# Securing GitOps pipelines

[Grab](https://yomu.fyi/company/grab) · Thang Le · Mar 1, 2023

**Type:** Problem & solution

## Summary

Grab's real-time data platform team transitioned from an Atlantis-driven Terraform workflow to an in-house GitOps platform called Khone to manage streaming infrastructure resources like Kafka topics and Flink pipelines. The earlier setup suffered from coarse-grained access controls, required manual merge request comments, and lacked flexible validation capabilities within native configuration files. Khone derives environment parameters directly from standardized directory paths and uses Python with the python-hcl2 library to inspect and validate resource definitions before executing Terraform stages in parallel. To prevent configuration tampering in merge requests, CI/CD pipeline definitions and execution scripts are isolated in a separate administrative repository and fetched during job runs using shallow Git clones.

## Context

Grab's data platform team experienced limitations with their Atlantis-based Terraform automation, including coarse-grained access controls that allowed unintended resource creation, manual merge request comment requirements, restricted HCL validation capabilities, and boilerplate code across projects.

## Approach / What changed

The team built an in-house GitOps platform named Khone that derives configurations from directory paths, validates HCL definitions using Python scripts and python-hcl2, executes parallel Terraform plan and apply jobs, and stores pipeline configurations and execution scripts in a separate private repository.

## Takeaways

- Khone derives parameters like Kafka broker endpoints and validates inputs by encoding properties such as namespace, resource type, environment, and cluster name directly into directory paths.
- Pipeline tampering is prevented by isolating GitLab CI configuration files and validation scripts in a separate administrative repository and shallow-cloning them during job execution.
- HCL source code is inspected using the python-hcl2 library to validate module sources, enforce resource whitelists, and restrict resource types without relying on native HCL functions.

**Tags:** [CI/CD](https://yomu.fyi/topic/ci-cd), [Deployment](https://yomu.fyi/topic/deployment), [Kafka](https://yomu.fyi/topic/kafka), [Python](https://yomu.fyi/topic/python), [Streaming](https://yomu.fyi/topic/streaming)

[Read original post](https://engineering.grab.com/securing-gitops-pipeline)