Secure Kubernetes Deployment Platform

Designed and built end-to-end during my final-year internship at TEAMWILL (July–August, 2 months). Nothing existed at the start — no cluster, no CI/CD chain, no security policies.

The Problem:

Deploying to Kubernetes guarantees nothing on its own. A container can run as root, an image can ship vulnerable dependencies or a leaked secret, a compromised pod can act freely once it is running, and nothing ties what runs in the cluster back to what was actually reviewed and approved. Security usually arrives after deployment, in the form of an audit — which is too late.

The Solution:

A nine-phase platform where security applies at every stage of the lifecycle, and where each control blocks the next:

• At commit: tests, dependency scanning, secret scanning, and infrastructure-as-code analysis — four surfaces, all blocking

• At build: image built without a privileged container, tagged with the commit SHA, and scanned before it is ever published

• At admission: Pod Security Standards and five Kyverno policies in enforce mode — a non-compliant object never exists in the cluster

• At deploy: GitOps through Argo CD, self-healing, triggered by an internal event rather than periodic polling

• At runtime: real-time intrusion detection with Falco, classified against MITRE ATT&CK

• Continuously: metrics, application logs, and security alerts brought together in a single interface

Technical Highlights:

• The pipeline holds NO cluster credentials — its only write is a commit to the GitOps repository. The in-cluster agent pulls and applies, a complete inversion of the classic deployment model

• Zero manual kubectl apply after the initial bootstrap: adding a component comes down to adding one YAML file (app-of-apps pattern)

• Image builds with no Docker daemon and no privileged container — the pipeline obeys the same policies it enforces on everything else

• In-cluster webhook instead of Internet exposure: the CI runner lives in the cluster and posts the event internally, leaving no exposed surface

• Runtime detection through a modern eBPF probe, with no kernel module compilation

• No credentials in version control: five bootstrap secrets only, each with a single scope, all kept out of Git

• Sixty-five automated checks replayable on demand — one validation script per phase plus a global orchestrator

Measurable Results:

• A third-party application (NestJS + MongoDB), developed independently and deployed onto the platform, had four defects surfaced before it ever started: a container running as root (refused at admission), an unresolved dependency conflict, a desynchronized dependency lock, and an incomplete install script

• The pipeline blocked that same application on 55 vulnerabilities, two of them critical: remote code execution (handlebars) and script injection (fast-xml-parser). After remediation: 10 residual vulnerabilities, each documented or waived with justification

• Deployment latency brought down from roughly three minutes to seconds by moving from polling to event-driven delivery

• The cluster was lost twice during the project; both times the platform rebuilt itself entirely from Git, with no intervention beyond recreating the bootstrap secrets