Configuring security

It is important to manage your cluster security, vulnerability, and risk assessment.

Customizing the Cloud Pak entry point
By default, the Cloud Pak Platform UI (Zen) is the main entrance to all the Cloud Pak services and capabilities. All the application URLs are hidden behind the Zen front door, which exposes a single hostname.
Customizing the Cloud Pak identity and access (IAM) service
The IBM Cloud Pak foundational service Identity and Access Management (IAM) is exposed on its own dedicated hostname. You can change this route hostname and customize the TLS certificate that is used to secure the route.
Managing certificates
You must monitor and manage the certificates that are deployed in your cluster. Cloud Pak for Business Automation generates self-signed certificates for all its servers, but you can provide your own CA certificate. You also need to import the certificates of the external services.
Configuring cluster security
Cluster security needs extra work and tools beyond Kubernetes to secure messages between its access points. While Kubernetes automates many of the tasks to deploy containerized applications, it does not manage the security of a cluster.
Verifying container image integrity
Container images for IBM Cloud Pak for Business AutomationIBM FileNet® Content Manager are signed by using GPG keys. You can verify the integrity of these images by using signature validation when you pull images by using Linux command-line tools. In Red Hat OpenShift, you can create a policy to enforce signature validation when your worker nodes pull images.

Parent topic: Administering