Cloud-Native Security

• Image-to-prod is now minutes, so security must live in pipelines and admission controllers, not checklist reviews.
• Ephemeral workloads remove the 'patch the VM on Friday' model; the artifact must be clean before it spawns.
• Misconfiguration is the number one cloud breach cause; policies enforced as code beat lengthy human review.

A single gate check misses threats that only appear mid-flight; runtime signals matter as much as admission.

• Build-time: SBOMs, scans, and signed images create a verifiable software supply chain.
• Admission: policy engines (Kyverno, OPA) evaluate every workload manifest against security rules before it schedules.
• Runtime: eBPF-based agents observe syscalls, network, and file activity to catch behavior scans miss.
• Serverless: functions are sandboxed but still need least-privilege roles and secrets hygiene.

• A platform rejects any image without an SBOM and a valid signature at admission time.
• A team auto-scans merges on main and blocks the pipeline when critical CVEs appear.
• A cluster runs eBPF detection that alerts on a container suddenly reading /etc/shadow.

• Sign images and require the admission policy to verify the signature and attestations.
• Pin base images and rebuild on a cadence; do not let image drift grow silently.
• Enforce least-privilege for functions and service accounts; scope secrets to what a workload truly needs.
• Feed runtime detections back into image and policy fixes, closing the loop to the artifact.

• Scanning images only at build and never revisiting them as new CVEs ship.
• Admission policies that gate on image age but verify nothing about provenance.
• Running containers privileged or with the full service-account token by default.
• Serverless functions given broad IAM roles 'because they are short-lived'.

• When a pod is denied, read the admission webhook response: it names the exact rule violated.
• Chase 'image not found' image-pull errors to tag drift and registry auth before blaming the cluster.
• Layer runtime alerts: first correlate to the image/version, then to the SBOM entry.

• The registry and the CI system are now trust anchors; secure and monitor them as such.
• eBPF agents have kernel-level reach; scope them to the cluster and their data plane carefully.
• Provenance only helps if workloads actually attest — skip verifying signatures and you reverted to checkboxes.