[{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/tags/2026/","section":"Tags","summary":"","title":"2026","type":"tags"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/tags/cyclades/","section":"Tags","summary":"","title":"Cyclades","type":"tags"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/categories/europe/","section":"Categories","summary":"","title":"Europe","type":"categories"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/voyages/europe/","section":"Travels","summary":"","title":"Europe","type":"voyages"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/tags/folegandros/","section":"Tags","summary":"","title":"Folegandros","type":"tags"},{"content":"","date":"27 janvier 2026","externalUrl":null,"permalink":"/tags/gr%C3%A8ce/","section":"Tags","summary":"","title":"Grèce","type":"tags"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/tags/greece/","section":"Tags","summary":"","title":"Greece","type":"tags"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/","section":"Le Site de François","summary":"","title":"Le Site de François","type":"page"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/tags/milos/","section":"Tags","summary":"","title":"Milos","type":"tags"},{"content":"","date":"27 janvier 2026","externalUrl":null,"permalink":"/tags/santorin/","section":"Tags","summary":"","title":"Santorin","type":"tags"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/tags/santorini/","section":"Tags","summary":"","title":"Santorini","type":"tags"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/tags/sifnos/","section":"Tags","summary":"","title":"Sifnos","type":"tags"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":"Two weeks in the Cyclades: four islands — legendary Santorini for the caldera and cliff-top villages, Folegandros for its understated charm, Sifnos for food and beaches, Milos for volcanic coves and the lunar landscape of Sarakiniko.\nDay 1: Brussels → Santorini # Santorini (Thira) is the most iconic island in the Cyclades: a volcanic caldera with white-and-blue villages clinging to the cliffs. The eruption that shaped it, around 1600 BC, remains at the heart of its identity.\nFor once, we take the train this year — the flight only leaves around 11 a.m. Flight to Santorini via Athens, arrival a little later than planned. Pick up the rental car at the airport, then check in at Aura Marina Apartments in Akrotiri (about a 20-minute drive) — warm welcome from Georges, pool facing the caldera.\nSunset caldera view from the apartment First evening in Akrotiri, a village in the south of the island, quieter than Fira or Oia: white lanes, a Venetian castle above, and the neighbouring archaeological site (the « Pompeii of the Aegean ») close by. Dinner at restaurant Mitseli.\nIsland specialities:\ntomatokeftedes — local cherry-tomato fritters with mint and herbs fava — yellow split-pea purée (PDO), velvety and naturally mild white eggplant — low in seeds, almost no oil when fried; excellent as melitzanosalata chloro — fresh, creamy artisan goat\u0026rsquo;s cheese Day 2: Santorini # Breakfast at café Akrothiri in the village of the same name (less than a 10-minute walk from the apartment), then the classic caldera hike: Fira → Oia (~10 km). We park in a free car park in Imerovigli, a little below the bus stop. Fira, the administrative capital, stretches along the cliff with shops and museums; the path leaves from there, sea on the left, white villages in the distance, as far as Oia, the postcard village of the Cyclades — blue domes, cave houses and legendary sunsets. Better to arrive mid-afternoon than at sunset hour if you still want room to breathe.\nStart of the Fira to Oia hike We even meet tortoises along the trail Previous Next Arrival in Oia and Agios Giorgios church\nIce-cream stop with toppings for the kids at ChillBox before heading back. Buses are flagged down at the stop — ticket €2.20.\nTypical Cycladic dome and bell tower on the way back to the car park Day 3: Santorini # To Kamari, east-coast resort with black pebbles and a developed seafront. From there, climb to Ancient Thera, a Hellenistic city perched on Mesa Vouno: temples, agora, theatre and plunging views over both bays — Kamari on one side, Perissa on the other. Entry €10 (free for under-18s and students).\nDown to Perissa, Kamari\u0026rsquo;s longer twin, same black sand, a freer atmosphere. Boat Perissa → Kamari and a swim. Lunch at Corner Food Diner (Greek omelette and more).\nDay 4: Santorini # Morning pool and terrace coffee at Daily Coffee. Back to Oia: Sunset parking if the free one is full. Walk through the village, then down to Amoudi, the small harbour at the foot of the cliff — feet-in-the-water tavernas, fishing boats, and a few rocks for a swim away from the crowds. Lunch near the windmills at Ellenika — vine leaves, anchovies, octopus salad, souvlaki and a glass of Vinsanto.\nAfternoon at Vlychada: the Tomato Museum, a former industrial site reimagined, tells how the island lived from canning before tourism. Just beside it, the long black-sand beach under ochre cliffs — the same colour as the old factory chimney. Quieter than Kamari or Perissa, a bit more swell, cooler water.