Your Sovereignty Journey¶

Evaluate

Discover secrets, assess risk

Install

Deploy operator + OpenBao

Protect Secrets

Inject into memory

Enforce

eBPF runtime blocking

Confidential computing

Each stage adds a layer of protection. You can stop at any stage and still have value - or go all the way to additional layers whose deployment prerequisites and limits need separate evidence.

1 Evaluate

Discover which workloads use Kubernetes Secrets (stored in etcd, readable by cloud provider). Assess your exposure before changing anything.

No cluster changes

Getting Started CLI: discover CLI: audit

2 Install

Deploy the cloudtaser operator (mutating webhook) and connect to your EU-hosted OpenBao. The operator watches for annotated pods but changes nothing until you annotate.

Score: +0 (ready state)

Install Operator Helm Values CLI: connect CLI: validate

3 Protect Secrets

Annotate workloads. The webhook injects the wrapper which fetches secrets from EU OpenBao directly into process memory (memfd_secret). Secrets never touch etcd.

Score: up to 55/75

Annotations CloudTaserConfig Migrate from ESO/Sealed/SOPS Memory Protection

4 Enforce

Deploy the eBPF daemonset and verify the actual states of its 37 catalogued kprobe syscall programs. Covered read-path denial does not prevent an authorised app from sending a secret it has copied or encoded. Application code, identity controls, kernel integrity and allowed egress remain trust boundaries; see the security model.

Score: up to 75/75

Install eBPF 37 Vectors Attack Surface Kernel Matrix

5 Encrypt Storage

Enable S3 proxy for object storage and DB proxy for databases. Data at rest is encrypted with EU-held keys before reaching the cloud provider. The provider stores only ciphertext.

Score: 75/75 + data sovereignty

S3 Proxy S3 Config DB Proxy Search Impact Encryption Protocol

6 Comply

Generate compliance evidence. Protection scores, audit reports, and framework-specific mappings for GDPR, DORA, NIS2, PCI DSS, ISO 27001, and more.

12 frameworks mapped

Regulatory Mapping All Frameworks CLI: audit Protection Score

7 Ultimate Protection

Deploy on confidential computing hardware (AMD SEV-SNP / Intel TDX). VM memory encrypted at CPU level. Combined with cloudtaser: zero access paths remain for the cloud provider.

Component checks do not establish an absolute confidentiality guarantee

Ultimate Protection Security Model Production Guide

Where Are You?¶

If you are...	Start at	You'll achieve
Exploring whether cloudtaser fits your needs	Stage 1: Evaluate	Understanding of your current exposure
Running a PoC on a staging cluster	Stage 2: Install → Stage 3: Protect	Secrets out of etcd, in process memory
Going to production for the first time	Stage 3 → Stage 4: Enforce	Full runtime protection (score 75/75)
Adding data-at-rest protection	Stage 5: Encrypt Storage	S3 + database encryption with EU keys
Preparing for a DORA/NIS2 audit	Stage 6: Comply	Framework-mapped evidence packages
A bank or government service assessing additional controls	Stage 7: Ultimate	Deployment evidence and explicit identity, application, kernel and compute limits

Each stage is independently valuable. You don't need to reach Stage 7 to benefit - Stage 3 alone removes secrets from etcd, which is the single biggest sovereignty risk in most Kubernetes deployments.