Security and IAM
Data boundary
Trinetra runs in the customer's Kubernetes environment. Discovery calls, validation actions, operational state, and evidence remain within customer-controlled cloud resources, except for minimal entitlement validation with the LNP Technologies licence service. Evidence is written to customer-selected object storage.
The runtime contains the components required to operate Trinetra. Licence signing keys are not shipped in the application image. Browser-delivered user-interface code remains inspectable, as with any web application.
Shared responsibility
| Control | Customer | LNP Technologies / product |
|---|---|---|
| Cloud scope, IAM, Kubernetes, network, and evidence storage | Owns configuration and approval | Documents supported integration points |
| Target selection and change authorization | Approves and schedules | Enforces supported safeguards and confirmations |
| Workload identities and credentials | Creates, rotates, and revokes | Does not require reusable private keys in values |
| Evidence retention and access | Defines policy and access | Records evidence identity and digest |
| Entitlement issuance | Supplies customer and installation information | Issues and validates signed entitlements |
| Product updates | Reviews and deploys | Publishes versioned packages and release notes |
Least privilege
Use separate workload identities for controller, UI, and probe components. Grant read access for discovery and only the mutation permissions required by customer-approved scenarios. Scope evidence writes to the selected object store rather than a broad cloud account where possible.
Provider-specific role mappings belong in the integration guide. Google Cloud customers should review Google Cloud Marketplace BYOL. Role names are examples and do not replace the customer's IAM review.
Network guidance
- Keep the UI private by default.
- External ingress is optional and not installed by the chart. If required, follow the customer-managed HTTPS ingress procedure, use identity-aware controls, and restrict source networks.
- Allow only the outbound cloud APIs required by enabled integrations and
license.trinetraplatform.com. - Do not expose the controller publicly.
Secrets
Store and rotate credentials using customer-approved secret controls. Do not place licence private keys, cloud private keys, kubeconfig files, activation keys, or reusable credentials in Helm values, documentation, tickets, or evidence.