DevSecOps
Private AKS with Hub Firewall and Bastion
A private AKS cluster in a spoke: Azure Firewall controls traffic in and out, admins come through Bastion.
The cluster's API server and nodes have no public addresses. Inbound traffic reaches workloads through firewall DNAT rules; route tables send all outbound traffic to the firewall, which allows only approved domains. Admins use Bastion and a jumpbox; PaaS sits behind private endpoints.
Point at a component to light its links; select it for what it does here and the practice that makes it right on Azure.
When to use it
- Regulated workloads (health, finance) where no cluster part may face the internet
- Security teams that must log and approve every outbound destination
- Several spokes sharing one inspected way in and out
How NGT delivers it
Built from code, reviewed at a gate by an NGT architect, and handed over with runbooks your team can run.
DevSecOps
