Security, Identity & Trust Evaluates inbound pod creation requests against defined OPA/Kyverno policies, injects required service mesh sidecars, and validates security contexts within 10 milliseconds.
Validating WebhookMutating WebhookKyvernoMutatingAdmissionWebhookValidatingAdmissionWebhook+4 more
Security, Identity & Trust Generates a new key version in KMS, updates the primary key alias pointer for new encryption operations, and maintains older key versions in read-only state for historical decryption.
Automated RotationLifecycle ManagerKey VersioningCryptoperiodAlias Pointer+3 more
Security, Identity & Trust When an application needs to encrypt or decrypt data, KMS uses envelope encryption: it generates a unique plaintext Data Encryption Key (DEK) alongside an encrypted DEK cipher wrapped by a root Customer Master Key (CMK) secured inside hardware security modules (HSMs). The application uses the plaintext DEK locally in volatile memory and discards it after use, ensuring the root key never leaves the hardware boundary.
KMSCrypto ServiceEnvelope EncryptionCMKDEK+5 more
Security, Identity & Trust Collects logs from container stdout/stderr, syslog daemons, and application log files, parses raw lines into structured JSON, enriches events with contextual metadata (traceId, host, pod), streams them into distributed index shards, and applies automated retention policies.
SecurityIntegrationMonitoringTimeoutCrash+1 more
Security, Identity & Trust Authenticates devices during setup, pushes mandatory OS configuration profiles (disk encryption, VPN, Wi-Fi certs, passcode rules), inventories installed software, monitors security patch levels, and restricts enterprise access for non-compliant hardware.
SecurityIntegrationMonitoringTimeoutCrash+1 more
Security, Identity & Trust When a user provides valid primary credentials (username/password), the MFA Gateway generates an authentication challenge via the user's enrolled factor, validates the submitted cryptographic response or token, and issues an authenticated session token upon success.
Multi-Factor Authentication2FA ServerTOTPWebAuthnFIDO2+4 more
Security, Identity & Trust Discovers running workloads, maps their cryptographic identities and metadata tags (namespace, service account, role), dynamically compiles fine-grained security policies into kernel-level eBPF or iptables filter rules, and drops unauthorized east-west network packets between internal workloads.
SecurityIntegrationMonitoringTimeoutCrash+1 more
Security, Identity & Trust Receives raw packet streams from network SPAN/mirror ports, reassembles fragmented TCP packets into contiguous stateful streams, evaluates payload bytes against signature rules (e.g., Suricata, Snort) and behavioral heuristics, and emits high-fidelity security alerts and telemetry to a centralized SIEM/SOC platform upon identifying malicious patterns (such as port scans, SQL injections, or unencrypted C2 beacons).
Network Intrusion Detection SystemPort MirroringSignaturesPCAPLateral Movement+3 more
Security, Identity & Trust Intercepts raw network packets at wire speed in the inline data path, performs stateful protocol verification, reassembles TCP streams, and evaluates signatures against incoming payloads. If a packet matches a verified attack pattern (e.g., remote code execution payload or brute-force exploit), the IPS immediately drops the packet, sends a TCP RST (reset) to terminate the socket connection, and blacklists the offending source IP at the firewall.
Intrusion Prevention SystemNext-Gen Firewall FeatureInline blockingFail-openDeep Packet Inspection+3 more
Security, Identity & Trust Coordinates authorization grant flows (such as Authorization Code Flow with PKCE or Client Credentials Flow). Upon verifying client credentials and user authentication, it generates short-lived access tokens containing scoped permissions, signs tokens with private keys exposed via a public JWKS endpoint, issues long-lived refresh tokens, and provides token introspection and revocation APIs.
Authorization ServerToken ServerAccess TokenRefresh TokenScopes+4 more
Security, Identity & Trust Authenticates users via username/password, hardware security keys, or biometric multi-factor authentication (MFA). Exposes standard metadata endpoints (.well-known/openid-configuration), authenticates client credentials, and issues digitally signed RS256/ES256 ID Tokens containing identity claims (subject ID, email, roles, issuance timestamp) alongside access tokens.
OPOpenID ProviderID TokenJWTAuthorization Code Flow+4 more
Security, Identity & Trust A service (such as an API gateway, Kubernetes admission controller, or microservice) dispatches an evaluation query with context data in JSON format to the OPA engine. OPA executes preloaded Rego policy rules in-memory against local cache documents and the input query, returning a deterministic boolean allow/deny decision or structured JSON decision payload with microsecond latency.
Open Policy AgentPolicy Decision PointRegoDecoupled PolicyPolicy as Code+4 more
