Security

Three layers, each consuming the one before it: OpenBao is the cluster’s secrets and PKI backend; PKI & Secrets covers how cert-manager and External Secrets Operator pull certificates and credentials out of it into the cluster; Policies covers what’s enforced once a workload is running — Kyverno admission, CiliumNetworkPolicy default-deny, and pod security context.

These pages describe how the platform implements security. The rules themselves — required security-context fields, RBAC conventions, IAM scoping — are the Platform Constitution; this section links to it rather than restating it.