Publish Date: September 30, 2026
Executive Overview
Enterprise software engineering organizations are confronting severe operational friction at the intersection of private cloud infrastructure and modern cloud-native delivery pipelines. While Kubernetes provides the declarative foundation for microservices deployment, establishing a production-ready, auditable continuous integration and continuous deployment (CI/CD) pipeline on premises historically required stitching together fragmented point solutions. Infrastructure administrators, platform reliability engineers, and application development squads frequently operate in isolated silos: developers manage build logic in public git repositories, security operations centers (SOCs) enforce out-of-band vulnerability gate checks, and virtualization engineers govern compute resources via ticket queues. This fragmentation introduces dangerous security vulnerabilities—such as static, long-lived API tokens committed to source code repositories, unvetted third-party base container layers, and manual, unmonitored promotion procedures.
Broadcom’s technical architectural publication, co-authored by Hugo Phan, Skand Purohit, and Rahul Kumar, addresses these systemic delivery bottlenecks by delivering a comprehensive, enterprise-grade DevSecOps reference architecture on VMware Cloud Foundation (VCF). Deployed atop the VMware vSphere Kubernetes Service (VKS), the blueprint establishes an end-to-end software supply chain integrating Harness CI/CD, Wiz vulnerability scanning, JFrog Artifactory, Dynatrace application performance monitoring (APM), and the native VCF Secret Store (powered by HashiCorp Vault). By enforcing zero static credentials, ephemeral container build execution, automated policy-driven promotion gates, and closed-loop performance rollbacks, the architecture demonstrates how enterprise private clouds can deliver public-cloud agility with defense-grade security governance.
This technical advisory provides an enterprise architecture evaluation of the deployment patterns, operational mechanisms, and security frameworks detailed in the publication. It examines the dual-cluster topology separating build planes from production environments, analyzes the runtime mechanics of the VKS Vault Secret Injector, evaluates the orchestration of automated image scanning and promotion gates, and dissects closed-loop APM rollbacks. Furthermore, this assessment explores real-world cross-industry use cases, weighs architectural alternatives, delivers a critical perspective on integrated ecosystem dependencies, and provides actionable recommendations for Chief Information Security Officers (CISOs), Chief Technology Officers (CTOs), and enterprise platform architects.
Features
Modernizing enterprise software delivery across sovereign private clouds requires translating zero-trust security principles into automated, declarative infrastructure pipelines. The publication outlines key architectural components, integration patterns, and operational controls across the entire software supply chain on VMware Cloud Foundation:
Dual-Cluster Isolated Topology (Build vs. Production Plane): To prevent lateral movement, blast-radius expansion, and resource contention, the architecture physically and logically bifurcates the continuous delivery lifecycle into two dedicated VKS clusters:
VKS Build Cluster: Dedicated strictly to continuous integration workflows. Harness CI provisions ephemeral build runner pods inside isolated vSphere Namespaces (
NS-01). Build pods exist only for the duration of compilation and unit testing, terminating immediately upon pipeline completion to prevent persistent container drift or credential harvesting.VKS Production Cluster: Dedicated exclusively to customer-facing application execution. The production cluster runs stateful and stateless microservice workloads governed by strict network isolation, admission control policies, and supervisor resource quotas. Direct developer SSH or shell access is permanently disabled.
Ephemeral In-Memory Credential Injection via VCF Secret Store: The architectural core of the pipeline’s security posture is the complete elimination of static, long-lived infrastructure credentials:
Runtime Secret Mounting: Leveraging the supervisor-integrated VKS Vault Injector (backed by the VCF Secret Store / HashiCorp Vault), sensitive parameters—including database connection strings, TLS certificates, and API tokens—are dynamically injected directly into container memory via shared in-memory volumes mounted at
/vault/secrets.Zero-Disk and Zero-Git Footprint: Secrets are generated dynamically, encrypted in transit using mutual TLS (mTLS), and never persisted to local container storage, committed to Git repositories, or exposed within vCenter Server virtual machine environment variables.
Short-Lived OIDC Authentication: Harness CD authenticates against the target VKS production cluster using short-lived OpenID Connect (OIDC) service account tokens issued on demand, eliminating the requirement to export, manage, or store static administrative
kubeconfigfiles within CI/CD runner environments.
Multi-Stage Security Gate Integration with Wiz: Vulnerability and misconfiguration detection is embedded directly into the developer feedback loop across two distinct stages:
Stage 1 (Pre-Build Source Code and Secret Scanning): Before application binaries are compiled, the pipeline triggers the Wiz CLI within the ephemeral build container. Wiz inspects raw application source code, configuration files, and infrastructure-as-code (IaC) templates for hardcoded credentials, unvetted dependencies, and licensing violations. If critical flaws are detected, the pipeline halts immediately, alerting the developer within their IDE.
