Cloud & DevOps
DevSecOps: Building Security into the CI/CD Pipeline
Security that arrives at the end of a project arrives too late. How to build automated checks into every stage of the pipeline while keeping developers productive.
Key takeaways
- Prefer managed Kubernetes unless you have strong reasons not to.
- Lock down RBAC, network policies and pod security from day one.
- Observability, backup and upgrade processes are not optional.
- A platform team with golden paths makes Kubernetes usable for developers.
Security
- Use managed control planes (AKS, EKS, GKE, OKE) with private API endpoints.
- Enforce RBAC with least privilege and integrate with your identity provider.
- Apply Pod Security Standards to prevent privileged containers.
- Define network policies — default deny between namespaces.
- Scan images and allow only signed images from trusted registries.
- Store secrets in an external secrets manager, not plain Kubernetes secrets.
Reliability
- Set resource requests and limits for every workload.
- Configure liveness and readiness probes.
- Use pod disruption budgets and spread replicas across zones.
- Autoscale pods and nodes based on real metrics.
Observability
| Signal | Tooling examples |
|---|---|
| Metrics | Prometheus-compatible monitoring |
| Logs | Centralised logging with retention policy |
| Traces | OpenTelemetry instrumentation |
| Alerts | SLO-based alerting routed to on-call |
Operations
- Back up cluster state and persistent volumes; test restores.
- Plan upgrades — Kubernetes releases minor versions regularly and support windows are limited.
- Manage configuration with GitOps for auditability and drift control.
- Document runbooks for common failures.
Platform engineering
Developers should not need to be Kubernetes experts. A platform team provides golden paths — templates, pipelines and guardrails — so teams can deploy securely with minimal friction.
Cost
Track utilisation per namespace, rightsize requests, use spot or preemptible nodes for tolerant workloads and remove idle environments.
Multi-tenancy
Decide early whether teams share clusters or get their own. Shared clusters need namespaces, quotas, network policies and RBAC per team; separate clusters offer stronger isolation at higher cost.
Disaster recovery for Kubernetes
| Element | Approach |
|---|---|
| Cluster configuration | Stored in Git; recreated through GitOps |
| Persistent data | Volume snapshots and application-consistent backups |
| Secrets | External secrets manager with its own DR |
| Container images | Replicated registry |
Compliance
Map cluster controls to CIS Kubernetes benchmarks, ISO 27001 and SOC 2, and keep evidence of configurations and scanning.
How NAZZTEC helps
We design and build production Kubernetes platforms on AKS, EKS, GKE and OKE, implement GitOps and security controls, and provide managed operations.
Next step: talk to our Cloud & DevOps team about Kubernetes platform builds and managed operations.
Frequently asked questions
Should we run Kubernetes ourselves or use a managed service?
For most organizations, managed services reduce operational burden and risk significantly.
Is Kubernetes right for every application?
No. Simple applications may be better served by PaaS or serverless options.
How often should clusters be upgraded?
Plan to stay within supported versions, which typically means upgrading at least a few times a year.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
