Skip to content
Techstream

Vol. III

Cloud-Native Security for DevSecOps

Zero trust, Kubernetes hardening, IaC security and compliance automation

Vol. III

§ 01, What it's about

Zero-trust architecture, Kubernetes hardening, infrastructure-as-code security and compliance automation, with evidence mapped to ISO 27001, SOC 2, PCI DSS and DORA. The compliance part is the Compliance Automation Framework explained at length.

§ 02, What I want the reader to be able to do

  1. 01

    Harden a Kubernetes cluster and show which control covers which risk.

  2. 02

    Keep infrastructure code scanned, policy-checked and free of secrets.

  3. 03

    Map a control to ISO 27001, SOC 2, PCI DSS or DORA and collect its evidence from the pipeline.

§ 03, The diagram I keep coming back to

Scrolls sideways →

Cloud-native securityKubernetes clusterprod namespacepodapp:v2podsidecarpodenvoyOPA Gatekeeperadmission policyFalcoruntime alertsstaging namespacepodtest-apppodmock-svcNetworkPolicyingress / egress rulesmTLSService mesh (Istio / Linkerd)mTLS between pods · SPIFFE identityRBAC + Pod Security Admissionleast-privilege rolesExternal Secrets Operator → Vaultsecrets never in etcd plaintext
Figure, Volume III: a hardened cluster, with admission policy, runtime detection, network policy, a service mesh and secrets kept out of etcd.

§ 04, Planned structure

  1. Part I

    Zero trust architecture

    Workload identity, mutual TLS and just-in-time access, applied to cloud-native systems.

  2. Part II

    Kubernetes security engineering

    Hardened images, pod security standards, admission policy, runtime detection and network policy.

  3. Part III

    Infrastructure as code security

    Scanning and policy for infrastructure code, secrets kept out of it, and drift caught before it matters.

  4. Part IV

    Compliance automation

    A continuous compliance pipeline, with controls mapped to ISO 27001, SOC 2, PCI DSS and DORA and evidence collected as a side effect.

§ 05, When it's readable

This volume is being written. Leave your email and I’ll send one message when it’s readable.

One email when it's readable.

← All six volumes