Event-Driven GitOps for Continuous STIG-Based Compliance on Regulated Kubernetes Fleets: Measuring Patch Exposure on Amazon Linux 2023

Abstract

Purpose: Federal Kubernetes fleets operating under a FedRAMP High authorization boundary must remain continuously aligned with a Security Technical Implementation Guide (STIG) baseline while also consuming upstream security patches within bounded time. In immutable-infrastructure and GitOps operating models both obligations are discharged by periodic rebuilding of a hardened machine image, yet the rebuild cadence is typically set by organisational convention rather than by the arrival process of the fixes it is meant to consume. This paper measures the exposure and cost consequences of that mismatch for Amazon Linux 2023.

Methodology: Using a dated series of 113 Amazon Linux 2023 security repository releases over a 41-month window, we compare seven trigger regimes — calendar-driven and event-driven — under a phase-averaged exposure model, evaluating both the unpatched exposure window and annualized build cost.

Findings: Repository releases arrive approximately eight times more frequently than the documented quarterly cadence, and an event-driven GitOps trigger dominates every calendar regime evaluated on both exposure and cost. The dominance follows from a structural feature of the arrival process, not from any operational parameter, and is invariant across a twenty-four-fold range of pipeline durations.

Unique contribution to theory, practice and policy: Rebuild cadence is the wrong control variable for continuous compliance in this setting; the relevant variable is whether build issuance is coupled to patch availability. The result gives practitioners and compliance program owners a measured basis for replacing calendar-based rebuild schedules with event-coupled triggers, without incurring the cost penalty of a naive “rebuild more often” strategy.