Continuous Delivery · Audit 2026-04-13

DevSecOps Pipeline

From commit to production — GitLab CE 18.x → Trivy scan → Vault secret inject → regis.onelabs.work registry push → Argo CD v3.3.6 GitOps deploy → AWX 149 playbooks. All images signed and scanned before deploy.

CI/CD Stages

8-Stage Pipeline

01
Source
GitLab CE 18.x
Feature branches
MR + CODEOWNERS
2 approvals min
02
CI Trigger
GitLab CI
.gitlab-ci.yml
K8s executor
Parallel jobs
03
Scan
Trivy
Container CVE
IaC misconfig
Secret detect
04
Secrets
Vault PKI
Dynamic creds
Code signing
Token inject
05
Build & Push
Docker Build
→ regis.onelabs.work
/soc/onelabs/…
Internal CA baked
06
Deploy
Argo CD v3.3.6
GitOps sync
Health check
Auto rollback
07
Observe
Prometheus+Loki
Metrics scrape
Log shipping
Alert firing
08
Automate
AWX 149 PBs
Event-driven
Discord notify
Audit spool JSON
Tool Details

GitLab · Argo CD · AWX — Real Data

GitLab CE 18.x
AuthAuthentik OIDC SSO
Image path/soc/onelabs/security/
Infra path/soc/onelabs/infra/
CODEOWNERS2 approvals min
CI runnerK8s executor
Docs174 docs · 16 systems
Argo CD v3.3.6
Chartargo-cd-9.5.0
Helm rev1 · deployed
Namespaceargocd
Ingress TLSwildcard-onelabs-tls
Redis HA3 servers · 3 haproxy
Repo servers2 pods (soc4 + soc6) · ⚠ 125 restarts each
Updated2026-04-13 22:42:28
Playbooks149 (0 YAML errors)
Librarysaza_playbooks_full_v4
NotifyDiscord + spool JSON
Color codeStage-aware severity
RBACClusterRoleBinding admin
Spooldelegate_to: localhost
Audit payloadAWX Job ID + timestamp
🔄 Argo CD Pods — kubectl get pods -n argocd All Running · audit 2026-05-03
PodReadyStatusRestartsNodeIP
argocd-application-controller-01/1Running0soc410.0.x.x
argocd-server-65c457b884-ctcgz1/1Running1soc610.0.x.x
argocd-server-65c457b884-dz47k1/1Running0soc510.0.x.x
argocd-redis-ha-server-0/1/23/3 eachRunning0soc5/soc6/soc4HA cluster
argocd-repo-server ×21/1Running125soc4 + soc610.0.x.x / 10.0.x.x
Automation Library

AWX Playbook Categories — 149 Total

28
Infrastructure
Node bootstrap · Talos config
K8s upgrade · Cert rotation
22
DevSecOps
GitLab config · Registry cleanup
Argo sync · Image scanning
31
SOC Automation
Alert triage · Case creation
IoC enrichment · Block IP
18
Secrets & PKI
Vault seal/unseal · Cert issue
Secret rotation · Audit
24
Compliance
CIS benchmark · FIM check
Policy report · Remediate
26
Storage & Backup
Longhorn snapshot · MinIO sync
Volume resize · Recovery
Notification Sample

Discord Alert Format

# onelabs-alerts · AWX Job #2847
✅ [ONELABS] Cert Rotation — vault.onelabs.work
STATUSSUCCESS
JOB_IDAWX-2847
STAGE03 / PKI Rotate
TARGETvault.onelabs.work
DURATION00:02:14
TIMESTAMP2026-04-13T23:19:05+10:00