Workload security, network, storage, and identity
Design namespace, admission, network, storage, secret, identity, and administrative controls.
Admission and workload identity
Allow deployments only from approved sources and service accounts. Validate immutable image identity, required signatures or attestations, namespace, security context, resource limits, volumes, capabilities, host access, and policy exceptions before admission.
Use workload identity instead of shared static credentials where the platform supports it. Separate deployment, runtime, secret access, node, storage, network, and cluster-administration authority.
Network
Default-deny traffic where feasible and explicitly allow control-plane, registry, storage, identity, model, retrieval, telemetry, and approved egress paths. Test DNS, node-level, host-network, operator, debug, and administrative bypasses.
Storage and secrets
Classify model, cache, index, source, log, evidence, backup, and temporary storage. Define encryption, key authority, snapshots, retention, deletion, access, capacity, performance, integrity, and restore.
Protect secrets from manifests, images, environment dumps, logs, and broad namespace reads. Define rotation and behavior when the secret service is unavailable.
Operational access
Constrain interactive shells, port forwarding, debug containers, privileged operators, node access, and break-glass. Record reason, approver, duration, commands or actions where appropriate, and closure evidence.