\nEnd of the day in Pyrgos, the island\u0026rsquo;s former capital, on a hill in the centre of Santorini. Park below (the upper lot fills up) and climb to the Castro after greeting three colourful donkeys — great view from a little square where you can sip a drink. A windy meltemi Sunday: shops in Pyrgos and Megalochori closed; a Carrefour Express in Emborio, a medieval village of narrow lanes, saves the day for bruschetta and Greek salad at the apartment.\nDay 5: Santorini → Folegandros # Last morning in Akrotiri: walk up to the Venetian castle, coffee at Café Akri (open only two weeks, lovely Cycladic décor — cappuccino, orange juice, and the classic freddo espresso / freddo cappuccino). Attempt at Red Beach, a cove of red pebbles under lava cliffs: packed car parks, too tight before returning the car — we skip it.\nTo Athinios port, Santorini\u0026rsquo;s « new » harbour tucked into the caldera. The Seajets runs a little late; peaceful crossing to Folegandros, a small, well-preserved island often compared to Santorini before mass tourism.\nAt the harbour, the white Nissan from Kountouris is waiting. Check-in at Levanda house, Lithia Villas (~1.5 km from Chora) — fruit, water and breakfast in the fridge, tips from Hari, pool with sea views.\nEvening in Ano Meria, farming hamlet in the west: low houses, dry-stone walls, far from postcard scenery. Mezze at taverna Irini, then up to Panagia monastery above Chora — the medieval capital, Venetian Kastro, paved lanes and church squares. Outstanding sunset from Panagia. Stroll through Chora, dinner at To Zik.\nUseful links: folegandros.gr and trails at routes.folegandros.gr.\nIsland specialities:\nmatsata — handmade fresh pasta, often with rabbit or rooster stew soufiko — summer vegetable stew in olive oil thyme honey — from the island\u0026rsquo;s dry hills kakavia — fisherman\u0026rsquo;s soup of the day Day 6: Folegandros # Breakfast on the Cycladic-coloured terrace. Hike Ano Meria → Livadaki on the monopatia — follow FL signs and blue dots. Livadaki is an enclosed cove, turquoise water, mainly reached on foot: the descent is rewarded with a swim almost alone. Climb back and lunch at taverna Irini (marsala chicken, Greek salad, aubergine, courgette, lemon-sauce meatballs…).\nPool time, then evening in Chora: visit the Kastro, the fortified core where houses still form a rampart, dinner at To Spitiko in a quiet lane.\nDay 7: Folegandros # Hike towards Fira and Agali beaches via Christos church. Fira (not to be confused with Santorini\u0026rsquo;s) is a small, almost empty pebble beach; Agali, lower down, is the main sandy bay on the south coast, with tavernas and easier access — the contrast is worth it. Swim at Fira almost alone; at Agali we save the swim for later with the whole family.\nAfternoon snack in Ano Meria at Chrisospila Honey Coffee \u0026amp; Shop, then back to Agali together — swim and a short climb towards Agios Giorgios, a chapel above the bay. Evening in Chora: dinner at Eva\u0026rsquo;s Garden (courtyard garden), then watermelon pie and ice cream at Parasagas.\nDay 8: Folegandros → Sifnos # Quiet morning in Chora (photos without the crowds), bread at Pascalis Bakery, last pool session. Part of the group stays at Karavostasis, the island\u0026rsquo;s port — sandy beach, Anemomilos windmills nearby, more village than resort. The others hike to Katergo (~30 min return): pebble beach under cliffs, very clear water, few people even in season — a boat drops a few passengers, but the cove stays far from crowded.\nExcellent mezze on the beach at I Pardalo. Return the car, Seajets a little late, stop at Milos before Sifnos, island of Cycladic gastronomy and potters.\nPick up the car at Kamares, the main harbour in a crescent bay, groceries at AB supermarket, check-in at Villa Irini in Platis Gialos — long southern sandy beach, seafront restaurants, pool at the apartment.\nIsland specialities:\nrevithada — chickpeas slow-cooked overnight in the village oven mastelo — lamb or kid with red wine and dill in a clay pot melopita — fresh myzithra and thyme-honey pie amygdalota — soft almond cakes Trails: Sifnos Trails.\nDay 9: Sifnos # Walk on foot: Apollonia, Sifnos\u0026rsquo;s capital, is built around « steno » lanes of shops and tavernas; then Artemonas, a more residential area with neoclassical mansions and gardens; then Kastro, a medieval fortified village clinging to the cliff — churches tucked into the walls, labyrinth lanes, sea views everywhere. Drink and visit, coffee near the bus stop, bus back to Apollonia (€2.20/person).\nPool and beach in the afternoon. Dinner in Faros, a small south-east harbour, at Ammos — open for a month, very good.\nDay 10: Sifnos # Beach morning and paddle rental at Platis Gialos (life jacket required). Then hike Faros → Chrysopigi monastery (~35 min, well-maintained path): the white monastery sits on a thin spit between two coves, Glyfo and Apokofto — one of Sifnos\u0026rsquo;s most photographed views. Option to jump from the rocks near the monastery. Snack stop at Ammos (Django ice cream, Greek halva). Evening in Artemonas.