How do you implement security requirements in CI/CD while taking care of security requirements? What are best practices here?
Security requirements may differ, let's assume this simple level of security:
- Direct administrative access to target system shouldn't be given to the CI/CD system
- CI/CD system needs to be able to initiate deployment and show it's success/fail status (could be determined by a white box test routine i.e. without admin access rights placed on the CI/CD side)