Skip to content

Workload hardening

The workload layer of the Zero Trust architecture ensures that only trusted, hardened code runs in your cluster. Alquimia Platform provides deployment overlays and policy guidance to enforce this.

ControlPurpose
Immutable image identityEvery runtime image is signed so its origin can be verified.
Signature verification at admissionThe cluster rejects unsigned or untrusted images before they run.
Curated registriesOnly approved container registries are allowed.
Hardened pod specPods run as non-root, drop all capabilities, use a read-only root filesystem, and apply a default seccomp profile.
Resource limitsEvery container declares CPU and memory requests and limits.

The runtime repository provides overlays for different environments:

OverlayUse
DevelopmentVanilla Kubernetes without admission policies for flexibility.
ProductionIncludes admission policies that enforce signing, registry allow-lists, and pod security.
OpenShift / ROSAUses OpenShift’s built-in security constraints instead of Kyverno policies.

Choose the overlay that matches your cluster’s security tooling and compliance requirements.

Runtime images are signed during the build pipeline using keyless signing tied to the CI workflow. At admission, the cluster verifies that the image was built by the trusted workflow and mutates the image reference to its digest for immutability.

If a workload genuinely needs to deviate from a policy — for example, a disaster-recovery container that must run as root — add an explicit exception rather than relaxing the base policy. Document the business justification and review period.

  • Pin images to digests in production overlays.
  • Scan images for vulnerabilities before deployment.
  • Limit registry access to trusted sources.
  • Rotate signing credentials on a schedule.
  • Monitor admission-control denials as a security signal.