Access to the Control Plane console or CLI is granted by authenticating using single sign-on (SSO) to one of the following providers:
For your chosen provider, Multi-Factor Authentication (MFA) is recommended.
Access to the Control Plane CLI using a Service Account is granted by the use of a generated token. During the token generation, the token can be copied to the clipboard or downloaded. After the token modal is dismissed, the token will no longer be available to be displayed or retrieved and will need to be regenerated if lost or compromised.
Authorization to all Control Plane resources is controlled using fine-grained authorization policies assigned to the following principal types:
All communications from external sources use end-to-end TLS to the destination Workloads.
The server certificates are generated by Let’s Encrypt and are rotated every 60 days.
All internal communications use mutual TLS (mTLS) using client certificates.
These certificates are rotated every hour.
Control Plane uses industry-standard firewall technology. All Workloads are configured to be fully restricted with no internal or external communication enabled by default, except for internal health check monitoring.
Inbound access to a Workload can be enabled/disabled from the entire Internet or limited to a specific list of CIDRs.
Outbound access from a Workload can be enabled/disabled to the entire Internet or limited to a specific list of CIDRs or hostnames.
By default, the Workload’s internal firewall is disabled.
Each Workload can be configured to allow inbound communications from:
Every Workload receives discovery information for other Workloads across the Org but communication is disabled by default using firewalls and client certificate validation.
All Workloads are isolated at the Org level based on the use of:
Direct communications between containers residing in other Orgs are not possible. Isolation between Workloads within an Org is defined based on the Workloads' internal firewall configuration.
Containers are isolated by the use of:
The following headers are sanitized and replaced with valid content before being forwarded to running Workloads:
All logs generated by an Org are only accessible by a user having the
Logs are retained for 30 days by default.
Rentention settings for logs, metrics and traces can be adjusted on the Org.
Org secrets are encrypted at rest using envelope encryption and use TLS while in transit. Secrets are stored on multiple cloud providers using cloud-based Hardware Security Modules (HSM).
Security updates and patches are applied regularly and meet all compliance and regulation requirements.
For zero-day vulnerabilities, updates are applied as soon as they are available and verified.
All scheduled maintenance that could cause downtime will be communicated via email and Discord.
If you find any security issues, or have any security questions, please email firstname.lastname@example.org.
The Control Plane platform is hosted at the following providers:
Each provider complies with the following:
Support staff has access to the following: