Assurance profiles

An assurance profile is what your security officer chooses for one cluster: compliance baseline, who holds the root keys, how nodes prove what they are, disk encryption, human sign-in strength, audit, how task records are signed, network posture, data residency and which agent tasks may run. It is data, not code: the portal form is rendered from a JSON Schema (draft 2020-12), the schema rejects impossible combinations, and the values become configuration of your cluster (Helm values and OpenTofu variables).

Status: In development. Schema version v1alpha1; it will change. Choosing a baseline selects the controls we map to; it is not a certification or authorization.

Presets

Preset	Summary
commercial-standard	NIST 800-53 Rev 5 Moderate, keys held by our management OpenBao (transit), cloud attestation
fedramp-high-like	GovCloud, your cloud KMS, TPM attestation, AAL3 sign-in
airgapped-dod-like	DoD IL6 overlay, your HSM, your hardware, no internet

The names describe intent (“like”): no preset is authorized by FedRAMP or DoD.

Rules the schema enforces

• Keys held by us (platform-transit) only for NIST Low or Moderate, never High, any FedRAMP baseline, CJIS, CMMC or DoD IL.
• Your KMS, HSM or Shamir custody each require their settings block.
• FIPS 140-3 required: custody must be your KMS or HSM, and Keycloak runs in FIPS strict mode.
• High baseline or FIPS: disk keys not static or node-derived; AAL2 or higher; immutable audit kept at least 365 days.
• TPM required: tpm_devid attestation with an approved TPM vendor list; not on Hetzner Cloud.
• AAL3: no synced passkeys; authenticator attestation direct or enterprise. CAC/PIV needs trust anchors.
• Air-gapped: no tunnel, no egress, your own registry, HSM or Shamir custody, no cloud attestors, no public Rekor, your hardware only.
• DoD IL5/IL6: US persons only; AWS GovCloud, Azure Government or your hardware only.

Profiles created through the portal form are checked against all of these; a subset is also enforced by the cluster API itself (Kubernetes CEL rules).

Field reference (generated)

Generated at build time from a vendored copy of assurance/schema.json in the portal repository (source commit recorded in vendor/portal-assurance/SOURCE of this site’s repository).

Schema https://zeta-reticuli.ai/schemas/assurance-profile/v1alpha1/schema.json: 115 fields.

