Table of Contents
- Updating the Jenkinsfile
- Kubernetes Production Deployment YAML
- Why Drop
NET_RAW? - Rollout Status Script
- Triggering the Deployment
- Verifying the Production Deployment
- Visualizing with Kiali
- References
Updating the Jenkinsfile
Add a new stage named K8S Deployment - PROD right after your CIS Benchmarking stage. This stage runs two parallel steps:Make sure your Jenkins agent has permissions to apply manifests in the
prod namespace.Kubernetes Production Deployment YAML
Create a file namedk8s_PROD-deployment_service.yaml with the following content. It includes:
- A Deployment with three replicas
- A security context that drops
NET_RAW - Resource requests and limits
- A
ClusterIPService
Resource Requests and Limits
Why Drop NET_RAW?
Dropping the NET_RAW capability mitigates DNS spoofing and other low-level network attacks. For a deeper dive, read DNS Spoofing on Kubernetes Clusters.

Ensure no essential functionality relies on raw sockets before dropping
NET_RAW.Rollout Status Script
Save the following ask8s-PROD-deployment-rollout-status.sh in your repo. It waits for the deployment to roll out, then rolls back on failure:
Triggering the Deployment
- Commit and push both
Jenkinsfileand YAML/script files to your Git repo. - Start the Jenkins build.
- Approve the production deployment when prompted.

Verifying the Production Deployment
Validate pods in theprod namespace and confirm the Kiali service:
The extra container in each pod is the Istio sidecar proxy.
Visualizing with Kiali
Kiali offers a comprehensive dashboard to monitor your service mesh. Below is a quick overview of key sections.Namespaces Overview

Outbound & Inbound Metrics
Outbound Metrics

Generating Traffic
Use a simplecurl loop to generate load and see real-time metrics:
Workload Health and Logs

Service Mesh Graph