\nDay 11: Sifnos # Morning in Vathi bay, a peaceful fjord on the west of the island: calm water, potters still at work, restaurants on the sand. Lunch at the beach restaurant.\nAfternoon walk Kastro → Agia Ti Poulati from the car park: white Byzantine church facing the sea, one of Sifnos\u0026rsquo;s finest viewpoints. Then on to the Chapel of the Seven Martyrs, a tiny white church stuck to the rock at the end of Kastro — postcard cliché, but earned. Ice cream at Way Cup Coffee and Julius in Platis Gialos.\nDay 12: Sifnos → Milos # Coffee at Way Cup, then Seajets to Milos, a volcanic island with more than 70 beaches in varied colours. Pick up the car, first look at the fishing harbours: Mandrakia and Firopotamos, with their syrmata — brightly painted boat shelters glued to the cliff at water level. Quick stop at Sarakiniko, the lunar bay of white rocks sculpted by wind and sea — already a little in the shade; we will come back early morning. Dinner near the lodging at Alivromelos.\nIsland specialities:\npitarakia — fried half-moon pastries with fresh cheese ladenia — tomato, onion and olive-oil focaccia Milos capers — hand-picked from volcanic cliffs Milos kakavia — fisherman\u0026rsquo;s soup with a mineral edge Day 13: Milos # Breakfast at Katrami and bakery Artepimata… Kai Alla (watermelon pie, croissants…).\nTo Fyriplaka, a large sand-and-pebble beach under ochre and red cliffs: one of the most accessible on the south coast, with SUP, kayak (to neighbouring Tsigrado, a dramatic enclosed cove) or boat without a licence. Then Paleochori, a little further east: longer beach, turquoise water, coloured cliffs — we reach the sand via the cliff path from the upper car park rather than the lower one.\nGroceries in Apollonia, pool time, then sunset from Plaka castle. Plaka, hilltop village and « capital » of Milos, is a maze of white lanes; from the castle the view takes in Adamas, the bay and, on a clear day, neighbouring islands.\nDay 14: Milos # Day at sea with Odysseus (Milos \u0026amp; Poliegos). The plan shifts because of the wind: three stops. Kleftiko, a corridor of white cliffs, arches and caves where pirates once hid — swim in unreal blue water, reachable only by boat. Gerakas, a wilder, lesser-known cove. A final beach to finish.\nDinner at Rizes in Trypiti, the village next to Plaka above Klima: early Christian catacombs, ancient theatre, and the spot where the Venus de Milo was found. Then Loukoumades in Plaka for honey-fried doughnuts.\nDay 15: Milos → Brussels # Early return to Sarakiniko just after 8 a.m. — still quiet, the white light on the volcanic rock is worth it before the cruise coaches. Drinks at Ice Monkey in Adamas, Milos\u0026rsquo;s main port, with a sea view. Picnic from Artemis bakery, then the tiny Milos airport and the flight via Athens.\nPractical information # Flights # Outbound — Brussels → Santorini (day 1)\nLeg Departure Arrival Duration Airline Aircraft 1 11:15 a.m. Brussels-National 3:15 p.m. Athens El. Venizelos 3h00 Aegean Airlines Airbus A321neo Layover in Athens 1 h 55 2 5:10 p.m. Athens El. Venizelos 6:00 p.m. Santorini 0h50 Aegean Airlines Airbus A320 Return — Milos → Brussels (day 15)\nLeg Departure Arrival Duration Airline Aircraft 1 2:30 p.m. Milos 3:10 p.m. Athens El. Venizelos 0h40 Olympic Air ATR 42 Layover in Athens 1 h 30 2 4:40 p.m. Athens El. Venizelos 7:05 p.m. Brussels-National 3h25 Aegean Airlines Airbus A321neo Ferries (Seajets) # Day Route Departure Arrival 5 Santorini → Folegandros ~2:40 p.m. — 8 Folegandros → Sifnos ~3:50 p.m. via Milos 12 Sifnos → Milos morning — Book on Seajets, Ferryhopper or Ferryscanner. Timetables can shift on the day.\nCar rental # Island Company Vehicle Duration Price Pick-up Drop-off Santorini CarHub Fiat or similar Days 1–5 €210 (taxes and third-party insurance) Airport Athinios port / airport Folegandros Kountouris Car Rentals Nissan 3 days €240 (basic insurance) Port Port Sifnos Loukataris Peugeot 208 or similar Days 8–12 €320 Kamares port Kamares port Milos Extreme Rentals Group B manual Days 12–15 — Milos port Milos airport Accommodation # Island Lodging Notes Santorini Aura Marina Apartments Akrotiri, caldera pool — Georges Folegandros Lithia Villas (Levanda house) ~1.5 km from Chora, sea view — Hari Sifnos Villa Irini Platis Gialos, pool Milos Petra Residence Mini Pool \u0026amp; Spa — Activity list # Santorini # Villages \u0026amp; sites # ⭐ Must-see — Akrotiri prehistoric site — buried Minoan city (the « Pompeii of the Aegean ») Megalochori — lanes, bell towers and cave houses; pleasant in the evening ⭐ Must-see — Pyrgos — former capital, Venetian castle, 360° views; less crowded than Oia Emporio — medieval kastro, narrow lanes and windmills Vothonas — houses carved into the rock; off the bus routes Canava / wineries around Pyrgos or Megalochori — assyrtiko and barrel-aged wines ⭐ Must-see — Oia — postcard village and sunset; go before 6 p.m. or outside July–August to avoid the crush Amoudi — small