Field	Type / allowed values	Required	Default	Description
apiVersion	const "assurance.zeta-reticuli.ai/v1alpha1"	yes
kind	const "AssuranceProfile"	yes
metadata	object	yes
metadata.name	string (pattern ^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$)	yes
metadata.tenant	string (pattern ^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$)	yes		SPIFFE trust domain becomes {tenant}.reti-infra.com
metadata.approvedBy	string			Security officer who approved this profile (name or email)
metadata.approvedAt	string (date-time)
compliance	object	yes
compliance.baseline	"nist-800-53-rev5-low" | "nist-800-53-rev5-moderate" | "nist-800-53-rev5-high" | "fedramp-low" | "fedramp-moderate" | "fedramp-high" | "fedramp-li-saas"	yes		Selects the OSCAL profile in /data/src/compliance/profiles/
compliance.overlays	array of "cmmc-l1" | "cmmc-l2" | "cmmc-l3" | "cjis" | "hipaa" | "pci-dss-4" | "dod-il4" | "dod-il5" | "dod-il6"
compliance.fips140_3Required	boolean		false	Every crypto module on the key path must be FIPS 140-3 validated
keyCustody	object	yes		Root of trust for OpenBao seal, Flux sops decryption and OpenTofu state encryption
keyCustody.mode	"platform-transit" | "customer-kms" | "customer-hsm" | "shamir"	yes		platform-transit: our management OpenBao transit. customer-kms: customer's cloud KMS (BYOK/HYOK). customer-hsm: pkcs11 or kmip HSM the customer owns. shamir: no auto-unseal, customer custodians.
keyCustody.kms	object
keyCustody.kms.provider	"awskms" | "gcpckms" | "azurekeyvault" | "ocikms" | "alicloudkms" | "ovhcloud" | "tcloudpublic"	yes
keyCustody.kms.keyRef	string	yes		Key ARN / resource id / vault+key name. Not a secret.
keyCustody.kms.region	string
keyCustody.kms.endpoint	string (uri)			e.g. a FIPS or GovCloud endpoint
keyCustody.kms.hsmBacked	boolean			Key lives in the provider's HSM tier (CloudHSM-backed, Managed HSM, Cloud HSM)
keyCustody.kms.keyOrigin	"provider-generated" | "byok-imported" | "hyok-external"
keyCustody.hsm	object
keyCustody.hsm.protocol	"pkcs11" | "kmip"	yes
keyCustody.hsm.model	string			Vendor and model, e.g. YubiHSM 2, Thales Luna 7
keyCustody.hsm.fipsCertificate	string (pattern ^[0-9]+$)			CMVP certificate number
keyCustody.hsm.fipsLevel	1 | 2 | 3 | 4
keyCustody.hsm.keyLabel	string
keyCustody.hsm.mechanism	string			PKCS#11 mechanism, e.g. CKM_AES_GCM
keyCustody.shamir	object
keyCustody.shamir.shares	integer [1..10]	yes
keyCustody.shamir.threshold	integer [1..10]	yes
keyCustody.shamir.custodians	array of objects	yes
keyCustody.shamir.custodians[].name	string	yes
keyCustody.shamir.custodians[].pgpKeyFingerprint	string (pattern ^[0-9A-F]{40}$)	yes
keyCustody.shamir.unsealDrillDays	integer [1..]		90
keyCustody.recoveryShares	object			Auto-unseal recovery key split (operator init -recovery-shares). Ignored for shamir.
keyCustody.recoveryShares.shares	integer [1..10]
keyCustody.recoveryShares.threshold	integer [1..10]
keyCustody.recoveryShares.heldBy	"customer" | "platform" | "split"
keyCustody.rotationDays	integer [1..730]		365
openbao	object	yes
openbao.voters	3 | 5	yes		Raft voters; each on a distinct physical host / failure domain
openbao.nonVoters	integer [0..4]		0
openbao.spreadAcross	"hosts" | "zones" | "regions"		"zones"
openbao.zones	array of string
openbao.snapshot	object
openbao.snapshot.intervalHours	integer [1..]		24
openbao.snapshot.retainDays	integer [1..]		30
openbao.snapshot.destination	string			Bucket URI in an allowed residency region
nodeAttestation	object	yes
nodeAttestation.methods	array of "tpm_devid" | "aws_iid" | "azure_msi" | "azure_imds" | "gcp_iit" | "k8s_psat" | "x509pop" | "join_token"	yes		SPIRE server node attestors allowed for this cluster
nodeAttestation.tpmRequired	boolean		false
nodeAttestation.approvedTpmVendors	array of string (pattern ^[A-Z0-9 ]{2,4}$)			TPM manufacturer IDs (TPM_PT_MANUFACTURER, 4-char) whose endorsement CA goes into tpm_devid endorsement_ca_path
nodeAttestation.secureBootRequired	boolean		true
