A Unified Zero Trust Orchestration Framework for Kubernetes: Design, Integration, and Functional Verification

Abstract

The deployment of Kubernetes increasingly depends on multiple independent security tools, but there is no defined rule for how these components should be sequentially installed, interconnected, and observed to maintain security. This creates inter-tool gaps that individual components cannot address in isolation. This paper aims to present the dependency-ordered installation blueprint and inter-tool wiring specification for a unified five-layer Zero Trust Architecture (ZTA) built on Kubernetes that comprises Cilium, SPIRE/SPIFFE, HashiCorp Vault, Kyverno, and Falco in a coherent framework with a unified Prometheus/Grafana observability pipeline. The framework is tested for functionality and validated by enforcing policies on all 5 layers. The results show that compliant workloads are admitted with less than 4 ms of additional latency, Kyverno blocks policy violations, Cilium drops unauthorized cross-namespace traffic, and Falco detects runtime anomalies. Under peak load, the framework incurs a 15.7% peak CPU overhead and 450 MB memory overhead in total, indicating that the system is deployable in practice on standard EC2 infrastructure. By formalizing this ordering and wiring as a single specification, the framework replaces the ad hoc, trial-and-error integration practitioners currently rely on with a reproducible deployment pattern and a replicable baseline for future ZTA research.