Lesson 4 : Networking & Security

Security Forge Platform — Architecture Reference

Internal production documentation for the multi-tier log analytics and security control plane deployed on Kubernetes.

System Scope

• Application tier (security-forge): API Gateway, log ingestion, query API, vault simulator, RBAC validator, audit service, secrets rotation, and the operations dashboard — baseline Pod Security Standard.

• Payment processing tier (security-forge-payment): log processor with restricted Pod Security Standard and PCI-oriented security context.

• Runtime detection tier (security-forge-runtime): Falco DaemonSet, security event processor, incident response controller, and threat simulator — privileged Pod Security Standard where kernel-level visibility is required.

• Team isolation namespaces (sf-analytics, sf-devops, sf-developers, sf-auditors): RBAC-scoped ServiceAccounts enforcing least-privilege access across tenant boundaries.

• Fault injection lab (security-forge-debug): intentionally misconfigured networking manifests for operator diagnostics training.

Operational Context

At scale, Kubernetes reconciles capacity contracts, not containers. When ingestion volume spikes during a rollout or regional failover, Pending pods indicate admission control — nodes at allocatable limits — not scheduler failure. Unconstrained Deployments with missing resource requests get placed, then OOM-killed under load, producing restart storms indistinguishable from application defects.

Production teams treat the cluster as a distributed constraint solver: networking identity, storage topology, and blast-radius boundaries are first-class design inputs. Explicit trade-offs apply throughout this platform: default-deny networking versus operational friction; restricted pod contexts versus compatibility with legacy images; hot-reloaded secrets versus rotation blast radius; runtime syscall visibility versus privileged namespace exposure.

Architectural insight: The control plane optimizes for cluster stability, not application latency. Service objectives must align with Kubernetes primitives — additional replicas cannot compensate for incorrect resource requests or missing disruption budgets.

Namespace Segmentation and Blast Radius

Workloads partition across namespaces that define NetworkPolicy enforcement scopes and RBAC boundaries — not organizational hierarchy.

Trade-off: Consolidated namespaces reduce operational overhead; granular namespaces tighten lateral movement after compromise.

Anti-pattern: Deploying security-sensitive workloads into default. A compromised ingestion pod reaching an unscoped metrics admin endpoint requires no additional privilege escalation.

Network Isolation