Hardened Kubernetes and a DevSecOps pipeline
- Context
- Personal project
- Year
- 2026
Ongoing - Stack
- Kubernetes (AKS)
- Docker
- Terraform
- GitHub Actions
- Trivy
- Python
- FastAPI
- Links
A Kubernetes deployment where security gates every release: a vulnerable image never reaches the cluster.
What I built
- A hardened container: runs as non-root with Linux capabilities dropped.
- An AKS deployment with two replicas, a token-less ServiceAccount and least-privilege RBAC.
- A GitHub Actions pipeline: tests, build, then a blocking Trivy scan. The SARIF report lands in GitHub Security.
- All infrastructure in Terraform: AKS and ACR linked through a managed identity, with no secret to store.
Architecture
- 01Tests
- 02Buildnon-root Docker image
- 03Trivyblocking scan, SARIF report
- 04ACRprivate registry
- 05AKS2 replicas, least-privilege RBAC