harbour below Oia (walk down or taxi); waterfront tavernas Museum of Prehistoric Thera (Fira) — complements Akrotiri with frescoes and artefacts Hiking # ⭐ Must-do — Caldera trail Fira → Oia (~10 km, 3 h) — start early; sea on your left in this direction Mesa Vouno \u0026amp; ancient Thera — steep climb, Hellenistic ruins, caldera and sea views; quiet Profitis Ilias (567 m) — highest point, panorama over the whole island Akrotiri → Red Beach — short coastal path; the beach is packed, the view from the trail is worth it Boat # Caïque south coast (from Vlychada or Akrotiri) — White Beach, Red Beach from the sea, caves ⭐ Must-do — Nea Kameni + Palea Kameni hot springs — active volcano and warm baths; prefer a small boat early morning Sunset sailing from Vlychada — more intimate than large catamarans from Fira Kayak rental — south coast from Vlychada or Red Beach; coves and volcanic cliffs up close, best in calm morning seas Food \u0026amp; experiences # Cycladic cooking class — tomatokeftedes, fava, melitzanosalata; workshops in Pyrgos or Megalochori (half-day, market + cooking) Barrel-wine tasting — Santo Wines (caldera view) or smaller estates like Sigalas / Hatzidakis Wine walk in Pyrgos — string together 2–3 canaves on foot in the evening when the light on the caldera is beautiful Restaurants \u0026amp; views # Selene (Pyrgos) — high-end local cuisine, island produce; book well ahead Metaxi Mas (Exo Gonia, near Pyrgos) — Cretan-Cycladic food, terrace with a view Aktaion (Akrotiri) — fish and mezze; close to the archaeological site and base Amoudi tavernas — feet in the water, grilled fish; sunset from the terrace Folegandros # Villages \u0026amp; sites # ⭐ Must-see — Chora — Venetian Kastro, lanes and church square ⭐ Must-see — Panagia — climb from Chora (~20 min); outstanding sunset Ano Meria — farming hamlet and ecological/folklore museum Karavostasis — peaceful port; Anemomilos windmills nearby Kimisis tis Panagias church (Kastro) — frescoes and Venetian architecture in the heart of Chora Hiking # ⭐ Must-do — Chora → Panagia → Chora — short, ideal at sunset ⭐ Must-do — Aspropounta lighthouse trail — ~4 h return from Ano Meria; wild coast, few people Chora → Livadaki — via Agali or coastal path; enclosed cove Chora → Petousis → Ano Meria — inland crossing between dry-stone walls and olive groves Boat # ⭐ Must-do — Island caïque tour — stops at Katergo, Livadaki, Sikia cave Agali → secluded beaches — Agios Nikolaos, Galifos; small local boats Kayak rental — Agali bay; access to neighbouring coves (Galifos, Agios Nikolaos) with no trail Food \u0026amp; experiences # Matsata class or demo — handmade Folegandros pasta with chicken or hare; some Chora tavernas offer workshops on request Sunset dinner at Panagia — climb 45 min before dusk, descend to dine in Chora Local cheese tasting — xinotyro, chloro (fresh cheese) at a deli or taverna in Ano Meria Restaurants \u0026amp; views # Pounda (Chora) — modern Greek cuisine, panoramic terrace over the sea Matsata (Chora) — house matsata specialist; unmissable on the island Irene\u0026rsquo;s Cookhouse (Chora) — tables on the square, village atmosphere; generous daily specials Agali taverna — feet in the water after a beach or kayak day Sifnos # Villages \u0026amp; sites # ⭐ Must-see — Kastro — medieval fortified village; visit early morning Artemonas — neoclassical mansions; pedestrian link with Apollonia ⭐ Must-see — Apollonia — capital and « steno » lanes ⭐ Must-see — Chrysopigi monastery — headland and sunset Pottery workshops — Vathi, Platis Gialos, Cheronisos Byzantine churches — Panagia Poulati (between Artemonas and Kastro), Agios Andreas (Mycenaean) for archaeology enthusiasts Hiking # ⭐ Must-do — Profitis Ilias (Agios Sostis) — ~2 h, central panorama (Sifnos Trails #1) Artemonas → Kastro → Faros — monopatia (ancient paths) between villages and sea Apollonia → Profitis Ilias of Apollonia — short climb, circular view Kamares → Agios Sostis → Cheronisos — wilder north coast Boat # ⭐ Must-do — Poliegos — deserted island (Natura 2000), wild coves; departures from Kamares or Platis Gialos South coast \u0026amp; caves — Hermoupolis, Fykiada from the sea Vathi by boat — anchor in the village fjord Dolphins \u0026amp; wild coast — half-day cruise towards Poliegos; frequent dolphin sightings off Sifnos (book from Kamares or Platis Gialos) Food \u0026amp; experiences # ⭐ Must-do — Sifnian cooking class — revithada (oven chickpeas), mastelo, amigdalota; birthplace of Cycladic gastronomy (local workshops) Hands-on pottery workshop — throw or decorate a piece in Vathi or Cheronisos (1–2 h) Mastelo oven visit — some traditional restaurants show Sunday lamb baking Apollonia market (morning) — cheeses, capers, thyme honey; ideal before a cooking class Restaurants \u0026amp; views # Drimoni (Kastro) — authentic Sifnian cuisine, terrace over the sea Lazarou (Platis Gialos) — catch of the day, bay views; close to base Omega3 (Platis Gialos) — creative cuisine, local produce Vathi harbour taverna — peaceful fjord, excellent Sunday revithada Milos # Villages \u0026amp; sites # ⭐ Must-see — Plaka — hilltop village and castle; before 10 a.m. or late afternoon ⭐ Must-see — Klima — colourful fishermen\u0026rsquo;s cottages on the water Mandrakia, Firopotamos, Fourkovouni — small harbours and « syrmata » (boat shelters) ⭐ Must-see — Trypiti \u0026amp; Catacombs — early Christian site, ancient theatre, where the Venus de Milo was found Mining Museum (Adamas) — industrial and volcanic history of the island ⭐ Must-see — Sarakiniko — lunar white rocks; outside cruise-ship hours if possible Hiking # ⭐ Must-do — Plaka → Trypiti → Klima — downhill walk (~45 min) between villages and sea Fyriplaka → Gerontas — coastal path, coloured cliffs Profitis Ilias (Plaka) — short climb, western panorama ⭐ Must-do — Sarakiniko early morning (7–8 a.m.) — white light, before the crowds Boat # ⭐ Must-do — Kleftiko (full day) — cliffs, arches and caves; prefer RIB or caïque 8–12 people ⭐ Must-do — Sykia cave — collapsed cave, swim from the boat; sea access only Glaronissia — small volcanic islets offshore West coast tour — Kleftiko, Triades and beaches unreachable by road (Agios Ioannis, etc.) Dolphin trip — morning cruises from Adamas or Pollonia; dolphins common in Milos bay (book ahead in summer) Kayak rental — Sarakiniko or Firopotamos bay; explore caves and coves under white cliffs Food \u0026amp; experiences # Milos cooking class — pitarakia (fried cheese bites), karpouzopita; occasional workshops in Adamas or Pollonia Salt pans / birdwatching — east side of the island, different landscapes and wildlife Sunset from Plaka castle — apéritif at dusk before dinner in the village Restaurants \u0026amp; views # Medusa (Mandrakia) — grilled fish, feet-in-the-water tables in the syrmata Astakos (Pollonia) — Pollonia views, refined Milos cuisine Bariel (Plaka) — panoramic terrace, creative cooking Utopia (Plaka) — legendary sunset from the terrace; book for dusk ","date":"June 27, 2026","externalUrl":null,"permalink":"/en/voyages/europe/cyclades/","section":"Travels","summary":"Fifteen days across Santorini, Folegandros, Sifnos and Milos — flights via Athens, Seajets ferries and an island-hopping road trip.","title":"The Cyclades","type":"voyages"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/categories/travels/","section":"Categories","summary":"","title":"Travels","type":"categories"},{"content":"","date":"June 27, 2026","externalUrl":null,"permalink":"/en/voyages/","section":"Travels","summary":"","title":"Travels","type":"voyages"},{"content":"","date":"27 janvier 2026","externalUrl":null,"permalink":"/categories/voyages/","section":"Categories","summary":"","title":"Voyages","type":"categories"},{"content":"","date":"7 janvier 2026","externalUrl":null,"permalink":"/tags/animaux/","section":"Tags","summary":"","title":"Animaux","type":"tags"},{"content":"","date":"7 janvier 2026","externalUrl":null,"permalink":"/tags/attractions/","section":"Tags","summary":"","title":"Attractions","type":"tags"},{"content":"","date":"7 janvier 2026","externalUrl":null,"permalink":"/tags/belgique/","section":"Tags","summary":"","title":"Belgique","type":"tags"},{"content":"","date":"7 janvier 2026","externalUrl":null,"permalink":"/tags/famille/","section":"Tags","summary":"","title":"Famille","type":"tags"},{"content":"","date":"June 7, 2026","externalUrl":null,"permalink":"/en/tags/family/","section":"Tags","summary":"","title":"Family","type":"tags"},{"content":"","date":"7 janvier 2026","externalUrl":null,"permalink":"/tags/nature/","section":"Tags","summary":"","title":"Nature","type":"tags"},{"content":"","date":"June 7, 2026","externalUrl":null,"permalink":"/en/categories/outings/","section":"Categories","summary":"","title":"Outings","type":"categories"},{"content":"","date":"June 7, 2026","externalUrl":null,"permalink":"/en/sorties/","section":"Outings","summary":"","title":"Outings","type":"sorties"},{"content":"","date":"7 janvier 2026","externalUrl":null,"permalink":"/tags/parcs/","section":"Tags","summary":"","title":"Parcs","type":"tags"},{"content":"Parcs animaliers, domaines forestiers et espaces de découverte nature — des sorties en plein air pour toute la famille, entre safaris, grottes, forêts et jardins extraordinaires.\nParcs animaliers # 🐼 Pairi Daiza # Le plus beau jardin zoologique de Belgique — élu meilleur zoo d\u0026rsquo;Europe à plusieurs reprises. 75 hectares de jardins thématiques spectaculaires (Jardin chinois, Temple indonésien, Terre du Froid, Oasis) abritant plus de 7.000 animaux de 800 espèces. Pandas géants, éléphants, orangs-outans, koalas, grands singes et bien plus. Hébergements insolites sur place (lodges avec vue sur les animaux). Une expérience immersive et dépaysante unique en Europe.\nPériode : Février à janvier (ouvert quasi toute l\u0026rsquo;année)\nTarifs : ~42 € adulte / 35 € enfant (3-11 ans)\nDepuis Bruxelles : ~50 min (E19/E42, sortie Ath)\nDomaine de Cambron, 7940 Brugelette\nSite web → 🦁 Monde Sauvage (Aywaille) # Le seul safari en voiture de Belgique — 88 hectares de nature à parcourir en voiture ou en petit train, à la rencontre de plus de 140 espèces (girafes, éléphants, hippopotames, rhinocéros, zèbres, ours, loups). Zones pédestres avec dôme tropical et temple maya, îles aux singes, forêt nord-américaine. Spectacles pédagogiques (perroquets, otaries, rapaces) et parc aventure (Fraxinus). À seulement 25 km de Liège.