Security
Apeiro integrates security throughout its architecture, grounded in open standards and open-source components. It is a reference architecture and construction kit: platform operators and solution providers assemble, configure, and operate the components. Apeiro does not itself constitute a managed security service, a certified ICT[1] product, or a compliance program.
Architecture Orientation
Apeiro addresses security across multiple domains, each backed by specific open-source components:
- Network security: IronCore (declarative networking, L3 tenant isolation), Zero Trust Workload Identities (in development) for workload identity and mTLS
- Identity & authorization: Keycloak (OIDC-based authentication, identity federation); OpenFGA (Relationship-Based Access Control); Zero Trust Workload Identities (in development) for workload identity and mTLS
- Secrets & certificates: OpenBao (secrets management, PKI, certificate lifecycle)
- Key management: OpenKCM (customer-controlled encryption at-rest, BYOK/HYOK)
- Software supply chain: Open Component Model (provenance, signing), Open Delivery Gear (continuous compliance), Konfidence (SaaS application delivery governance, promotion gates)
- Security operations: CobaltCore (integrates Greenhouse and Heureka Security Posture Management), IronCore (cloud-native infrastructure telemetry), Audit Logging
- Crypto agility: Open Crypto Broker (algorithm governance, post-quantum path)
Security Documentation
The first three pages cover general framework topics. The remaining pages follow the defense-in-depth layers defined in Security Principles.
| Page | What it covers |
|---|---|
| Security Principles | Zero Trust, open standards, digital sovereignty, defense in depth |
| Scope & Shared Responsibility | What Apeiro provides vs. what operators own |
| Network Security | Zero Trust workload identity, IronCore declarative networking, CobaltCore for traditional workloads |
| Identity & Access Management | Authentication (OIDC, Keycloak), workload identity (Zero Trust Workload Identities, in development), authorization (OpenFGA ReBAC), federation |
| Secrets Management & PKI | OpenBao: secrets storage, certificate lifecycle, PKI |
| Key Management | OpenKCM: key hierarchies, BYOK/HYOK, pluggable KMS backends |
| Software Supply Chain Security | OCM provenance, ODG compliance, Konfidence SaaS application delivery governance |
| Security Operations | Greenhouse observability, Heureka security posture management, audit logging, incident response enablers |
| Emerging Threats | Open Crypto Broker, post-quantum path, supply chain threat visibility |
Platform Mesh Security
The Platform Mesh implementation has its own dedicated security page covering its specific authentication and authorization architecture, including OIDC-based identity federation with Keycloak, per-organization identity realms, and the two-tier RBAC + OpenFGA authorization model used within the Platform Mesh control plane. See Platform Mesh Security.
ICT: Information and Communications Technology; the term used in EU regulatory frameworks such as the Cyber Resilience Act. ↩︎