Parent folderOpen Confluence

RWS Architecture article

Security Posture & Hardening

Establish the security baseline, BIO2 compliance controls, and supply-chain safeguards for the platform.

  1. Typeworkpackage
  2. Statusplanned
  3. Domainsecurity
On this page
  1. WP-06 Security Posture & Hardening
  2. Summary
  3. Scope
  4. Architecture Context
  5. Decision Context
  6. Dependencies
  7. Acceptance Criteria

WP-06 Security Posture & Hardening

Summary

Establish the security baseline, BIO2 compliance controls, and supply-chain safeguards for the platform.

Scope

  • Enforce cluster security baselines, admission policy controls, and privileged-access constraints.
  • Implement software supply-chain controls for signature verification and vulnerability gating.
  • Maintain compliance evidence workflows, including exception approval and expiry tracking.

Architecture Context

Decision Context

Dependencies

Acceptance Criteria

  • No production cluster retains active OpenShift kubeadmin credentials.
  • Break-glass access is time-bound, approved, and audited.
  • Admission policy controls are enforced by policy-as-code admission (for example OPA Gatekeeper) for Kubernetes object-level requirements such as approved registries and digest/metadata policy.
  • Signature verification is enforced through OpenShift image signature/sigstore policy distribution to nodes (for example MCO-managed container policy files), with evidence that non-compliant signatures are denied at pull/runtime enforcement points.
  • Vulnerability gating, where required for a release lane, is enforced through a designated scanner plus admission integration with precomputed scan results and explicit severity policy.
  • Blocking controls run fail-closed by default.
  • Break-glass exceptions are time-bound, approved, and audited.
  • Compliance evidence includes policy versions, admission audit decisions (allow/deny), and a documented exception workflow with approval owner and expiry.