Workload hardening
The workload layer of the Zero Trust architecture ensures that only trusted, hardened code runs in your cluster. Alquimia Platform provides deployment overlays and policy guidance to enforce this.
What is enforced
Section titled “What is enforced”| Control | Purpose |
|---|---|
| Immutable image identity | Every runtime image is signed so its origin can be verified. |
| Signature verification at admission | The cluster rejects unsigned or untrusted images before they run. |
| Curated registries | Only approved container registries are allowed. |
| Hardened pod spec | Pods run as non-root, drop all capabilities, use a read-only root filesystem, and apply a default seccomp profile. |
| Resource limits | Every container declares CPU and memory requests and limits. |
Deployment overlays
Section titled “Deployment overlays”The runtime repository provides overlays for different environments:
| Overlay | Use |
|---|---|
| Development | Vanilla Kubernetes without admission policies for flexibility. |
| Production | Includes admission policies that enforce signing, registry allow-lists, and pod security. |
| OpenShift / ROSA | Uses OpenShift’s built-in security constraints instead of Kyverno policies. |
Choose the overlay that matches your cluster’s security tooling and compliance requirements.
Image signing and verification
Section titled “Image signing and verification”Runtime images are signed during the build pipeline using keyless signing tied to the CI workflow. At admission, the cluster verifies that the image was built by the trusted workflow and mutates the image reference to its digest for immutability.
Handling exceptions
Section titled “Handling exceptions”If a workload genuinely needs to deviate from a policy — for example, a disaster-recovery container that must run as root — add an explicit exception rather than relaxing the base policy. Document the business justification and review period.
Supply-chain best practices
Section titled “Supply-chain best practices”- Pin images to digests in production overlays.
- Scan images for vulnerabilities before deployment.
- Limit registry access to trusted sources.
- Rotate signing credentials on a schedule.
- Monitor admission-control denials as a security signal.