Nothing is exposed directly. Every request crosses a firewall, terminates TLS at a single gateway, and is routed by hostname — so there is exactly one front door to secure and observe.
Reaches *.secdevops.ablecommunity.com over HTTPS. Wildcard DNS → one public IP.
Only ports 80/443 forwarded inbound. SSH & host management restricted to the protected management IP.
Forwards :80/:443 into the cluster gateway. Management plane (K8s API, Cockpit) never leaves the host network.
TLS terminates here. Let's Encrypt certificate for all hostnames. Host-based routing sends each name to the right service. Admin API is internal-only.
Each service in its own namespace with a default-deny network policy — services can only talk to what they explicitly need.
This is the "Sec" in SecDevOps: security is built into every step of shipping software, not bolted on at the end. A change cannot reach the cluster without passing the gates.
Developer pushes to GitLab.
🔐 SSO login (Keycloak + MFA)GitLab CI builds & tests the change.
🔐 SAST · dependency & secret scanContainer built, scanned, pushed to the registry.
🔐 Vulnerability scan · cosign signatureArgoCD syncs the declared state from Git.
🔐 Git is the single source of truthKyverno checks every manifest before it runs.
🔐 Policy-as-code gateWorkload runs in K3s.
🔐 Falco runtime detection · NetworkPolicyFour platform-wide capabilities every service depends on — the reason the pieces behave as one system.
One login for every tool. Users authenticate once via OIDC; their group decides what they can do in each service. Privileged groups are forced through multi-factor authentication. No per-app passwords.
Central, encrypted secret store. Auto-unseals on boot, holds credentials and TLS material, and is itself snapshotted nightly. Privileged operations require a separate break-glass credential.
Metrics from every component feed Grafana dashboards; Falco streams runtime security events. You can see health, load, and threats in one place — see the Platform Overview dashboard in Grafana.
Nightly backups of Vault, GitLab, Keycloak, the gateway config and the cluster — kept on a separate disk, with a documented, drill-tested restore procedure. The platform also self-heals on reboot.
Eight web interfaces, one gateway, one identity. All reachable at <name>.secdevops.ablecommunity.com.
Source code, CI/CD pipelines, container registry.
GitOps delivery — deploys what Git declares.
Cluster & workload management UI.
Identity provider — SSO, groups, MFA.
Secrets management & encryption.
Dashboards, metrics, alerting.
Agentic / AI Model-Context-Protocol service.
Host management (gated). Root-level — extra auth layer.
Security isn't a stage — it's present at every layer. Each row is a control that is already enforced, not aspirational.
| Layer | Security control | What it prevents |
|---|---|---|
| Identity | OIDC single sign-on + MFA on privileged groups | Shared/weak passwords; unauthorised admin access |
| Network | Default-deny NetworkPolicies per namespace | Lateral movement between compromised services |
| Perimeter | Single TLS gateway; management plane isolated | Direct exposure of databases, APIs, admin ports |
| Supply chain | SAST + image scanning + cosign signing in CI | Vulnerable or tampered code & images reaching prod |
| Admission | Kyverno policy-as-code | Non-compliant workloads ever starting |
| Runtime | Falco behavioural detection | Undetected intrusions & anomalous activity |
| Secrets | Vault with separation of duties | Secrets in code, configs, or Git history |
| Recovery | Nightly backups + tested restore + reboot self-heal | Permanent data loss; long outages |