Skip to content
Cloudkeel-DD Docs

Security model

Cloudkeel-DD is designed to be safe to point at production: it runs in your cluster, reads with least-privilege credentials, and never writes to your cloud.

Read-only, always

Section titled “Read-only, always”
  • No writes to your cloud. Cloudkeel-DD never creates, updates, or deletes cloud resources, and never runs terraform apply. Every connection guide uses a read-only credential.
  • No auto-remediation. It produces a revert plan for drift; acting on it stays with you.
  • The least-privilege reference lists the exact permissions each credential needs — all read/list/get, nothing mutating.

What it reads

Section titled “What it reads”
SourceWhat it reads
Terraform Cloud / state bucketYour .tfstate (desired resource config)
Cloud APIs (Azure/AWS/GCP)Live resource configuration in enabled scopes
Kubernetes APIHelm release records + live workload specs

What it never reads or stores

Section titled “What it never reads or stores”
  • Kubernetes Secret contents are excluded from comparison entirely — secret values never land in a diff.
  • It reads Helm’s own release secrets only to learn desired state (the rendered manifest), and still never diffs Secret objects.
  • It does not read your source code, CI logs, or anything outside the integrations you connect.

Credential handling

Section titled “Credential handling”
  • Connected credentials are encrypted at rest with your install’s immutable Fernet key.
  • Credentials are supplied by you and scoped narrowly (a bucket, a subscription, a cluster). Rotating them is a mint-new-key-then-update flow — see troubleshooting.

Network & data residency

Section titled “Network & data residency”
  • All data — inventory, findings, encrypted credentials — stays in your PostgreSQL inside your cluster.
  • Outbound calls go only to the endpoints you connect: your Terraform backend, your cloud, your clusters. The site and app make no third-party calls.
  • The UI is reached via kubectl port-forward by default, or through your own ingress if you opt in — terminate TLS there in production.

Application security

Section titled “Application security”
  • All container images run as a non-root user.
  • The API enforces authentication; sessions are signed with the JWT secret.
  • Rate limiting protects the API (configurable).
  • Policy evaluation (OPA) is best-effort — a broken or absent policy engine degrades gracefully and never fails a scan or exposes data.

Tenancy

Section titled “Tenancy”

Each install serves your organization’s tenant(s). Integrations, scopes, resources, and findings are isolated per tenant.