Shared responsibility model
Cloudfleet Kubernetes Engine (CFKE) is a managed Kubernetes service. Cloudfleet operates and secures the control plane and the platform that connects your nodes to it. You decide what runs in the cluster and on which infrastructure, and you secure your workloads and your cloud accounts. Where the line falls depends on how your nodes are provisioned.
Overview
| Area | Cloudfleet | You |
|---|---|---|
| Control plane | Operates, scales, patches and upgrades the Kubernetes API server, controllers, scheduler and the cluster data store. Backs up the cluster data store. | Use the Kubernetes API efficiently. See Control plane scalability. |
| Auto-provisioned nodes | Provisions, replaces and deletes nodes in your cloud account, and configures the operating system and the Kubernetes components on them. | Provide the cloud account and the permissions CFKE needs. Your cloud provider bills you directly for the nodes. |
| Self-managed nodes | Installs and manages the Kubernetes components: kubelet configuration, certificate rotation and networking. | Own the machine, its operating system and its network: hardware failures, operating system updates, capacity and lifecycle. |
| Cluster networking | Encrypts all traffic between nodes with WireGuard® and enforces network policies on every node. | Write the network policies that decide which workloads can talk to each other, and decide what you expose. |
| Workloads | Runs them on your nodes. | Secure your container images, application configuration and the data in your applications. |
| Access to the cluster | Restricts and audits staff access to control plane components. | Manage your Cloudfleet users and Kubernetes RBAC, and the cloud permissions you grant to workloads. |
| Encryption keys | Encrypts the cluster data store at rest. | With Confidential Control Plane, hold the key that protects all cluster data. |
Control plane
Each cluster has its own control plane, which Cloudfleet operates in the control plane region you choose. Cloudfleet keeps it available and scales it with your usage, applies security patches, and upgrades your clusters to new CFKE and Kubernetes versions. The cluster data store is encrypted at rest and backed up. See Security and data protection for where the data is stored and who can access it.
You use the control plane through the Kubernetes API. How your workloads, controllers and tools call it affects its performance. See Control plane scalability.
Nodes
With node auto-provisioning, Cloudfleet creates nodes in your cloud account when your workloads need them and removes them when they do not. Cloudfleet replaces failed nodes and configures the operating system and the Kubernetes components. Running nodes are not upgraded in place. New nodes join with the control plane’s current Kubernetes version. You can drain a node to replace it sooner. You provide the cloud account and grant CFKE the permissions it needs, as described in Fleet configuration. The permissions are limited to the resources CFKE creates.
With self-managed nodes, you own the machine. You are responsible for its hardware, its operating system and operating system updates, its network and firewall, and its capacity. Cloudfleet manages the Kubernetes components on it and does not replace failed self-managed nodes. To upgrade a self-managed node to the control plane’s version, add it again. See Self-managed node issues for the boundary in practice.
Networking
CFKE encrypts all traffic between nodes with WireGuard®, including traffic between nodes in the same private network. Cilium enforces network policies on every node, and Hubble records network flows. You decide which workloads can talk to each other and which services you expose, with network policies and Services. See Network security.
Workloads and data
You are responsible for what runs in your cluster: your container images and their vulnerabilities, your application configuration, the Secrets you store, and the data your applications process. Back up the data of your applications, for example the persistent volumes they use. Cloudfleet backs up the cluster data store to restore the control plane, not your application data.
Identity and access
You manage who can use your clusters: the users of your Cloudfleet organization, Kubernetes RBAC in each cluster, and the cloud permissions you grant to workloads through workload identity. Cloudfleet staff operate the control plane under the access controls described in Access by Cloudfleet staff.
Encryption keys
By default, the cluster data store is encrypted at rest with keys managed by the infrastructure provider. On Enterprise clusters, Confidential Control Plane encrypts every Kubernetes object with a key you hold in your own cloud KMS or HSM. You are then also responsible for the availability of that key, its backup and its rotation. See Shared responsibility model in Confidential Control Plane.
Security incidents
Cloudfleet notifies you of a personal data breach affecting your data within 24 hours of becoming aware of it. Report security issues in the platform to [email protected]. Incidents in your own workloads, images and cloud accounts are yours to detect and handle.