Stage 2 (Post-Build Registry Layer Scanning): Following Go binary compilation into a minimal, hardened container image (such as a distroless or chiseled image), the artifact is pushed to JFrog Artifactory tagged with an immutable build identifier. Harness triggers a post-build Wiz scan directly against the registry layer. Wiz interrogates image layers for Common Vulnerabilities and Exposures (CVEs), malware signatures, and base operating system flaws, issuing an explicit cryptographic verification gate before permitting downstream promotion.
Modern Ingress and Microservice Routing via Kubernetes Gateway API: Workload exposure within the VKS production cluster transitions away from legacy Kubernetes Ingress controllers to the modern Kubernetes Gateway API:
Contour Control Plane and Envoy Data Plane: Ingress routing is orchestrated by Contour operating as the control plane controller and Envoy Proxy serving as the high-performance data plane engine.
Declarative Hostname Mapping: Platform engineers declare standard
GatewayandHTTPRouteCustom Resource Definitions (CRDs) within application namespaces, routing custom domain hostnames (such astravelportal.sfo.io) directly to active backend container endpoints while enforcing automated TLS termination.
Closed-Loop Observability and Automated Deployment Rollbacks via Dynatrace: Application reliability is maintained through real-time telemetry correlation:
Automated OneAgent Injection: Dynatrace OneAgent is deployed as a platform-native daemon across the VKS production cluster, automatically instrumenting application runtimes without requiring manual developer code modification.
SLO-Governed Promotion and Rollback: Following automated blue-green or rolling canary deployments via Harness CD, Dynatrace continuously measures response latency, CPU consumption, and HTTP 5xx error rates against strict, pre-defined Service Level Objectives (SLOs). If a newly promoted deployment induces an error rate spike or violates latency thresholds within an observation window, Harness intercepts the Dynatrace webhook and automatically initiates an automated rollback to the last known healthy replica set.
Benefits
Implementing an automated, zero-trust DevSecOps reference architecture atop VMware vSphere Kubernetes Service delivers measurable operational, security, and financial advantages across enterprise IT organizations:
Elimination of Static Administrative Credentials: The exposure of hardcoded service account tokens, static database passwords, and long-lived
kubeconfigfiles represents one of the primary vectors in enterprise private cloud compromises. By leveraging short-lived OIDC federation and in-memory Vault injection via the VCF Secret Store, this architecture completely eliminates static credentials from the delivery fabric, drastically reducing the enterprise attack surface.Drastic Compression of Developer Lead Time: In traditional enterprise environments, deploying a new microservice requires weeks of cross-team coordination across infrastructure provisioning, security firewall configuration, and registry onboarding. Providing developers with standardized, pre-approved GitOps deployment pipelines linked to VKS allows software squads to transition code from commit to production in minutes, significantly improving enterprise DORA (DevOps Research and Assessment) metrics.
Automated Shift-Left Security Without Developer Friction: Security audits that occur manually weeks after software is compiled generate massive friction, forcing developers to abandon active roadmaps to remediate legacy defects. By embedding Wiz CLI scans directly into the compile and registry layers, vulnerabilities are identified and remediated at the point of origin, ensuring that non-compliant images never reach production compute nodes.
Protection of Production Workload SLAs via Automated Rollbacks: Human-dependent deployment verification is inherently error-prone; platform operators often fail to detect subtle application latency degradations until end users report service disruptions. Integrating Dynatrace telemetry with Harness CD closed-loop rollbacks guarantees that production regressions are detected and remediated automatically within seconds, protecting application availability and service-level agreements (SLAs).
Resource Optimization via Ephemeral Build Compute: Running persistent, dedicated virtual machines or static worker nodes for continuous integration pipelines consumes vast amounts of data center capacity that sits idle between build cycles. Utilizing VKS to dynamically provision ephemeral build runner pods ensures that compute and memory resources are consumed only during active compilation, freeing up private cloud capacity for primary business workloads.
Unified Compliance Traceability and Audit Defensibility: Regulated enterprises subject to stringent compliance frameworks (such as SOC 2, PCI DSS, and HIPAA) must provide immutable proof that code deployed to production was vetted, scanned, and deployed through authorized channels. Every Git commit, Wiz vulnerability scan digest, Artifactory image checksum, and Harness deployment event is cryptographically logged, establishing an auditable chain of custody from source code to hypervisor execution.
