Swift has built container security for hundreds of clusters in such a way that policies, vulnerabilities, and ownership do not spread across different systems. This is an important example of how hybrid cloud security can be made manageable without constant manual intervention.
When the infrastructure serves a network through which the equivalent of the world’s GDP passes every 3 days, security ceases to be a separate function. For Swift, the issue was not the lack of tools, but the scale and how risk data was collected and matched. Manually searching for a vulnerable image in a distributed hybrid cloud environment would be too slow and too fragile. In this context, even one critical vulnerability in a single image becomes an operational risk.
The team chose Red Hat Advanced Cluster Security for Kubernetes as the foundation for control at the build, deploy, and runtime stages. The pragmatic choice was not to build an architecture based on constant polling of each cluster from a central CMDB. Such a pull-based approach created unnecessary network load and complicated operations. Instead, Swift flipped the data flow: a local agent in each Red Hat OpenShift environment collects image data, sends it to a central repository, and then the central scanning task matches it against known CVEs and returns a cleaned and prioritized risk profile back to the CMDB.
This scheme is important not only as a set of components but also as an architectural compromise. The center does not roam through clusters for data. It receives already collected context and processes it in one place. This reduces network complexity and makes the system more resilient to the removal of individual clusters. If a cluster disappears, the central state can be restored from code. This means that the failure of a single node does not break the security model as a whole. For infrastructure of this scale, this is not an embellishment but a way to maintain manageability.
A separate issue arose around changes to the security policies themselves and versions of Red Hat Advanced Cluster Security. In an enterprise environment, such updates often have side effects: false positives, unnecessary noise, and increased alert fatigue among developers. Swift mitigated this risk through an automated regression testing pipeline. Before promoting a new policy or a new version to testing and production, the team runs it in a sandbox with test workloads that deliberately trigger specified policy violations. This checks not only the correctness of the detection but also whether the update will disrupt the usual developer workflow.
At the operational level, this provided a calmer working model. Daily automated scans of running images, including short-lived pods, reduced the volume of manual checks. Zero-touch certificate management through Argo CD and HashiCorp Vault eliminated another class of routine operations. As a result, the security team only gets involved when a high-priority vulnerability is confirmed. There are no precise metrics in the original material, so it is more accurate to speak not of quantitative effects but of qualitative ones: less manual work, less operational noise, and more predictable risk management in hybrid cloud.