DOKS Security

Shared responsibility: DO secures control plane, hypervisor, and physical infrastructure. Customers secure workloads, RBAC, network policies, and secrets. DOKS provides OIDC SSO, private clusters, and Cilium network policies at no extra cost.

OIDC SSO (GA June 2026): Any standard OIDC provider. Per-cluster configuration. Dedicated kubeconfig per user. RBAC: Full K8s RBAC + DO IAM team roles for two-layer authorization. Private Clusters: No public IPs on workers. Outbound via VPC NAT Gateway. Cilium Network Policies: eBPF-based L3-L7 enforcement (HTTP, gRPC, Kafka-aware policies). Hubble observability. VPC Firewall: Stateful rules on worker nodes.

Encryption at Rest: etcd encrypted, boot volumes encrypted, PVs AES-256 encrypted. Encryption in Transit: TLS 1.2+ for API server, node-to-CP, etcd peering. Automatic Security Patches: Control plane + worker node OS. CIS Benchmarks: Workers hardened per CIS K8s guidelines. Audit: K8s audit logs + DO audit log for team actions. Secrets: External secrets management via Vault or Sealed Secrets recommended for production.