\nPériode : Mars à novembre\nTarifs : ~28 € adulte / 24 € enfant\nDepuis Bruxelles : ~1h15 (E25, sortie 46 Aywaille/Remouchamps)\nFange de Deigné 3, 4920 Aywaille\nSite web → 🐻 Domaine des Grottes de Han # Un domaine exceptionnel combinant grotte souterraine classée 3 étoiles au Guide Vert Michelin et parc animalier de 250 hectares. La grotte (spectacle son et lumière \u0026ldquo;Origin\u0026rdquo; à 110 m sous terre) se visite en 1h15 à 2h, tandis que le parc animalier (safari-bus ou à pied, 4 km) abrite bisons d\u0026rsquo;Europe, ours bruns, lynx, loups et chevaux de Przewalski dans un cadre naturel préservé (UNESCO Global Geopark). Tram centenaire, glamping en Tree Tents au cœur du parc.\nPériode : Février à novembre (horaires variables)\nTarifs : PassHan (grotte + parc) ~31 € adulte / 22 € enfant\nDepuis Bruxelles : ~1h20 (E411, sortie Rochefort)\nRue Joseph Lamotte 2, 5580 Han-sur-Lesse\nSite web → 🐺 Parc animalier du Domaine des Grottes de Han — Réserve d\u0026rsquo;Animaux Sauvages # La réserve animalière du Domaine s\u0026rsquo;étend sur 250 hectares de collines boisées — un safari-bus commenté de 1h30 vous emmène à la rencontre des grands mammifères européens dans leur habitat naturel. Programmes de conservation européens (EEP) : réintroduction des ours bruns, reproduction des bisons d\u0026rsquo;Europe et suivi GPS des lynx boréaux.\nVisite : Safari-bus (~1h30) ou sentier pédestre (4 km, à votre rythme)\nHébergement : Tree Tents (nuit perchée au cœur du parc animalier)\nRue Joseph Lamotte 2, 5580 Han-sur-Lesse\nSite web → 🐺 Forestia # Parc animalier et aventure en forêt ardennaise — 44 hectares dédiés à l\u0026rsquo;observation des animaux nord-européens en semi-liberté (loups, lynx, ours, cerfs, élans, bisons) et 11 parcours d\u0026rsquo;accrobranche avec 130 obstacles et 2 tyroliennes géantes (dont une de 120 m). Accessible dès 2 ans pour le parc animalier et certains parcours aventure. Hébergement sur place (hôtel et lodges en forêt), Forest\u0026rsquo;bar et boutique.\nPériode : Parc animalier toute l\u0026rsquo;année (sauf lun-mar en hiver) / Aventure : mi-mars à mi-novembre\nTarifs : Animalier ~14 € / Aventure + Animalier ~28 €\nDepuis Bruxelles : ~1h20 (E25, sortie Theux/Spa)\nRue du Parc 1, 4910 Theux\nSite web → Domaines naturels \u0026amp; forestiers # 🌲 Domaine provincial de Chevetogne # 600 hectares de nature entre Rochefort et Ciney — le paradis des familles en plein air. 14 plaines de jeux dignes d\u0026rsquo;un film d\u0026rsquo;aventure, piscine extérieure (été), mini-golf, barques, canoës, petit train, ferme pédagogique et jardins thématiques (dont pagodes japonaises et cabane de hobbit !). Deux musées sur place : le NEM (Nature Extraordinary Museum) et le MHiN (histoire naturelle pour enfants). Hébergements (gîtes, camping) et zones barbecue. Ouvert toute l\u0026rsquo;année avec 4 formules : Nature, Loisir, Fun (été) et Event.\nPériode : Toute l\u0026rsquo;année (activités selon saison)\nTarifs : Nature 14 €/voiture — Loisir 12 €/pers — Fun (été) 17 €/pers — Gratuit -5 ans\nÉvénements : Totem (mai), Même pas peur (octobre)\nDepuis Bruxelles : ~1h10 (E411, sortie Rochefort/Ciney)\nRue de Pirchamps 1, 5590 Chevetogne\nSite web → 🌳 Parc Chlorophylle # Parc forestier récréatif et pédagogique au cœur de l\u0026rsquo;Ardenne — 9 hectares de forêt classée Natura 2000 avec un sentier pédagogique de 2 km, 33 attractions en bois et un parcours spectaculaire dans la cime des arbres (200 m de passerelles suspendues à 15 m de hauteur, cabanes thématiques et modules interactifs). Approche totalement ludique de la nature : découvrir la forêt en s\u0026rsquo;amusant. Pyramide de cordes géante, plaine de jeux monumentale en bois, brasserie du parc.\nPériode : Avril à novembre (fermé lundi et mardi hors vacances)\nTarifs : ~12 € adulte / 10 € enfant (3-11 ans)\nDepuis Bruxelles : ~1h30 (E25, sortie Manhay)\nRue des Chasseurs Ardennais 60, 6960 Dochamps (Manhay)\nSite web → 🦌 Parc à Gibier de La Roche-en-Ardenne # Parc animalier en semi-liberté au cœur de La Roche-en-Ardenne — cerfs, daims, sangliers, mouflons, bouquetins et rapaces dans un cadre forestier vallonné. Sentier de 1,5 km accessible à tous, volière de rapaces et point de vue panoramique sur la vallée de l\u0026rsquo;Ourthe. Petit, familial et gratuit (participation libre).\nPériode : Toute l\u0026rsquo;année, accès libre\nTarifs : Gratuit (dons bienvenus)\nDepuis Bruxelles : ~1h30 (E25/N89)\nRue Châmont, 6980 La Roche-en-Ardenne\nSite web → 🌿 Domaine de Bérinzenne (Spa) # Centre nature au cœur des fagnes spadoises — 5 sentiers balisés à travers tourbières, landes et forêts, musée de la forêt et de l\u0026rsquo;eau, observatoires et expositions sur la biodiversité locale. Point de départ pour les promenades dans les Hautes Fagnes. Ambiance contemplative et ressourçante.