Use cases
The integrated DevSecOps delivery architecture on VKS applies across diverse enterprise and mission-critical deployment environments:
Global Financial Services Payment Processing Modernization: A multinational banking enterprise operates digital payment settlement microservices across private cloud infrastructure. Security policies prohibit storing database credentials in container configuration maps or external cloud secret managers. The bank deploys the VKS DevSecOps reference architecture: application developers commit payment routing code to GitHub, triggering Harness CI to execute ephemeral build pods within an isolated build cluster. The VCF Secret Store injects dynamic database tokens directly into pod memory, while Wiz blocks images containing unresolved high-severity vulnerabilities. Dynatrace monitors payment transaction latencies post-deployment, ensuring continuous compliance with PCI DSS and strict financial uptime mandates.
Healthcare System Managing Diagnostic Telemetry Applications: A healthcare provider hosts patient telemetry pipelines and clinical diagnostics backends across distributed vSphere clusters. To protect sensitive Electronic Health Records (EHR) from insider threats and supply chain tampering, the organization mandates automated container vulnerability validation. Developers push microservice updates through the automated Harness pipeline, where Wiz verifies that base container images contain zero embedded secrets and strictly conform to HIPAA data protection rules. Artifacts are cryptographically validated in JFrog Artifactory before automated promotion to the VKS production cluster, eliminating human configuration error in clinical environments.
Enterprise SaaS Continuous Delivery at Scale: A software-as-a-service enterprise manages continuous deployment pipelines supporting hundreds of multi-tenant application microservices. Frequent software updates historically caused transient availability drops due to unmonitored database connection exhaustion. The platform team implements closed-loop Dynatrace APM integration: when a new microservice deployment introduces anomalous CPU throttling or database latency spikes, Harness intercepts the Dynatrace anomaly event and automatically reverts the cluster to the previous revision within 30 seconds, maintaining a 99.99% availability SLA for global customers.
Air-Gapped Sovereign Cloud Software Delivery: A national defense contractor operates an isolated, air-gapped sovereign private cloud supporting classified simulation software. External public cloud CI/CD SaaS platforms are strictly prohibited. The platform engineering group deploys self-hosted Harness automation workers, private JFrog Artifactory registries, and the VCF Secret Store directly within on-premises VCF 9.1 clusters. The pipeline delivers modern cloud-native developer agility—including automated image scanning and declarative Kubernetes deployments—entirely within an air-gapped security boundary.
Alternatives
When architecting automated continuous integration and continuous deployment pipelines across private cloud environments, technology leaders must evaluate several alternative methodologies:
Alternative 1: VKS-Native Ecosystem Integration via Harness, Wiz, and VCF Secret Store (Recommended Standard): The primary architectural approach detailed in the publication couples VMware vSphere Kubernetes Service with specialized, enterprise-grade tooling (Harness, Wiz, Artifactory, Dynatrace, and Vault). This model maximizes operational security by eliminating static credentials, automating multi-stage vulnerability gating, isolating build vs. production blast radiuses, and providing closed-loop automated rollbacks. However, it requires licensing investments across multiple independent software vendors and demands cross-functional operational discipline to maintain interoperability across platform components.
Alternative 2: Public Cloud Hyperscaler Managed DevOps Stacks (e.g., AWS CodePipeline, Azure DevOps): Rather than maintaining an on-premises DevSecOps pipeline, an enterprise can route software builds and deployments through managed public cloud developer platforms. While this approach eliminates the overhead of managing local build infrastructure and provides turnkey developer tooling, it introduces significant data sovereignty risks, incurs high ongoing operational expenditures (OpEx), requires transmitting proprietary source code and container binaries across external networks, and introduces network latency during container image deployments back to on-premises private clouds.
Alternative 3: Traditional Open-Source DIY Tooling on Bare-Metal (Jenkins, Harbor, Prometheus): Organizations often attempt to construct private cloud CI/CD pipelines using standalone open-source software (such as self-managed Jenkins runners, Harbor registries, and open-source Prometheus/Grafana monitoring). While this avoids commercial software licensing costs, it imposes immense internal operational overhead. Internal engineering teams must act as software integrators, maintaining complex custom bash scripts, debugging brittle webhook integrations, and manually rotating static service account secrets. The administrative burden and talent scarcity associated with maintaining DIY continuous delivery pipelines frequently exceeds commercial licensing savings.
Alternative 4: Monolithic Virtual Machine Packaging and Scripted Deployments: Under this legacy model, software updates are compiled into full virtual machine templates or golden images and deployed via scheduled PowerShell/PowerCLI scripts or Ansible playbooks. While this leverages familiar virtualization primitives, it represents the exact antithesis of modern developer agility. Monolithic VM compilation cycles are slow, rollbacks require restoring entire virtual disks, and the delivery process lacks the granular scaling, ephemeral efficiency, and declarative lifecycle management native to containerized Kubernetes architectures.
