TriSec DevSecOps and AI/ML Security Lab on GCP demonstrates a phased, production-hardened Kubernetes environment built with infrastructure-as-code and GitOps principles. The architecture progresses from Workload Identity Federation and Terraform remote state through a private VPC with regional GKE, security services including Secret Manager and Cloud KMS, and policy enforcement via OPA Gatekeeper and Binary Authorization. Multi-namespace deployments—Juice Shop, AI Goat, ML Service, and observability stacks—showcase real-world security patterns with RBAC, NetworkPolicies, and Falco runtime monitoring. This lab design solves the challenge of learning GCP security best practices in a controlled, repeatable environment without long-term cost burden. Fork this diagram on Diagrams.so to customize phases, add additional workloads, or adapt the VPC CIDR ranges and node pool configurations for your own labs. The phased approach allows teams to build incrementally, validating each security layer before moving to the next.