\nPériode : Toute l\u0026rsquo;année (musée : mercredi à dimanche, 10h–17h)\nTarifs : Sentiers gratuits / Musée ~5 €\nDepuis Bruxelles : ~1h20 (E42, sortie Spa)\nRoute de Bérinzenne, 4900 Spa\nSite web → Pays-Bas \u0026amp; alentours # 🦁 Burgers\u0026rsquo; Zoo # L\u0026rsquo;un des zoos les plus innovants d\u0026rsquo;Europe — écosystèmes entiers recréés sous d\u0026rsquo;immenses dômes : forêt tropicale (Burgers\u0026rsquo; Bush), océan (Burgers\u0026rsquo; Ocean avec 8 millions de litres d\u0026rsquo;eau), désert, mangrove et savane africaine. Approche écologique et immersive unique. Plus de 3.000 animaux de 700 espèces.\nPériode : Toute l\u0026rsquo;année (365 jours)\nTarifs : ~28 € adulte / 25 € enfant\nDepuis Bruxelles : ~2h15 (A50 direction Arnhem)\nAntoon van Hooffplein 1, 6816 SH Arnhem\nSite web → 🐘 GaiaZOO # Zoo moderne dans le Limbourg néerlandais, à la frontière belgo-allemande — élu meilleur zoo du Benelux. Parcours thématique par continent (savane africaine, forêt sud-américaine, taïga) dans un cadre vallonné et verdoyant. Plus de 150 espèces dans des enclos spacieux et naturels.\nPériode : Toute l\u0026rsquo;année\nTarifs : ~24 € adulte / 20 € enfant\nDepuis Bruxelles : ~1h30 (E40/E314 direction Aachen)\nDentgenbachweg 105, 6468 PG Kerkrade\nSite web → ","date":"7 janvier 2026","externalUrl":null,"permalink":"/sorties/parcs/parcs-nature/","section":"Sorties","summary":"Parcs animaliers, domaines naturels et espaces de découverte — la nature à portée de main en Belgique et alentours.","title":"Parcs animaliers \u0026 nature","type":"sorties"},{"content":"Les meilleurs parcs d\u0026rsquo;attractions à portée de route depuis la Belgique — des montagnes russes aux univers féeriques, en passant par les parcs à thème immersifs.\nBelgique # 🎢 Walibi Belgium # Le parc d\u0026rsquo;attractions phare de Belgique — montagnes russes à sensations (Kondaa, Pulsar, Radja River), attractions familiales et zone enfants. Ambiance festive, concerts en été et événement Halloween (Scary Nights). À 20 minutes de Bruxelles.\nPériode : Avril à octobre + Halloween (octobre-novembre)\nTarifs : ~42 € en ligne / 47 € sur place\nDepuis Bruxelles : ~25 min (E411, sortie Wavre)\nBoulevard de l\u0026#39;Europe 100, 1300 Wavre\nSite web → 🎢 Bobbejaanland # Parc d\u0026rsquo;attractions familial en Campine anversoise — plus de 50 attractions dont des roller coasters (Fury, Typhoon, Naga Bay), des attractions aquatiques et une zone pour les tout-petits. Événements saisonniers : Boo!gie Nights (Halloween), Land of Legends (été) et Winter Land.\nPériode : Avril à janvier (calendrier variable)\nTarifs : ~38 € en ligne\nDepuis Bruxelles : ~1h (E313, sortie Geel-West)\nDe Vlijt 1, 2275 Lichtaart\nSite web → 🎢 Plopsaland De Panne # Parc familial à la côte belge — univers des personnages Studio 100 (Mega Mindy, Wickie, Maya l\u0026rsquo;Abeille). Attractions pour tous âges : The Ride to Happiness (meilleur coaster spinning d\u0026rsquo;Europe), Anubis The Ride, parc aquatique couvert (Plopsaqua). Idéal pour les familles avec enfants de 2 à 14 ans.\nPériode : Toute l\u0026rsquo;année (parc aquatique couvert)\nTarifs : ~40 € en ligne\nDepuis Bruxelles : ~1h30 (E40 direction Côte)\nDe Pannestraat 68, 8660 De Panne\nSite web → 🎢 Bellewaerde # Parc unique combinant attractions à sensations et parc animalier — plus de 60 attractions et 300 animaux dans un cadre verdoyant de 54 hectares. Roller coasters (Dawson Duel, Wakala), zones thématiques (Far West, Mexico, Canada) et parc aquatique (Bellewaerde Aquapark). Spectacles animaliers et pédagogiques inclus.\nPériode : Avril à octobre + Halloween\nTarifs : ~38 € en ligne\nDepuis Bruxelles : ~1h15 (E40 direction Côte, sortie Ypres)\nMeenseweg 497, 8902 Ypres\nSite web → 🎠 Plopsa Coo # Petit parc familial en Ardenne, au pied des cascades de Coo — attractions pour enfants, télésièges panoramiques sur les hauteurs boisées et base de kayak. Ambiance nature et détente, idéal pour une journée combinant parc et cascades.\nPériode : Avril à septembre (week-ends et vacances)\nTarifs : ~27 €\nDepuis Bruxelles : ~1h30 (E25 direction Luxembourg)\nCoo 2, 4970 Stavelot\nSite web → 🏰 Mini-Europe # L\u0026rsquo;Europe en miniature au pied de l\u0026rsquo;Atomium — plus de 350 maquettes à l\u0026rsquo;échelle 1/25 des monuments les plus remarquables de l\u0026rsquo;Union Européenne. Animations interactives (éruption du Vésuve, chute du Mur de Berlin, décollage d\u0026rsquo;Ariane 5). Ludique et éducatif, parfait pour les enfants.\nPériode : Toute l\u0026rsquo;année\nTarifs : ~17,50 € adulte / 12,50 € enfant\nAccès : Métro Heysel (ligne 6)\nBruparck, Avenue du Football 1, 1020 Bruxelles\nSite web → Pays-Bas # 🏰 Efteling # Le parc féerique le plus célèbre des Pays-Bas — un univers enchanteur inspiré des contes et légendes dans un cadre forestier magique. Attractions spectaculaires (Baron 1898, Python, Symbolica, Fata Morgana), Bois des Contes (Sprookjesbos) et hôtels thématiques. L\u0026rsquo;un des plus anciens parcs d\u0026rsquo;attractions au monde (1952) et régulièrement élu meilleur parc thématique d\u0026rsquo;Europe.