Skip to content

Security & identity

Security here is a set of standard Kubernetes primitives applied in layers, not a single product with a badge on it. Each one is inspectable, expressible in Git and enforced by the cluster rather than by convention.

Isolation is a choice you make per workload: a namespace on shared infrastructure, a dedicated cluster, or dedicated hosts. Infrastructure is operated in the Netherlands, under Dutch and EU law.

What this section will cover

  • RBAC, roles and service accounts
  • Namespace isolation and micro-segmentation
  • Secrets handling and rotation
  • TLS and certificate management
  • Private endpoints
  • Compliance posture and the shared responsibility model

A baseline worth applying now

  1. Bind the narrowest role that works — view before edit, edit before admin.
  2. Apply a default-deny egress NetworkPolicy, then allow what the workload needs.
  3. Keep credentials in Secrets injected at runtime, never in an image or in Git.
  4. Use short-lived service account tokens for automation.
oc get rolebindings -n <project> -o wide
oc get networkpolicy -n <project>

Scaffold status

This is a placeholder. Capabilities, limits and configuration reference are written here once confirmed against the platform — deliberately not copied from marketing pages, which move independently of these docs.