AI Driven DevSecOps Part 5: Zero Downtime Deployments with Kubernetes
Source: YouTube · SANS Cloud Security · published Aug 7, 2026 · 55:59
This SANS webinar by Dakota Riley explains how to achieve zero-downtime deployments on Kubernetes using native rollouts, blue/green deployments via service labels, weighted routing with the Gateway API, and GitOps—arguing that reliability and security goals are intertwined 4:25-5:00.
Key Takeaways:
• Security practitioners care about safe deployments because patching CVEs, fixing misconfigurations, and adding security features all require code changes, and fear of breakage often blocks them 3:09-4:05
• AI-assisted code generation means more code than ever needs to ship, making safe, reliable deployments essential to both security and business objectives 4:25-4:53
• Kubernetes deployments support rolling updates with fine-grained control (max unavailable, max surge, revision history) and native rollback via replica sets 12:54-16:12
• Readiness probes act as guardrails: in the demo, a deliberately broken container image failed its readiness check and the deployment halted mid-rollout, keeping the application up until rollback 28:54-29:35
• Blue/green deployments can be implemented with two deployments and one service by patching the service's label selector to flip traffic between slots 29:48-32:31
• Gateway API HTTPRoutes support weighted backends, enabling gradual canary rollouts (e.g., shifting traffic 0→100% between blue and green services) 36:56-39:05
• GitOps (e.g., Flux, Argo CD) uses a pull-based controller that continuously reconciles cluster state with a Git repository, demonstrated by deploying workloads simply by committing manifests 44:07-46:04
• Continuous delivery operators like Flagger let you declaratively define canary rollouts with metric-based health thresholds, replacing brittle scripts 46:28-48:23
The core message: making deployments easier and safer directly serves security objectives, and Kubernetes plus GitOps tooling provide mature, declarative ways to get there 54:14-54:46.
Sources:
- 3:09 Why security teams need safe software change processes
- 4:25 AI code generation and the security/reliability alignment
- 12:54 Kubernetes deployment rollouts and rollback mechanics
- 28:54 Demo of readiness probes stopping a bad rollout
- 29:48 Blue/green deployment via service label selectors
- 36:56 Weighted routing canary with Gateway API
- 44:07 GitOps with Flux: pull-based reconciliation
- 46:28 Continuous delivery operators (Flagger, Argo Rollouts)
- 54:14 Closing takeaways on security and reliability
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Welcome everyone. Happy Thursday and welcome to AI driven DevSecOps. We're talking about zero downtime deployments with Kubernetes. So just to briefly introduce myself, I'm Dakota Riley. I'm a current active Sans instructor. I teach SEC 540, which is cloud native security and DevSecOps automation. So all of this Kubernetes chaos that we're about to talk through, that's five days full of that. By day job, I'm a founding security engineer at a company called Fluidstack and we do basically infrastructure build-outs for the Frontier AI labs. So a lot of the stuff we talk about in this class, it's it's a lot of fun. I'm also an active AWS community builder, which is just a group of people who kind of curate content and tooling around, you know, AWS. It's fun community to be a part of. A bit mor…