Skip to content
Kupe Cloud Kupe Cloud Kupe Cloud Docs

Security

Every managed cluster runs the same set of controls by default. You do not opt in to them, and they cannot be turned off. This page lists what is enforced, where responsibility splits between Kupe and your team, and what a rejected deployment looks like.

What’s enforced

Section titled “What’s enforced”

Every managed cluster on Kupe Cloud has:

  • Workload security policies that block privileged or unsafe pod settings
  • Network isolation restricting workload egress to internet only
  • Container security contexts requiring non-root, dropped capabilities, and a seccomp profile
  • Runtime threat monitoring for suspicious process behaviour in running workloads
  • Continuous vulnerability scanning for CVEs, compliance findings, and SBOMs
  • Resource quotas preventing any single cluster from exhausting platform resources

Shared responsibility

Section titled “Shared responsibility”
Kupe managesYou manage
Pod security policies (non-root, no privileged)Application-level authentication
Network egress restrictionsSecrets rotation for your workloads
Runtime threat detectionKeeping application dependencies updated
Vulnerability scanningReviewing scan results for your workloads
Infrastructure patchingResponding to vulnerability alerts

How enforcement works

Section titled “How enforcement works”

When you deploy a workload, Kupe validates it before it runs. If it violates a required policy, the deployment is rejected with a clear error message explaining what to fix.

For example, deploying a container that runs as root produces:

Error: admission webhook denied the request:
Tenant containers must set runAsNonRoot: true and allowPrivilegeEscalation: false.

Some checks start in audit mode (violations are logged but allowed) before they become required.

Section titled “Related pages”