Security

This page describes the infrastructure side of a GLYPH deployment as the chart ships it, so a security officer can review it and decide what to add. For GLYPH's cryptographic design, see the Security Model.

Statements here describe the current chart release. Where the chart leaves a decision to you, the page says so.

At a glance

Area	What the chart does	What you decide
Workloads	Non-root, no privilege escalation, all capabilities dropped, read-only root filesystem on the chart's own pods	Seccomp profile, pod security level, admission policy
Network	Default deny for inbound traffic, TLS at the gateway, TLS between frontend and server	The strict mesh mTLS policy (the reference setup enforces it), outbound rules, firewalling
Secrets	Holds no secret values and references Secrets by name	How Secrets are created, encrypted, and rotated
Data	Persistent volumes, plus an object bucket with Object Lock and versioning	Volume encryption, backups, retention
Permissions	Narrow chart permissions, plus the operators that automate the databases	Review and scoping of the operators
Images	Scanned by the maintainers with SBOMs	Mirroring, pinning, signature policy

Workload hardening

Workload	Runs as	Settings
Server	uid 1000, fsGroup 2000	runAsNonRoot, no privilege escalation, drop ALL capabilities, read-only root filesystem
Frontend	uid 101, fsGroup 2000	Same, with a writable /tmp as an emptyDir
Periodic jobs	uid 1000, fsGroup 2000	Same
wait-for-mongo init container	uid 1000	Same

Access control

Principal	Scope	Permissions
glyph-app-server service account (chart)	mongo.namespace	get, list, watch on mongodbcommunity resources, used by the wait-for-mongo init container
seaweedfs service account (subchart)	Cluster	ClusterRole glyph-app-seaweedfs-rw-cr: get, list, watch, create, update, patch, delete on pods, used to restart SeaweedFS master pods after a migration
MongoDB Community Operator	Application namespace, plus cluster	Role: manage Services, Secrets, ConfigMaps, StatefulSets, Deployments, Jobs, and Pods (including deletecollection) in its namespace. ClusterRoles: validating webhook configurations, Services, and read access to node and version information for telemetry
RabbitMQ Cluster Operator	Cluster	ClusterRole: create, get, list, update, and watch Secrets, ConfigMaps, PersistentVolumeClaims, ServiceAccounts, and Services; update pods and create on pods/exec; manage StatefulSets, Roles, and RoleBindings

Operator permissions

The chart's own permissions are narrow. The operators hold more, because they automate provisioning, scaling, and upgrades for MongoDB and RabbitMQ. The MongoDB operator runs in the application namespace and can read every Secret there, including the application Secret. The RabbitMQ operator holds cluster-wide permissions over Secrets. Both are upstream operators, so review them as you would any third-party software.

The SeaweedFS ClusterRole can be turned off with seaweedfs.global.seaweedfs.createClusterRole: false. Running without it has not been validated, so test first.

Network

Inbound

networkPolicy.enabled (default true) creates three policies in the application namespace:

1. Deny all inbound traffic to every pod.
2. Allow inbound traffic from any pod in the same namespace.
3. Allow inbound traffic to the frontend pods from outside the namespace, so the gateway can reach them.

The result is that nothing outside the namespace reaches MongoDB, RabbitMQ, the server, or object storage directly. NetworkPolicies only add permissions, so to limit the frontend policy further, for example to the gateway alone, set networkPolicy.enabled to false and supply your own policies.

Outbound

The chart does not restrict outbound traffic. The namespace needs DNS, the Kubernetes API (for the operators), and several external services, and each missing exception is only discovered when something breaks. If your policy requires egress control, build it from this list:

Destination	Used for	When
Vonage Video API	Meetings and huddles	When video is used
Firebase and web push services	Push notifications	When push is used
Amazon SES	System email	Always, unless arranged otherwise with SENTRIQS
Snowflake	Analytics jobs	Only if analytics or dailyMetrics is enabled
AWS Secrets Manager	Secret retrieval	Only if server.skipAwsSecrets is false
Image registries	Image pulls	Always

Encryption in transit

Connection	Protection
Browser to gateway	TLS with your certificate. Port 80 redirects to HTTPS.
Gateway to frontend	Mesh mTLS.
Frontend to server	Mesh mTLS.
Server to MongoDB	Mesh mTLS, plus SCRAM authentication.
Server to RabbitMQ	Mesh mTLS.
Server to object storage	Mesh mTLS.
Server to external services	HTTPS, outside the mesh.

With strict mTLS enforced, as in the reference setup, Istio encrypts and mutually authenticates every hop inside the mesh, whatever protocol the application speaks. The chart does not create that policy, so apply the PeerAuthentication shown in Installation and treat it as required. mTLS proves identity and encrypts, but it does not limit which workloads may connect, so add Istio AuthorizationPolicy resources if you need that.

Secrets

• No secret values in the chart. The chart and its values file hold only Secret names. You create the application Secret yourself.
• Environment variables. The application Secret reaches the server and job pods as environment variables, so exec access to those pods is equivalent to access to the secrets.
• Rotation. Ask SENTRIQS before rotating the token-signing and password-hashing secrets.

Data

Store	What it holds	Where
MongoDB	Application records	20Gi volume per member
Object storage	Files and archive material, with Object Lock and versioning	SeaweedFS volumes
RabbitMQ	Broker queues	10Gi volume

• Encryption at rest. The chart does not configure it. Use an encrypted StorageClass or encrypted volumes.
• Backups. The chart configures none. Plan backups for MongoDB and object storage, and test restores. SENTRIQS cannot read or recover your content, as described in the Security Model.
• Archiving keys. Archiving keys are shown once and cannot be recovered. See Archiving and Compliance.

Images and supply chain

• Scanning. SENTRIQS scans the GLYPH images and produces a CycloneDX SBOM for each. Ask SENTRIQS for the current report and SBOMs.
• Third-party components. The operators, cert-manager, Istio, and SeaweedFS are third-party software. Scan them in your own pipeline and track their advisories.
• Your controls. Mirror images into your own registry, pin them by digest, and enforce your signature and admission policy.
• Minimal database image. glyph-mongodb carries only the mongod binary on a small base, to reduce attack surface.

Reporting a security concern

Email support@sentriqs.com with "Security" in the subject line. Do not include secrets, keys, or customer data in the message. See Getting Support for what to include.