Cloud & DevOps
Kubernetes in Production: A Readiness Checklist
Getting a Kubernetes cluster running takes an afternoon. Running it safely in production takes discipline. A checklist for security, reliability and operations.
Key takeaways
- Automate security checks at every pipeline stage.
- Fail builds only on high-confidence, high-severity findings to avoid alert fatigue.
- Secure the pipeline itself — it is a privileged target.
- Generate SBOMs to understand and manage open-source risk.
Security at every stage
| Stage | Control | Purpose |
|---|---|---|
| Code | IDE plugins, pre-commit secret scanning | Catch issues before commit |
| Build | SAST, software composition analysis | Code flaws and vulnerable libraries |
| Package | Container image scanning, SBOM generation | Known vulnerabilities and inventory |
| Infrastructure | IaC scanning | Misconfigurations before deployment |
| Test | DAST, API security testing | Runtime vulnerabilities |
| Deploy | Signed artefacts, policy gates | Only approved artefacts reach production |
| Run | Runtime protection, monitoring | Detect exploitation |
Keeping developers on side
- Start in "report only" mode and tune rules before blocking builds.
- Fail builds only for high-confidence critical issues.
- Show findings in the developer's existing tools with fix guidance.
- Give teams security champions and short secure-coding training.
Securing the pipeline itself
CI/CD systems hold credentials to production. Protect them with MFA, least-privilege service accounts, short-lived tokens, protected branches, mandatory code review and isolated build runners. Supply-chain attacks increasingly target build systems rather than applications.
Software supply chain
Generate a software bill of materials (SBOM) for every release, monitor dependencies for new vulnerabilities and pin versions. Frameworks such as SLSA describe maturity levels for build integrity.
Metrics
Track mean time to remediate vulnerabilities by severity, percentage of repositories with scanning enabled, critical issues reaching production and pipeline lead time — security should not materially slow delivery.
Compliance alignment
NCA ECC and NCA CCC include secure development and change management expectations. Pipeline evidence — scan results, approvals and signed artefacts — provides strong proof of compliance.
A rollout plan
| Month | Focus |
|---|---|
| 1 | Secrets scanning and SCA on all repositories |
| 2 | SAST tuned for main languages; IaC scanning |
| 3 | Container scanning, SBOM generation, signed artefacts |
| 4+ | DAST, policy gates and security champions programme |
How NAZZTEC helps
We assess pipelines, implement tooling and policy gates, and train teams — balancing security with delivery speed.
Next step: our Cloud & DevOps and Software Solutions teams implement secure pipelines.
Frequently asked questions
Which tool should we start with?
Secrets scanning and software composition analysis usually deliver the fastest risk reduction with low noise.
Does DevSecOps replace penetration testing?
No. Automated testing finds common issues continuously; skilled penetration testers find logic flaws and chained attacks.
What is an SBOM?
A software bill of materials lists all components and dependencies in an application, enabling rapid response to newly disclosed vulnerabilities.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
