ashishdhawal/devsecops-iacrunner repository overview

devsecops-iacrunner is a portable multi-architecture DevSecOps execution runtime designed for Terraform/IaC security validation pipelines across local development, Kubernetes delegates, and CI/CD platforms like Harness.

The goal was to eliminate “works on my machine” inconsistencies by packaging all required IaC, Kubernetes, cloud, security, and policy tooling into a single reproducible execution image.

The image was built and tested for both ARM64 and AMD64 architectures using Docker Buildx, enabling consistent execution from Apple Silicon developer laptops to enterprise Kubernetes runners.

Core capabilities include:

Terraform validation and plan execution Static and evaluated-plan security scanning using Checkov Policy-as-Code enforcement using Open Policy Agent and Rego Kubernetes and GitOps tooling via kubectl, Helm, and Flux Container and dependency scanning via Trivy Artifact signing and verification using GPG Cloud CLI integrations for Azure and AWS workflows

A key architectural decision was separating live infrastructure planning from security validation.

Instead of exposing sensitive Azure credentials directly into the CI/CD platform, Terraform plans can be generated locally or in controlled environments, converted into sanitized JSON artifacts, and then evaluated offline inside the pipeline using Checkov and OPA policies.

This creates a cleaner security boundary while still demonstrating full CI/CD governance, policy enforcement, and DevSecOps orchestration.

The runtime was integrated with Harness running on Kubernetes delegates, where the pipeline successfully:

Pulled the custom image Cloned GitHub repositories Executed Terraform validation Performed Checkov scans Evaluated Rego policies through OPA Supported artifact signing workflows

The project also establishes a clean operational separation: Rego functions → reusable policy utilities Rego rules → enforcement logic Harness → orchestration layer Custom image → portable execution runtime