Originally sourced from an interview published on Digital Journal (December 2019). Predictions were made by Ali Golshan, co-founder and CTO of StackRox.
Introduction
As 2019 drew to a close, Ali Golshan, co-founder and CTO of container security company StackRox, shared seven predictions with Digital Journal about where Kubernetes and cloud-native security were heading in 2020. The predictions cover the maturation of the Kubernetes ecosystem, the emergence of service mesh, the growing importance of third-party tooling, and the convergence of DevOps and security practices — themes that remain relevant for DevOps engineers today.
Prediction 1: Container Orchestration Consolidates Around Kubernetes
Golshan’s first prediction was that the container orchestration market would converge on Kubernetes as the clear standard. His reasoning: as more organizations adopt containers and microservices as part of their DevOps journeys, workload complexity increases, and teams develop a sharper understanding of what they actually need from the container ecosystem.
“The Kubernetes ecosystem is very rich,” Golshan noted, “and as more companies find value in using Kubernetes as a container orchestrator, they will adopt more solutions in the ecosystem. These advances mean we’ll see increasingly complex workloads running in Kubernetes.”
He highlighted SaaS companies as a leading indicator: data-heavy, highly complex applications built on Kubernetes are an ideal forcing function for both ecosystem maturity and broader service mesh adoption.
Prediction 2: Kubernetes Maturity Enables Bigger, More Critical Workloads
Golshan’s second theme was that Kubernetes was crossing from experimental adoption into production-grade, mission-critical use. He pointed to the Cloud Native Computing Foundation’s (CNCF) first full Kubernetes security audit as a turning point — confirming that Kubernetes is foundationally secure, while also prompting engineers to examine configuration weaknesses and potential vulnerabilities more carefully.
“Up to this point, a lot of organizations were running Kubernetes to build and test applications, or in environments that didn’t have external exposures,” Golshan said. “They didn’t have mission-critical applications with web-facing services exposed.”
He drew a parallel with earlier technology transitions: server virtualization in the early 2000s and public cloud adoption roughly between 2008 and 2012 followed similar maturity curves before becoming enterprise standards. Kubernetes, he argued, was following the same natural progression.
Prediction 3: Service Mesh Comes Into Its Own
Golshan’s third prediction focused on service mesh technology — tools such as Istio, Envoy, and Linkerd — gaining traction as Kubernetes deployments grew in complexity and criticality.
He described a typical microservices maturity path: lock down your CI/CD pipeline, run continuous image scanning, harden deployment processes, then move into runtime, segment the network, and incrementally add observability and application-level controls. Service mesh, he argued, represents the upper layers of that stack.
“That last piece is what service mesh provides, and from a productization and application perspective, the evolution of service meshes is still unclear — unlike with Kubernetes — no clear winner has emerged. The needs for observability, tracing, and application-level controls using policies and routing are clear; however, we have yet to see which technology emerges as the dominant player.”
Ali Golshan, CTO, StackRox (December 2019)
Prediction 4: Advanced Third-Party Tooling Makes Cloud Native More Functional
While the CNCF security audit confirmed Kubernetes’ strong security foundations, Golshan argued this did not mean Kubernetes was ready out-of-the-box to run massively scaled enterprise workloads. That gap, he predicted, would be filled by a maturing ecosystem of third-party tools covering observability, security automation, and operational intelligence.
He used Kubernetes pod security policies as a concrete example: while Kubernetes provides the policy framework, manually applying policies at scale — hundreds of times daily, thousands of times weekly — is operationally infeasible. Automation tooling is required to generate and enforce policies based on actual application behavior across development, staging, and production environments.
“You need third-party tools to ingest data, analyze it, and deliver actionable intelligence,” Golshan said. “In an ideal scenario, that intelligence will then programmatically update infrastructure for various use cases.”
Prediction 5: Kubernetes Use Cases Move Toward Operational Safety
Golshan’s fifth prediction addressed how security use cases within Kubernetes deployments evolve as organizations scale. Early-stage deployments tend to focus on basic visibility and configuration management. As deployments mature and expand, security posture management, runtime protection, and compliance automation become priorities.
He noted an interesting pattern: in some sectors, such as healthcare, newer startups were often more security-advanced than established incumbents, partly because they had built on Kubernetes from the start without legacy technical debt.
Golshan also highlighted large enterprises — citing Sony and Disney as examples — that were rebuilding streaming infrastructure on Kubernetes to compete with the delivery speed of cloud-native competitors. “Sometimes Kubernetes adoption is tied to getting a leg up on innovation, and other times it’s a matter of survival,” he said.
He added that security is increasingly embedded in the developer mindset: “Developers are realizing that if security isn’t built in, they will suffer from undetected vulnerabilities, misconfigurations, or other factors out of their control. Security is increasingly part of the developer’s consciousness.”
Prediction 6: Security as Code Translates Security Into Safety
Golshan drew a distinction between security and safety — analogous, he said, to the difference between walls and doors. Security is probabilistic; safety is deterministic. His sixth prediction was that treating both infrastructure and security as code — a practice embodied in the DevSecOps movement — would allow teams to shift from reactive security patching toward automated, policy-driven safety guarantees.
The declarative nature of Kubernetes and microservices architectures makes this shift tractable: policies can be defined once, version-controlled, and applied consistently at scale across clusters. “You have to build security into development for automation,” Golshan said, “because you’re dealing with so much data, so many users, highly distributed infrastructure, and much larger scale. You can’t just keep adding firewalls and agents and point solutions.”
Prediction 7: Operational Issues Will Drive Kubernetes Evolution More Than Security Vulnerabilities
Golshan’s seventh and final prediction was perhaps the most counterintuitive for a security-focused company to make: operational challenges — not security CVEs — would be the primary driver of Kubernetes development in 2020 and beyond.
He acknowledged that 2019 saw a number of Kubernetes CVEs, but praised the community’s response as strong and effective. Looking ahead, he expected questions like “How do I deploy Kubernetes across thousands of clusters and tens of thousands of nodes?” to dominate the roadmap more than security patch cycles.
“As these operational challenges get addressed, we’ll see an acceleration in improvements that result in increased scalability, performance, and functionality,” Golshan predicted. “As a result, Kubernetes will be adopted by a much larger arena of applications, including IoT, autonomous vehicles, and popular consumer technologies that need processing power and the ability to build and deliver applications and services more effectively.”
Key Takeaways for DevOps Engineers
- Kubernetes is the orchestration standard. Invest in Kubernetes expertise and ecosystem tooling rather than hedging across competing orchestrators.
- Service mesh is a next-layer concern. Plan for observability, traffic management, and application-level policy enforcement as workloads grow in complexity — but evaluate tools carefully, as the market has not yet fully consolidated.
- Native Kubernetes features need automation wrappers. Features like pod security policies, network policies, and RBAC require tooling to be operationally practical at scale.
- Shift-left security is not optional. Build security scanning, policy enforcement, and compliance checks into CI/CD pipelines from the start.
- Operational scale will define the next frontier. Multi-cluster management, observability at scale, and cost governance are becoming as important as security for mature Kubernetes deployments.
Note: StackRox was acquired by Red Hat in January 2021 and its technology was open-sourced as Red Hat Advanced Cluster Security for Kubernetes.