Security baseline

The baseline is the floor. Nothing deploys below it. Going further is encouraged; going under is blocked.

Containers

Nothing runs as root, and the root filesystem is read-only.

securityContext:
  runAsNonRoot: true
  runAsUser: 1001
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop: ["ALL"]
  seccompProfile:
    type: RuntimeDefault

Secrets

Secrets live in Vault and reach the pod through a sidecar. Never in the repository, never in a ConfigMap, never baked into an image's environment.

resource "vault_kv_secret_v2" "payments_db" {
  mount = "kv"
  name  = "payments/production/database"
 
  data_json = jsonencode({
    username = var.db_username
    password = var.db_password
  })
}

A local hook scans for secrets before anything is committed:

gitleaks protect --staged --redact --verbose

Pipeline gates

Security that engineers route around is not security. If a gate produces false failures a few times a week, tune it or delete it — before someone learns to ignore it.

Network

Every namespace denies ingress by default. Access is opened explicitly, per source.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes: ["Ingress"]