Policy-Driven Shift-Left Security for Hybrid OpenShift CI/CD Pipelines

This paper presented a policy-driven shift-left security framework for hybrid OpenShift CI/CD pipelines that integrates container vulnerability scanning (Trivy), Kubernetes policy enforcement (OPA/Rego with eight denial rules), and governance tag validation into a unified pre-deployment gate. Through a controlled experiment of 50 pipeline builds per configuration, the framework detected and blocked all 15 insecure builds (8 vulnerable images, 5 policy violations, 2 governance violations) while allowing all 35 compliant builds to deploy, achieving a 100% detection rate with zero false positives. The shift-left pipeline introduces a mean overhead of 28.3 seconds per build, with container scanning accounting for 82.2% of the added time. The results demonstrate that early-stage, automated security enforcement can prevent insecure artifacts from reaching production environments without disrupting legitimate workloads. The layered three-gate architecture provides defense in depth across image vulnerabilities, deployment misconfigurations, and governance metadata, addressing a gap in existing CI/CD security research that has focused on individual controls in isolation.

shift-leftpolicy as codeOpenShiftOPA/Regocontainer security