an end-to-end supply chain, there is no common thread from commit to production.
How we work with you
Four steps, the same for every NETWAYS solution: We start with your repositories and end with a secure, automated release into production.
Analysis & Concept
We'll take a look at repos, build and deploy processes, the target environment, and security requirements, and plan the appropriate pipeline.
→ A pipeline that fits your tech stack and level of maturity.
Setup & Integration
We'll set up GitLab as our central platform, build the CI/CD pipelines, and integrate security scans and a container registry.
→ Every commit becomes an automated, tested process.
Commissioning & Deployment
Go-live: Deploy the pipelines to the target environment (often Kubernetes) in a reproducible manner, including approvals and rollbacks.
→ Reliable, repeatable releases instead of worrying about the next deployment.
Support & Operations
Upon request, we can fully manage the platform—including as a managed service through NETWAYS Managed Services—or we can assist your team with support and training.
→ A stable supply chain without having to build an in-house platform team.
What Your Pipeline Does
Build, Test, Security, and Deployment are interrelated and can be implemented in stages.
Build & Test
Every commit is automatically built and tested. GitLab CI and parallelized runners ensure fast feedback.
Result: Errors are detected early and in a timely manner.
Check Security
SAST, dependency, and container scans run automatically as part of the pipeline; security is shifted left.
Effect: Vulnerabilities are identified before the release.
Deliver & Release
Deployment to the target environment typically involves stages, releases, and rollbacks, often to Kubernetes via GitOps.
Result: Reproducible releases instead of manual work.
Understand & Ensure
Artifacts, signatures, and logs document the entire supply chain from commit to the current release.
Result: You can verify at any time what was delivered.
Here’s how you can achieve that with DevSecOps
Faster & More Secure Delivery · FullTraceability
Faster Delivery
From weeks-long release cycles to one-click deployment: more releases with significantly less manual effort.
Deliver more securely
Security is an integral part of the pipeline; it is not an afterthought. Vulnerabilities are detected before they go live.
Full Traceability
Every step is documented. Good for audits, troubleshooting, and the software supply chain.
This is how your solution is built
Tried-and-true open-source components for your DevSecOps. Operated either in-house or through NETWAYS Managed Services. You decide what you’ll do yourself and what we’ll take care of.
Gitlab
Kubernetes
A common deployment environment: Pipelines are deployed to the cluster in a reproducible manner using GitOps, with stages, approvals, and rollbacks.
Prometheus
Collects metrics from pipelines and deployed applications. It therefore serves as the data foundation for the feedback loop following the release.
Grafana
Provides visibility into deployment frequency, error rates, and the status of releases. Development and operations are thus on the same page.
We’ll integrate what you’re already using with
The pipeline integrates code, security, and the target environment. A selection of the building blocks we use to build DevSecOps setups.
Code & Repos
- GitLab
- Git
- Merge Requests
- Code Review
Security (DevSecOps)
- SAST / DAST
- Dependency Scanning
- Container Scanning
- Secret Detection
Operation & Feedback
- Prometheus
- Grafana
- Alerting
- NMS Cloud (EU)
CI/CD & Build
- GitLab CI
- Runner
- Container Registry
- Artifacts
Deployment & Objective
- Kubernetes
- Helmet
- GitOps (Argo CD / Flux)
- Docker
Questions & Answers
Frequently Asked Questions About This Solution
What is DevSecOps?
DevOps vs. DevSecOps – What's the Difference?
How do I build a CI/CD pipeline?
Essentially, you define stages for build, test, security scan, and deployment that are automatically run with every commit. In GitLab, this is done through a pipeline definition in the repository, which is executed by runners. NETWAYS works with you to determine the appropriate steps, sets up the pipeline, and integrates it with your target environment.
What is GitLab CI/CD?
GitLab CI/CD is the automation for building, testing, and deploying that is integrated into GitLab. Pipelines are defined right next to the code and are executed by GitLab runners. Security scans, container registries, and permissions are all part of the same platform; no additional tools are required.
What is the difference between CI and CD?
Continuous Integration (CI) involves merging changes frequently and automatically building and testing the code. Continuous Delivery or Deployment (CD) builds on this and automatically deploys verified builds to test or production environments; in the case of Continuous Deployment, this is done entirely without any manual intermediate steps.
Is DevSecOps also possible with Kubernetes and as a managed service?
Yes. The pipelines are typically deployed to Kubernetes via GitOps, either to your environment or as Managed Kubernetes via NWS. If you'd like, NETWAYS can manage the entire platform, leaving you free to focus on development.
Which security scans should be included in a DevSecOps pipeline?
Typical examples include SAST for your own code, dependency scanning for external libraries, container scanning for images, and secret detection to prevent accidentally checked-in credentials. All four run automatically with every commit or merge request.
Do I absolutely need Kubernetes for DevSecOps?
No. Kubernetes is the most common target environment for which we build pipelines, but DevSecOps with GitLab works just as well with other deployment targets. We'll work around your existing infrastructure.
