---
import Base from "../../../layouts/Base.astro";
---
<Base path="/en/cases/k8s-hardening" title="Case Study – Kubernetes Hardening & GitOps">
  <h1 class="text-3xl font-bold mt-8">Case Study: Kubernetes Hardening & GitOps</h1>
  <p class="mt-4 text-textMuted">Production‑ready K8s setup hardened against CIS, with end‑to‑end policies‑as‑code and GitOps deployments.</p>

  <section class="mt-8 grid md:grid-cols-3 gap-6">
    <div class="p-6 border rounded-brand card">
      <h3 class="font-semibold">Goal</h3>
      <p class="mt-2 text-textMuted">Secure cluster baseline: identity‑centric access, network segmentation, clean supply chain.</p>
    </div>
    <div class="p-6 border rounded-brand card">
      <h3 class="font-semibold">Approach</h3>
      <p class="mt-2 text-textMuted">CIS benchmarks, OPA/Gatekeeper or Kyverno policies, Pod Security Standards, signed artifacts & GitOps (Argo CD).</p>
    </div>
    <div class="p-6 border rounded-brand card">
      <h3 class="font-semibold">Outcome</h3>
      <p class="mt-2 text-textMuted">Reproducible deployments, policy‑compliant releases, auditability and reduced attack surface.</p>
    </div>
  </section>

  <section class="mt-10">
    <h2 class="text-2xl font-bold mb-3">Key metrics</h2>
    <ul class="list-disc pl-6 text-textMuted">
      <li>100% declarative deployments (GitOps, pull‑based)</li>
      <li>~80% of CIS controls automatically verifiable</li>
      <li>Policy breaks prevent risky manifests before rollout</li>
      <li>Signed container images & SBOM for core services</li>
    </ul>
  </section>

  <section class="mt-10 grid md:grid-cols-2 gap-6">
    <div class="p-6 border rounded-brand card">
      <h3 class="font-semibold">GitOps setup</h3>
      <p class="mt-2 text-textMuted">Multi‑stage environments (dev/stage/prod) with branch/tag strategy, Kustomize overlays and PR‑based changes.</p>
    </div>
    <div class="p-6 border rounded-brand card">
      <h3 class="font-semibold">Cluster hardening</h3>
      <p class="mt-2 text-textMuted">RBAC least‑privilege, NetworkPolicies default‑deny, Pod Security, image scanning, secrets management.</p>
    </div>
  </section>

  <div class="mt-12 rounded-brand p-6 bg-gradient-to-r from-accent to-primary text-white flex items-center justify-between">
    <div class="text-lg font-semibold tracking-wide">Planning a similar project?</div>
    <a href="/en/kontakt" class="px-5 py-3 rounded-brand bg-white text-primary font-medium">Request now</a>
  </div>
</Base>
