Compliance involves meeting best practices, guidelines, or regulatory requirements, and being able to prove it during audits. Traditional compliance approaches do not work when applied to containerized workloads and container images, which are the building blocks of cloud-native applications during runtime and build time, respectively.
Traditional compliance approaches depend on physically knowing where workloads are deployed, how many are deployed, how long they are deployed, and rely on perimeter-based access controls.
Compliance for containers and Kubernetes is not complex, it just requires the correct context from build to runtime.
In the world of cloud-native applications—including private cloud—the exact location, number, and duration of containerized workloads are dynamic based on specific timestamps.
And with the number of microservices and workloads within cloud-native applications growing, tracking which workload is calling another workload becomes challenging and difficult to track for compliance purposes.
Also, security vulnerabilities have to be identified and assigned rankings to take corrective action. Further, cloud-native applications require continuous compliance. The reporting has to be customized according to industry, company, organization, or team requirements.
Container and Kubernetes compliance refers to security controls and measures to ensure the protection of workloads and vulnerability management for container images.
Your container-based application running on Kubernetes will likely be required to meet compliance standards, so it’s best to start the journey sooner rather than later.
Organizations follow specific compliance guidelines for containerized workloads based on the standards for the industry in which they operate, as well as location-specific guidelines according to the geography of the organization and the customers they serve.
For example, a payment processing company operating out of Europe that has US customers will need to be compliant with PCI DSS, SOC 2, and GDPR. A health insurance provider in California, US will need to be compliant with HIPAA and CCPA.
You’ll need to make a list of different compliance standards you need to adhere to based on your industry and geographic region.
Copyright © 2023 Tigera, Inc.