Azure integration
Entra integration, managed identities, Key Vault and control-plane access.
Cloud security
Azure Kubernetes Service security review
Assess AKS identity, cluster policy, networking and workload controls in the context of the Azure tenant. Reduce cloud attack paths without making routine engineering depend on a security ticket.
01 / Scope
Work on the system, not around it.
The engagement starts with the architecture and working constraints already in place. We agree the risky paths, make the changes visible and leave ownership with the team running the system.
Cluster policy
Kubernetes RBAC, admission, pod security and upgrades.
Network
Private cluster design, ingress, egress and network policy.
Workloads
Images, secrets, capabilities, logging and recovery.
02 / Method
Reduce cloud attack paths without making routine engineering depend on a security ticket.
Scope and access are agreed before the work begins. Decisions, changes and residual risk remain visible throughout the engagement.
Map the boundary
Start with evidence, owners and the constraints that shape the safe solution.
Validate the risky paths
Prioritise by practical impact and implement with the people who operate the system.
Implement and verify
Test the changed path, document the decision and hand over a backlog that still makes sense.
03 / What remains
- 01AKS architecture and access map
- 02Azure and Kubernetes findings
- 03Policy, Bicep/Terraform and manifest fixes
- 04Retest and operating checklist
Related work
Continue with the adjacent problem.
04 / Talk to Gritt
What is happening in the system?
Send the cloud, workload or deadline. An engineer will reply and tell you whether this is the right scope.
email