Infrastructure & Deployment exit conditions
Candidate exit conditions for the Infrastructure & Deployment type. See the catalog overview for how to adopt these.
This type covers the runtime and deployment surface — container and host hardening, image provenance, network posture, and the CIS Benchmark controls a platform team expects before a service goes live.
|
This is a defined, tiered Definition-of-Done type, but it ships no default-library conditions yet. When you deploy to Akka Automated Operations (AAO), these controls are asserted by the platform, which runs the hardened, benchmarked runtime. Off AAO, the ids below are candidates for inspiration — adopt one by authoring or provisioning its covering auditor. |
Host and container hardening
| Exit condition | What it checks |
|---|---|
|
The runtime satisfies the applicable CIS Benchmark profile for its host and orchestrator. |
|
Containers run as a non-root user with no writable root filesystem. |
|
No container runs privileged or with host namespaces mounted. |
|
CPU and memory limits are declared for every workload. |
Network and transport
| Exit condition | What it checks |
|---|---|
|
Traffic to and between services is encrypted in transit with an enforced minimum TLS version. |
|
A default-deny network policy scopes which workloads may reach the service. |
|
Runtime secrets resolve from an external store, not from the image or environment defaults. |
Image and deployment provenance
| Exit condition | What it checks |
|---|---|
|
The deployed image is signed, and its signature is verified at admission. |
|
The image passes a vulnerability scan against a current advisory database before deploy. |
|
The deployment is produced from committed, versioned configuration with no manual drift. |