Pipeline to Runtime
A series on securing every stage of software delivery — from the first commit to the running cluster. Each part builds on the last: we start where code is built, then gate what gets deployed, then lock down what's already running. Best read in order.
-
Mar 2026 · Part one — secure the pipeline
Building org-wide, self-service security pipelines with reusable Harness templates
How we replaced inconsistent, team-by-team CI/CD security with versioned, account-level templates that every pipeline inherits automatically — so secret scanning, SAST, and image scanning happen by default, not by request.
-
Jul 2026 · Part two — gate the deploy
Policy-as-Code Gates: Blocking Bad Deploys Before They Ship
How we used OPA and Kyverno to turn security policy from a document nobody read into an automatic admission gate — privileged containers, unsigned images, and root access blocked before they ever reach production.
-
Sep 2026 · Part three — lock down runtime
Network Policies: Default-Deny Without Breaking Everything
How we rolled out default-deny Kubernetes NetworkPolicies across namespaces — observing real traffic first, so the gates didn't take down production — and made lateral movement structurally impossible.
What's next in this series
IP-and-port rules get us containment, but they're still coarse. Coming next: identity-aware policy — moving from "anything in namespace A may reach port 443" to workload identity, so rules say which service may talk to which service. After that: SLSA-style provenance, to close the supply-chain loop from signed images to verifiable build attestations.
New notes land every couple of weeks. Follow along via RSS.
Questions about the series, or a topic you think it should cover? Get in touch.