High level security considerations & status

High level list of security related items

In 0.8 release

• Client authentication via client certificates (tlsverify)
• Thumbprint validation of vSphere systems
• Authenticated access to vic-admin (logs and status, no control)
• Automated application of RBAC constraints to provided VCH operations user
• Proxy support
• Custom Certificate Authority bundles for validating private registries

Out of plan

vSphere

• Automated creation of RBAC constrained user for VCH operation
• Throttling of vSphere control plane operations (DDoS potential)
• Automated installation of persistent firewall rules

Virtual Container Host

• Certificate revocation
• VCH credentials hidden from guest
• Mutual authentication between containerVMs and VCH applianceVM on the management network

Registries

• Image signature validation (JWS signature on images registry)
• Registry white & black lists for secure registries