Alternative perspective
A critical analysis of integrated enterprise DevSecOps pipelines across private cloud platforms requires examining the operational trade-offs, system dependencies, and organizational overhead inherent in multi-vendor integration:
The Operational Tax of Multi-Vendor Ecosystem Integration: While the reference architecture provides a robust, defense-grade pipeline by linking best-of-breed platforms (Harness, Wiz, JFrog, Dynatrace, HashiCorp), it creates a complex web of software dependencies. Platform engineering teams must manage independent licensing contracts, monitor disparate API deprecation lifecycles, and maintain multiple custom webhook integrations. If an API schema changes in an upstream component or an authentication certificate expires on an auxiliary webhook listener, the continuous delivery pipeline halts. Organizations must ensure that internal platform teams possess the multi-disciplinary skills required to troubleshoot complex cross-platform integration failures.
The Reality of Container Build Resource Contention: The architecture advocates scheduling ephemeral build pods inside the VKS Build Cluster. While dynamic container scheduling optimizes hardware density, compiling large-scale enterprise applications (such as massive Java or C++ monoliths) generates sudden, intense spikes in CPU utilization, memory pressure, and storage I/O. If platform administrators do not enforce strict Kubernetes ResourceQuotas and LimitRanges on build namespaces, a sudden surge in concurrent developer commits can saturate physical ESXi host resources, degrading adjacent cluster services and impacting build completion times.
Cognitive Overhead and Developer Resistance: Transitioning software developers from traditional, permissive development environments to a strictly gated zero-trust delivery model can encounter severe cultural resistance. When Wiz security gates block builds due to minor upstream open-source license ambiguities, or when developers cannot directly access application pods via
kubectl execdue to hardened namespace lockdown policies, engineering velocity can initially slow down. Without comprehensive developer education, clear remediation documentation, and responsive platform engineering support, rigid security guardrails can inadvertently incentivize developers to bypass established pipelines.The Fragility of Automated Rollback Decisions: Relying on Dynatrace telemetry to trigger automated Harness CD rollbacks assumes that application anomalies can be definitively isolated through automated metrics. In real-world enterprise environments, transient database lock contention, external network provider hiccups, or third-party payment gateway outages can cause temporary HTTP 5xx error rate spikes that have nothing to do with the newly deployed container code. If automated rollback thresholds are configured with overly aggressive sensitivity settings, the pipeline can trigger unnecessary, disruptive deployment thrashing during routine traffic surges.
Final thoughts
Broadcom’s DevSecOps reference architecture on VMware vSphere Kubernetes Service delivers a vital, production-ready blueprint for modern enterprise software delivery. In an operating environment defined by expanding cyber threats, complex regulatory compliance frameworks, and accelerating demands for developer agility, enterprise IT organizations can no longer afford to operate with fragmented, ticket-driven deployment processes.
By converging enterprise-grade Kubernetes orchestration (VKS), ephemeral in-memory secret injection (VCF Secret Store), automated multi-stage vulnerability verification (Wiz, Artifactory), and closed-loop APM rollbacks (Harness, Dynatrace), the architecture proves that private cloud platforms can deliver the speed of public cloud environments while enforcing the rigorous security, isolation, and governance demanded by mission-critical enterprise workloads.
To successfully operationalize this DevSecOps reference architecture, enterprise CISOs, CTOs, and platform engineering teams should implement the following strategic recommendations:
Enforce Strict Environmental Separation Across Clusters: Mandate the architectural isolation of continuous integration build environments from production execution runtimes by deploying dedicated, independent VKS clusters. Restrict developer permissions on production clusters strictly to declarative GitOps pipelines.
Eliminate Static Credentials via In-Memory Secret Injection: Immediately audit enterprise CI/CD repositories and container deployment templates to eliminate hardcoded passwords, static API tokens, and long-lived
kubeconfigfiles. Deploy the VKS Vault Injector and VCF Secret Store to mount credentials dynamically in memory at runtime.Embed Automated Security Gates into Image Registries: Configure multi-stage vulnerability and secret scanning within continuous integration workflows. Establish mandatory cryptographic gates in JFrog Artifactory that block the promotion and deployment of container images carrying unmitigated critical CVEs or hardcoded secrets.
Modernize Application Ingress via Kubernetes Gateway API: Deprecate legacy Kubernetes Ingress resources in favor of the modern Kubernetes Gateway API managed by Contour and Envoy Proxy. Standardize routing and TLS termination through declarative
GatewayandHTTPRoutecustom resources.Operationalize Closed-Loop Deployment Governance: Integrate real-time application performance monitoring (Dynatrace) with automated deployment orchestration (Harness CD). Establish conservative, well-calibrated SLO thresholds that automatically trigger non-disruptive canary rollbacks when newly promoted code introduces systemic error rate or latency regressions.