Building PCI Compliant Kubernetes Platforms - Demystified, Fun, and Possible
Talkat Platform Engineering Day North America 2025 · on Monday, 2025-11-10· at 13:30· Building B | Level 5 | Thomas Murphy Ballroom 2-3·
summary
Claims a repeatable PCI path built on GitOps and Zero Trust by provisioning per-tenant clusters with Crossplane + Argo CD and automating RK2 installs via Ansible. Uses Trivy and osquery for continuous vulnerability detection, Cilium + STTO for mesh and pod-to-pod encryption, Hubble for flow visibility, Kyverno to tighten CIS exemptions, and Loki + GitHub Actions for auditable approvals. Platform bundles Kubernetes and component versions as one release, supports releases ~one year, and lets teams opt into upgrades on their schedule.
AI-written summary · about
chapters (13)
- 0:00PCI compliant Kubernetes intro
- 1:08PCI vs Kubernetes culture clash
- 4:38High-level architecture
- 8:25Platform security controls
- 10:52CIS policies with Kyverno
- 12:19Privileged credential monitoring
- 14:24Single sign-on for PCI
- 19:38Shared responsibility model
- 21:26Beyond traditional compliance
- 22:07Control plane change management
- 24:02Kubernetes upgrades and services
- 26:42Vulnerability management
- 28:24Q&A
related talks
22mSecuring Kubernetes
34mKubernetes Hardening for Regulatory Compliance: A Practical Approach
30mSecuring Kubernetes Multi-Tenancy
46mContinuous Kubernetes Security
11mSecuring the Kubernetes Ecosystem
37mAchieving High Security at Scale with Microservices
30mA secure journey on Kubernetes
25mSecuring Kubernetes Multi-Tenancy: Navigating Challenges Through DevSecOps Control and Visibility