This is the capstone. You will build a production-grade cloud-native security platform that combines everything from the previous 15 modules into one integrated architecture. By the end, you will have a complete reference implementation that you can adapt for your organization.
What You Will Build
- SPIRE (Identity): HA deployment with auto-registration and federation
- Envoy + Istio (Zero Trust): Transparent mTLS for all service communication
- OPA Gatekeeper + Kyverno (Policy): Admission control blocking insecure deployments
- Falco + Tetragon (Runtime): Real-time threat detection and enforcement
- Sigstore + SBOM (Supply Chain): Image signing and vulnerability tracking
- Vault (Secrets): Dynamic credentials with SPIFFE authentication
- OpenTelemetry + Grafana (Observability): Security dashboards and alerting
Architecture Decisions
Document your choices: trust domain naming schema, SPIFFE ID path convention, SVID TTL, policy enforcement mode, runtime detection rules, image signing workflow, monitoring thresholds, and incident response procedures.
Attack Simulation
After deployment, simulate attacks to verify your security controls work:
- Deploy a rogue pod — verify it gets no SVID (identity layer)
- Attempt unauthorized API access — verify OPA denies it (policy layer)
- Spawn a shell in a container — verify Falco alerts (runtime layer)
- Deploy an unsigned image — verify Gatekeeper rejects it (supply chain layer)
- Access a service without mTLS — verify Envoy rejects it (zero trust layer)
What This Proves
When you complete this capstone, you can demonstrate: production-grade Kubernetes security, five-pillar defense in depth, attack simulation and containment, security observability and incident response, and architecture documentation for stakeholder review.