Nest for Security Teams
Nest enforces tenant isolation and credential handling at the platform layer, so security teams are not relying on every application team to configure it correctly per resource.
Pain points
- Preventing cross-tenant data or network access on shared Kubernetes clusters.
- Ensuring encryption at rest for cloud-managed disks and buckets across multiple providers.
- Managing credentials for database and iSCSI access without exposing them in resource specs or Git.
How Nest helps
- A default-deny NetworkPolicy is created automatically in each tenant namespace on first provision, scoping egress to same-namespace traffic, DNS, and the gateway services — not left to each team to author. (First-Class Multi-Tenancy)
- AWS EBS/KMS, Azure Managed Disk/Key Vault, and GCP Persistent Disk/CMEK encryption at rest apply by default for cloud-managed volumes and buckets. (GA Cloud Provisioners)
- iSCSI CHAP authentication is auto-provisioned per DataResource — a generated secret scoped and owned by the resource — so credentials never need to appear in a spec or manifest. (Block, File & Object Storage)