Data controls in the DevSecOps life cycle

Integration Point

Description

Container Orchestration and Cluster

Data Control integrations in both container orchestration and the running cluster provide the same functionality as described below. Whether you are testing, releasing, deploying, operating or monitoring the cluster, these controls need to be considered. 

With Red Hat OpenShift Container Platform, you can enable etcd encryption, which provides an additional layer of data security for Secrets, Config maps, Routes, and OAuth tokens. This can help protect data if it's exposed to the wrong parties.

Data in-transit encryption is all about certificates and securing the ingress and egress traffic within a cluster. One of the many certificate types to address in the default API server certificate provided by the OpenShift Container Platform. For example, if you need clients outside of the cluster to access any running web applications, you’ll need to replace the certificate with a Certificate Authority that the client's trust. 

In order to centrally manage, store and further protect OpenShift keys and certificates for data controls, you’ll want to extend and enhance OpenShift Container Platform’s data security capabilities with certified partner software that centralizes data encryption across environments and adds layers of data protection. 

Red Hat’s partner ecosystem can help add:

• Data encryption on container data, file and volumes, 

• Control access to that data, 

• Provide data access audit logging,

• All through a centralized approach.

Data protection in a running cluster can also include discovering where sensitive data exists in your cluster, as well as analyzing data risks and uncovering suspicious activity against the data in rest.