From Policy to Production - Implementing ISO27001/BSI IT-Grundschutz in Kubernetes with GitOps

Discover how to bridge the gap between strict compliance requirements and dynamic Kubernetes environments in this lightning talk from KubeCon + CloudNativeCon. Learn from a real-world case study at Hamburg Port Authority that demonstrates how GitOps and open-source tools can automate compliance for critical security controls without sacrificing agility. Explore the implementation of two key IT-Grundschutz/ISO27001 building blocks: APP.4.4.A2 for CI/CD automation through secure scalable setup via templating, Kyverno, and ArgoCD, and APP.4.4.A13 for automated configuration auditing using continuous compliance checks with tools like Trivy, Kyverno, and ArgoCD through GitOps workflows. Gain practical insights into transforming audit checklists into automated guardrails using a high-stakes public-sector example, and walk away with a blueprint for implementing scalable compliance automation in your own Kubernetes environments.