Encryption
OSC uses encryption to protect data in transit and at rest across the managed platform.
Connections to platform endpoints and Kubernetes APIs use TLS. Communication between managed Kubernetes components is authenticated and encrypted, including the connection between a Shoot and its hosted control plane.
Persistent storage is encrypted by the platform. Encryption protects physical media and stored volumes against unauthorized access outside the running service context. Object storage also uses service-level access controls and encrypted transport.
Encryption keys required for the standard platform service are managed as part of OSC operations. Where customer-controlled key models or confidential computing are available, they provide additional protection for workloads with higher trust requirements.
Confidential computing is aimed at data in use. It reduces the trust placed in the host operating system and hypervisor by running sensitive code and data in an attested execution environment.
Confidential computing is an optional workload architecture, not a transparent property of every Kubernetes application.
Customers remain responsible for application-level secrets, certificate use and any encryption performed inside their applications. Platform encryption protects the service foundation, while application encryption protects business data according to the application's own threat model.