Unit 03 of 03
Infrastructure Posture
The runtime posture of the layer beneath the application is measured with numbers: the lateral-movement pairs closed by service-to-service authentication and the items certificate management adds, the processes that deviate from the baseline in container runtime detection along with false positives and detection latency, the legitimate deployments rejected by admission controller rules and the number of teams affected when moving to enforce mode, the findings returned to application teams and the unowned findings in continuous configuration auditing, and how many days rebuild-based updates cut patch lag to and the disruption they bring in return.
Published Updated
Lessons
- 01 Network Segmentation and Service Zero Trust Lateral movement is counted in service pairs: of the nine services' 72 directed pairs, 52 pass the network policy and only 17 correspond to a legitimate call. One-way transport verification and mutual verification without an allow list close zero pairs; a per-caller allow list closes 35 pairs and brings average reach down from 7.1 to 4.1, but all eight of eight are still reachable from the edge service and the secret store is at most two hops away. The price is 31 certificates, 11,315 renewals a year at a short life, and 3.8 legitimate pairs lost per service. 15 min read
- 02 Container Runtime Detection Four baselines are run on the same cluster over a week of process launch records: the image inventory catches 5 of the 21 anomalous events and misses 16, seven days of learning catches 12 but turns 9 legitimate events into false positives, writing the allow list as pairs brings the false positives down to 4, and writing it as binaries drops the caught events to 6. Detection latency is 17 seconds in stream mode and 47 seconds in batch mode, and only 8 and 6 of the 12 caught events arrive while the process is still running; 90.9% of the 68,746 events the pipeline carries deviates in no baseline, and narrowing the image from 342 binaries to 41 pairs gives the same three numbers without building a learning window. 15 min read
- 03 Admission Controller Ten admission rules are run over 22 cluster objects: of the 35 violations, 22 are defects, 8 are justified needs and 5 are object types the rule does not fit. If enforce mode is switched on all at once, 21 objects are rejected, 5 of them legitimate deployments, and all five teams are affected; when the rules are ordered by defect ratio, the first six rules close 19 of the 22 defects with zero legitimate rejections, and the last three rules reject four legitimate deployments without closing a single defect. An exclusion is 13 rows per object, or 7 rows per namespace covering 38 cells and silently exempting one defect; all ten rules can also run at the pipeline gate, and the defects that can be closed only at the admission gate number 3. 12 min read
- 04 Continuous Configuration Audit The 147 open findings of continuous audit are run through the ownership resolution chain: the owner label resolves 65 of them, namespace ownership 24 and repository path mapping 18, and 40 (27.2%) remain unowned. 81 of the findings fall to application teams and 26 stay with the platform; because the capacity of the 40 unowned findings is zero, the queue grows to 112 in twelve weeks while the backlog of the fixing teams shrinks. 31 of the unowned findings are on resources outside the cluster, and no cluster mechanism can resolve them; 122 of the 147 findings could have been closed at an earlier stage, but for 25 of the 40 unowned findings there is no earlier stage. 14 min read
- 05 Rebuild-Based Update The same base image fix is run on thirty-one replicas by three paths and patch lag is measured in days: in-place patching closes the whole fleet in 5.25 days, but protection disappears after 2.61 days on a replica-weighted average and 72.8% of thirty days is spent open; a rebuild tied to a code change closes the last replica in 14.25 days and the open share is 19.4%; a scheduled rebuild closes all nine services in 1.75 days and brings the open share down to 5.8%. The price is a 31.6% rise in weekly replica restarts, from 73.5 to 96.75; services with two replicas lose half their capacity for ninety seconds on every round. 14 min read