Skip to content

Secrets and certificates — edge cluster standard

Purpose

Minimum security norms for kubeconfig, join tokens, TLS, and application secrets on farm edge clusters—aligned with Remote access and operational security model — two-site smart farm.

Drill: Runbook — backup validation and recovery drill Drill F.

Standard

# Rule
1 No plaintext secrets or kubeconfig in public Git—use Sealed Secrets, SOPS, external secret store, or private vault per team policy.
2 Join tokens and API credentials are rotated on compromise or personnel change—document who may re-issue.
3 TLS for ingress and backup targets: document issuer (Let's Encrypt, internal CA) and renewal owner; alert on expiry where possible.
4 Rancher (if used): retain encryption config for backups outside operator artifacts (Kubernetes platform backup / DR).
5 Break-glass: one offline copy path for cluster recovery secrets (encrypted)—tested annually or when DR policy changes.