Network policy, admission control and secrets handling, in the order an auditor asks about them.
Executive Summary
- Default-deny network policy first: an auditor asks what can reach the workload before asking what runs in it.
- Admission control is where policy becomes enforcement - anything documented but not admitted is a recommendation.
- Secrets belong to an external store with short-lived, audited leases, never to a manifest in the cluster.
Where teams usually start
Most teams arrive at this problem from the same direction: something that worked at one scale stopped working at the next, and the fix that used to be obvious no longer is. This guide walks the path we take with clients, in the order we take it.
The approach
Work in slices that can each ship on their own. A slice that cannot be deployed independently is not a slice, it is a phase – and phases are where migrations go to die.
What to measure
Decide the numbers that say it worked before you start, and instrument them first. Retrofitting measurement onto a finished migration tells you nothing about what the migration changed.
Conclusion
None of this is exotic. It is the discipline of small, reversible steps applied to a problem large enough that skipping the discipline is tempting.