nodeAttestation.allowSoftwareTpm	boolean		false	swtpm/vTPM without a manufacturer EK cert (lab only)
diskEncryption	object	yes
diskEncryption.keySource	"tpm" | "kms" | "tpm+kms" | "nodeID" | "static"	yes		Talos volume encryption key provider for STATE and EPHEMERAL (luks2)
diskEncryption.kmsEndpoint	string (uri)			gRPC KMS (siderolabs/kms-client protocol), not a cloud KMS API
diskEncryption.tpmPcrs	array of integer [0..23]		[7]
diskEncryption.lockToState	boolean		true
diskEncryption.providerDiskEncryption	boolean		true	Also require the cloud's volume encryption (CMK where supported)
identity	object	yes
identity.federation	array of objects
identity.federation[].protocol	"saml" | "oidc"	yes
identity.federation[].alias	string (pattern ^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$)	yes
identity.federation[].metadataUrl	string (uri)	yes
identity.federation[].requireSignedAssertions	boolean		true
identity.aal	"AAL1" | "AAL2" | "AAL3"	yes		NIST SP 800-63B-4 authenticator assurance level
identity.cacPivRequired	boolean		false
identity.x509TrustAnchors	array of "dod-pki" | "fpki-common-policy" | "customer-ca"
identity.webauthn	object
identity.webauthn.acceptableAaguids	array of string (pattern ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$)			Empty = any authenticator
identity.webauthn.allowSyncedPasskeys	boolean		true
identity.webauthn.attestation	"none" | "indirect" | "direct" | "enterprise"		"direct"
identity.ciba	object
identity.ciba.enabled	boolean		true
identity.ciba.expiresInSeconds	integer [30..600]		120
identity.session	object
identity.session.idleMinutes	integer [1..1440]		30
identity.session.maxHours	integer [1..720]		12
identity.session.reauthForPrivilegedMinutes	integer [1..1440]		15
identity.keycloakFipsMode	"off" | "non-strict" | "strict"		"off"
audit	object	yes
audit.sinks	array of objects	yes
audit.sinks[].type	"in-cluster-loki" | "s3-object-lock" | "syslog-tls" | "splunk-hec" | "customer-siem-otlp"	yes
audit.sinks[].endpoint	string
audit.retentionDays	integer [30..3650]	yes
audit.immutable	boolean		true	WORM / object lock in compliance mode
audit.sources	array of "kube-apiserver" | "openbao" | "keycloak" | "spire" | "talos" | "flux" | "agent-tasks"
evidenceSigning	object	yes
evidenceSigning.mode	"platform-key" | "customer-kms" | "keyless-spiffe"	yes		cosign signer for in-toto/DSSE task records
evidenceSigning.kmsUri	string (pattern ^(awskms|gcpkms|azurekms|hashivault)://)			cosign --key URI
evidenceSigning.rekor	"public" | "private" | "none"		"private"
evidenceSigning.fulcioUrl	string (uri)
network	object	yes
network.airGapped	boolean	yes
network.cloudflareTunnelAllowed	boolean		true
network.egressAllowList	array of string
network.registry	"platform-mirror" | "customer-harbor" | "customer-zot"		"platform-mirror"
network.platformSupportAccess	"none" | "break-glass" | "standing"		"break-glass"
residency	object	yes
residency.placements	array of objects	yes
residency.placements[].provider	"aws" | "aws-govcloud" | "azure" | "azure-government" | "gcp" | "oci" | "alibaba" | "tencent" | "ovh" | "hetzner-cloud" | "hetzner-dedicated" | "cherry" | "vultr" | "customer-metal"	yes
residency.placements[].region	string	yes
residency.usPersonsOnly	boolean		false
agentPolicy	object	yes
agentPolicy.digitalTasks	boolean	yes
agentPolicy.licensedTasks	"deny" | "with-human-approval" | "with-licensed-supervisor"	yes
agentPolicy.physicalTasks	"deny" | "with-human-approval" | "allowed"	yes
agentPolicy.allowedSocCodes	array of string (pattern ^[0-9]{2}-[0-9]{4}\.[0-9]{2}$)
agentPolicy.approval	object
agentPolicy.approval.spendUsdAbove	number [0..]
agentPolicy.approval.externalCommunication	"never" | "first-contact" | "always"		"first-contact"
agentPolicy.approval.dataExport	"never" | "always"		"always"
agentPolicy.approval.approvers	integer [1..3]		1	Distinct CIBA approvals (two-person rule = 2)
agentPolicy.models	array of string			Allowed model endpoints/families behind the gateway