Enterprise .NET on Kubernetes: Secure Architecture, Deployment, and Operations

Overview

.NET is Microsoft's cross-platform application platform for building web APIs, background workers, event-driven services, and enterprise integrations. Its core purpose is to provide a high-performance runtime, a mature base class library, and a consistent developer experience for cloud, on-premises, and hybrid deployments.

Enterprises use .NET because it combines strong performance, long-term support releases, first-class container support, and broad tooling across Visual Studio, GitHub Actions, Azure DevOps, and Kubernetes. It is especially effective for internal platforms, line-of-business APIs, identity-aware applications, and regulated workloads that require predictable deployment and operational controls.

Architecture

A typical enterprise .NET architecture includes the following components:

• ASP.NET Core API for REST endpoints and health probes
• Worker Services for asynchronous jobs and queue processing
• Configuration providers for environment variables, JSON files, and secret stores
• Observability via OpenTelemetry, structured logs, and Prometheus-compatible metrics
• Data layer using SQL Server, PostgreSQL, or managed cloud databases
• Ingress and service mesh for TLS termination, routing, and policy enforcement

Common deployment models:

• Containers on Kubernetes for standardized scaling and release automation
• Virtual machines for legacy integration or strict host-level controls
• Serverless hosting for event-driven functions and burst workloads

Typical data flow:

1. Client sends HTTPS request through ingress.
2. Ingress forwards traffic to the ASP.NET Core service.
3. The service authenticates the request using OpenID Connect or JWT bearer tokens.
4. Business logic reads secrets from environment variables or external secret stores.
5. The application writes structured logs and traces, then persists data to the database.

Implementation Guide

1. Install and create the service

dotnet --info
dotnet new webapi -n EnterpriseApi
cd EnterpriseApi
dotnet restore
dotnet build
dotnet publish -c Release -o out

2. Add container support

Create Dockerfile:

{
  "note": "Use this content as a Dockerfile",
  "content": "FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base\nWORKDIR /app\nEXPOSE 8080\nENV ASPNETCORE_URLS=http://+:8080\nFROM mcr.microsoft.com/dotnet/sdk:8.0 AS build\nWORKDIR /src\nCOPY . .\nRUN dotnet restore && dotnet publish -c Release -o /app/publish\nFROM base AS final\nWORKDIR /app\nCOPY --from=build /app/publish .\nENTRYPOINT [\"dotnet\", \"EnterpriseApi.dll\"]"
}

3. Configure application settings

Create appsettings.Production.json:

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "ConnectionStrings": {
    "MainDb": "Host=postgres.default.svc.cluster.local;Port=5432;Database=enterprise;Username=appuser;Password=${DB_PASSWORD}"
  }
}

4. Build and deploy to Kubernetes

docker build -t registry.example.com/enterprise-api:1.0.0 .
docker push registry.example.com/enterprise-api:1.0.0
kubectl create namespace enterprise
kubectl create secret generic enterprise-api-secrets --from-literal=DB_PASSWORD='S3curePass!'
kubectl apply -f k8s/deployment.yaml
kubectl rollout status deployment/enterprise-api -n enterprise

Code Examples

Kubernetes deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: enterprise-api
  namespace: enterprise
spec:
  replicas: 3
  selector:
    matchLabels:
      app: enterprise-api
  template:
    metadata:
      labels:
        app: enterprise-api
    spec:
      containers:
      - name: enterprise-api
        image: registry.example.com/enterprise-api:1.0.0
        ports:
        - containerPort: 8080
        env:
        - name: ASPNETCORE_ENVIRONMENT
          value: Production
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: enterprise-api-secrets
              key: DB_PASSWORD
        securityContext:
          runAsNonRoot: true
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
        resources:
          requests:
            cpu: "250m"
            memory: "256Mi"
          limits:
            cpu: "1000m"
            memory: "512Mi"

CI pipeline snippet

name: build-and-scan
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'
      - run: dotnet restore
      - run: dotnet test --configuration Release
      - run: dotnet publish -c Release -o out
      - run: docker build -t registry.example.com/enterprise-api:${{ github.sha }} .

Runtime configuration export

export ASPNETCORE_ENVIRONMENT=Production
export ASPNETCORE_URLS=http://+:8080
export ConnectionStrings__MainDb="Host=postgres.default.svc.cluster.local;Port=5432;Database=enterprise;Username=appuser;Password=${DB_PASSWORD}"
dotnet EnterpriseApi.dll

Security Hardening

• Enforce TLS everywhere: terminate TLS at ingress and use mTLS between services where possible.
• Use managed identity or workload identity instead of embedded credentials.
• Store secrets outside source control and inject them through Kubernetes Secrets, Azure Key Vault, or HashiCorp Vault.
• Run containers as non-root with readOnlyRootFilesystem: true and minimal Linux capabilities.
• Enable dependency and image scanning in CI/CD and patch to supported .NET LTS versions.
• Apply least privilege for database accounts, service accounts, and RBAC roles.
• Protect data at rest using database-native encryption and encrypted persistent volumes.

Comparison

Troubleshooting

Error 1: Port binding failure

Log sample:

fail: Microsoft.Extensions.Hosting.Internal.Host[11]
      Hosting failed to start
      System.IO.IOException: Failed to bind to address http://0.0.0.0:8080: address already in use.

Fix: Verify ASPNETCORE_URLS, container port mappings, and that no sidecar or duplicate process already owns port 8080.

Error 2: Database authentication failure

Log sample:

Npgsql.PostgresException (0x80004005): 28P01: password authentication failed for user "appuser"

Fix: Confirm the Kubernetes secret value, connection string key naming, and environment variable mapping ConnectionStrings__MainDb.

Error 3: Crash due to missing certificate

Log sample:

System.Security.Cryptography.CryptographicException: The system cannot find the file specified.
   at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password)

Fix: Mount the certificate as a secret volume or use ingress-managed TLS instead of loading local files in the container.

Best Practices

Do

• Standardize on .NET LTS such as .NET 8 for predictable patching.
• Use health checks like /healthz and /ready for Kubernetes probes.
• Emit structured logs with correlation IDs for incident response.
• Separate config from code using environment-specific settings and secret stores.

Don't

• Do not bake secrets into images or commit them to appsettings.json.
• Do not run as root unless a documented exception exists.
• Do not skip dependency updates; stale NuGet packages are a common risk.
• Do not rely on local disk state in containers; use external storage or managed services.