Presenters

Source

⚓ Smooth Sailing Through Regulatory Storms: How GitOps Powers the Hamburg Port Authority

In the world of global logistics, the Hamburg Port Authority (HPA) is a titan. Managing Germany’s largest seaport and Europe’s premier rail port isn’t just about moving containers; it is about securing the digital backbone of critical infrastructure.

When Marcus Ross, Lead for the Cloud Center of Excellence at the HPA, took the stage recently, he revealed a startling reality: his team isn’t just fighting hackers—they are navigating a 1,000-page mountain of security regulations. Here is how they use GitOps as their “hidden champion” to stay compliant, secure, and agile. 🌊🚢

🏔️ The KRITIS Challenge: Scale vs. Scrutiny

Operating under the KRITIS designation (critical infrastructure) means the HPA is subject to some of the strictest legal mandates on the planet. They don’t just follow “best practices”; they must satisfy ISO 27001 and the BSI (German Federal Office for Information Security) standards.

  • The Manual: A massive 1,000-page guide containing 21 specific building blocks for Kubernetes security.
  • The Fleet: Over 35 Kubernetes clusters spanning a hybrid landscape of on-premises and cloud environments.
  • The Lean Team: Remarkably, this entire operation is managed by just 3 Platform Engineers and 1 Site Reliability Engineer (SRE).
  • The Goal: Empower autonomous product teams to innovate while ensuring the port’s security posture remains unshakeable. 🛠️⚖️

🛠️ The Tech Stack: Building an Automated Lifecycle

To bridge the gap between dense policy manuals and live production environments, the HPA team built a sophisticated, declarative toolchain. They’ve moved away from manual “click-ops” toward a fully automated Infrastructure as Code (IaC) philosophy.

  • Provisioning with Terraform: Every piece of infrastructure starts as a Terraform module. By using terraform plan, the team audits every resource shift before a single line of code hits production.
  • Templating with YART: To manage diverse configurations without losing their minds, they created YART (Yet Another Random Templator). This open-source tool uses the Jinja2 engine and JSON Schema validation to ensure data integrity across both YAML and non-YAML formats.
  • The Cockpit Cluster: HPA uses a centralized “Cockpit” to manage the fleet. They deploy an individual Argo CD instance for every single developer team, providing total isolation and autonomy.
  • Security First: They’ve ditched weak Base64-encoded secrets in favor of a robust external Vault integration and use Harbor for secure container registry management. 💾🔒

🛡️ Real-World Enforcement: Killing Configuration Drift

In a GitOps world, the Git repository is the source of truth, but the reconciliation loop is the enforcer. Marcus Ross highlighted how they use specialized tools to ensure that security policies aren’t just suggestions—they are immutable laws.

  • Kyverno for Network Integrity: To meet BSI requirements for network separation, the team uses Kyverno. Even if a developer manages their own namespace, a Kyverno cluster policy automatically injects a default deny ingress/egress policy. If someone tries to delete it? Kyverno immediately recreates it.
  • Runtime Defense with Falco: To guard against threats like the Leaky Vessel CVE, the team relies on Falco for threat detection and Trivy for vulnerability scanning.
  • The Audit Advantage: When auditors arrive, the HPA doesn’t scramble for logs. They present their Git history. This provides a definitive, chronological record of every change, proving that the state of the cluster matches the mandated security requirements. 🤖🎯

💡 Expert Insights: Defense in Depth

During the session, a sharp audience member asked: If I use Cilium for network policies, can I rely on it exclusively instead of using admission controllers like Kyverno?

Marcus Ross’s take was clear: Defense in depth is non-negotiable. While Cilium is powerful, Kyverno acts as a vital secondary safeguard. If a user with administrative privileges attempts to “sneak around” by deleting a Cilium policy, Kyverno’s reconciliation loop will detect the drift and force the environment back into a compliant state instantly. 🛡️🌐

🚀 The Bottom Line: Start Small, Think Big

The HPA’s journey proves that you don’t need an army of engineers to manage world-class infrastructure; you need automation and discipline. By treating every policy as code, they’ve transformed GitOps from a deployment strategy into a comprehensive lifecycle engine.

The transition involves an upfront investment in complexity, but the payoff is a resilient, self-healing system that stands up to the most rigorous audits. As Marcus Ross puts it: Start small, and you will eventually stand on the shoulders of the projects underneath you.

Are you ready to let GitOps be the hidden champion of your infrastructure? 🦾✨

Appendix