Breakwater

Overview

Secure platform foundations from infrastructure provisioning through workload delivery.

Problem

Platform teams need secure, repeatable AKS foundations that cover identity, deployment guardrails, supply-chain checks and operational reliability without relying on ad-hoc manual steps.

Engineering Goals

• Codify AKS, ACR, identity and Key Vault integration with reusable Terraform modules.
• Enforce secure workload guardrails before deployment.
• Keep delivery Git-native and auditable with environment-specific GitOps manifests.
• Include reliability and security checks as blocking CI gates.

Architecture

• Terraform modules for AKS, ACR, Key Vault, managed identity and RBAC.
• Helm chart for secure workload runtime defaults and observability resources.
• Argo CD applications for dev/prod environment reconciliation.
• Kyverno policies for workload, runtime and supply-chain admission controls.

Key Engineering Decisions

• Use GitHub OIDC workflow design for Azure authentication without long-lived client secrets.
• Bind Kubernetes ServiceAccount identity to Azure UAMI through workload identity federation.
• Model policy-as-code with positive and negative test fixtures in CI.
• Treat high/critical vulnerability scanning as fail-closed by default with explicit, time-bound exceptions.

Security / Reliability Controls

• Kyverno rules for privileged containers, host namespace usage, latest tags and unapproved registries.
• Trivy IaC/filesystem/image scans and CycloneDX SBOM generation.
• Immutable image digest support in Helm deployment values.
• Prometheus SLI/SLO recording rules and burn-rate alert tests via promtool.

Validation / Testing

• terraform fmt/init(validate backend=false)/validate for dev and prod.
• tflint checks against shared Terraform lint policy.
• helm lint and rendered manifest checks.
• kyverno test and promtool test rules in CI-compatible flow.

What This Demonstrates

• Platform engineering foundations for AKS.
• Secure delivery and policy enforcement discipline.
• Operational reliability thinking with measurable SLOs.