\nPériode : Toute l\u0026rsquo;année\nTarifs : ~44 € en ligne\nDepuis Bruxelles : ~1h30 (A16 direction Breda)\nEuropalaan 1, 5171 KW Kaatsheuvel\nSite web → 🎢 Walibi Holland # Le parc à sensations fortes des Pays-Bas — montagnes russes extrêmes (Untamed, Lost Gravity, Goliath), attractions à frissons et événements saisonniers (Fright Nights en octobre). Ambiance jeune et adrénaline.\nPériode : Avril à novembre\nTarifs : ~38 €\nDepuis Bruxelles : ~2h15 (A27)\nSpijkweg 30, 8256 RJ Biddinghuizen\nSite web → 🎠 Toverland # Parc familial dans le Limbourg néerlandais — deux halls couverts gigantesques (idéal par mauvais temps) + zone extérieure avec montagnes russes (Troy, Fenix, Dwervelwind). Ambiance féérique, taille humaine et très proche de la frontière belge. Parfait pour les familles avec enfants de 4 à 12 ans.\nPériode : Toute l\u0026rsquo;année (halls couverts)\nTarifs : ~37 €\nDepuis Bruxelles : ~1h30 (E314 direction Venlo)\nToverlaan 2, 5975 MR Sevenum\nSite web → Allemagne # 🌍 Europa-Park # Le plus grand parc d\u0026rsquo;attractions d\u0026rsquo;Europe — 18 quartiers thématiques représentant les pays européens, plus de 100 attractions dont Silver Star (73 m), Blue Fire, Wodan et le tout nouveau Voltron. Resort complet avec 7 hôtels thématiques et parc aquatique couvert (Rulantica). Régulièrement élu meilleur parc au monde.\nPériode : Toute l\u0026rsquo;année (saisons thématiques)\nTarifs : ~62 € adulte / 53 € enfant\nDepuis Bruxelles : ~4h30 (A5 direction Freiburg)\nEuropa-Park-Straße 2, 77977 Rust\nSite web → 🎭 Phantasialand # Parc d\u0026rsquo;attractions immersif à Brühl, à seulement 1h de la frontière belge — univers thématiques ultra-détaillés (Berlin, Chinatown, Mexico, Afrique, Fantasy). Attractions de classe mondiale : Taron, F.L.Y. (premier flying launch coaster au monde), Chiapas, Black Mamba. Compact mais d\u0026rsquo;une qualité scénographique exceptionnelle — souvent comparé à Disney pour l\u0026rsquo;immersion. Hôtels thématiques sur place.\nPériode : Avril à janvier (dont Wintertraum en décembre)\nTarifs : ~57 € adulte / 47 € enfant\nDepuis Bruxelles : ~2h (E40/A4 direction Cologne, sortie Brühl)\nBerggeiststraße 31-41, 50321 Brühl\nSite web → 🎬 Movie Park Germany # Parc à thème cinéma et séries à Bottrop (Ruhr) — attractions inspirées de Nickelodeon, Star Trek, The Walking Dead, Ice Age et Van Helsing. Montagnes russes (Star Trek, The Lost Temple), spectacles de cascadeurs et Halloween Horror Fest (l\u0026rsquo;un des meilleurs événements Halloween d\u0026rsquo;Europe).\nPériode : Avril à novembre\nTarifs : ~45 €\nDepuis Bruxelles : ~2h30 (E34/A2 direction Oberhausen)\nWarner Allee 1, 46244 Bottrop\nSite web → France # 🏰 Disneyland Paris # Le parc Disney européen — deux parcs (Disneyland Park et Walt Disney Studios), univers magiques, spectacles grandioses et rencontres avec les personnages. Space Mountain, Big Thunder Mountain, Crush\u0026rsquo;s Coaster, Avengers Campus et le tout nouveau World of Frozen (2026). L\u0026rsquo;expérience Disney à 1h de Paris.\nPériode : Toute l\u0026rsquo;année\nTarifs : À partir de 56 € (1 jour / 1 parc)\nDepuis Bruxelles : ~3h (A1/E19 puis A4) ou Thalys + RER\nBoulevard de Parc, 77700 Coupvray\nSite web → 🎢 Parc Astérix # Parc à thème gaulois au nord de Paris — montagnes russes à sensations (Toutatis, Ozíris, Tonnerre 2 Zeus), univers thématiques (Gaule, Empire Romain, Grèce, Égypte, Vikings) et spectacles. Humour et culture française, ambiance décontractée. L\u0026rsquo;alternative française aux grands parcs, avec des coasters de classe mondiale.\nPériode : Avril à janvier (dont Peur sur le Parc en octobre)\nTarifs : ~53 €\nDepuis Bruxelles : ~2h30 (A1, sortie Parc Astérix)\n60128 Plailly\nSite web → 🎭 Futuroscope # Parc dédié aux technologies, au cinéma dynamique et aux expériences immersives — simulateurs, cinémas IMAX, réalité virtuelle et attractions multisensorielles. Spectacle nocturne aquatique. Idéal pour les curieux et les familles aimant la science et l\u0026rsquo;innovation.\nPériode : Février à décembre\nTarifs : ~42 € adulte\nDepuis Bruxelles : ~5h30 (A10 direction Poitiers)\nAvenue René Monory, 86360 Chasseneuil-du-Poitou\nSite web → ⚔️ Puy du Fou # Parc de spectacles historiques unique au monde — pas de montagnes russes, mais des shows grandioses à couper le souffle : gladiateurs romains, mousquetaires, Vikings, chevaliers de la Table Ronde, oiseaux de proie en vol libre. La Cinéscénie (spectacle nocturne de 2h avec 2.600 acteurs bénévoles) est le plus grand spectacle de nuit au monde. Élu meilleur parc au monde à plusieurs reprises.\nPériode : Avril à novembre (Cinéscénie : juin à septembre, vendredis et samedis)\nTarifs : ~45 € (Grand Parc) / Cinéscénie ~30 €\nDepuis Bruxelles : ~6h (A10/A83)\nLes Epesses, 85590 Vendée\nSite web → Parcs aventure \u0026amp; loisirs (Belgique) # 🧗 Aventure Parc (Wavre) # 28 parcours d\u0026rsquo;accrobranche dans le Bois de Beumont, à 20 km de Bruxelles — plus de 280 jeux dans les arbres pour tous les niveaux et tous les âges. Tyroliennes, ponts de singe, sauts de Tarzan et parcours sensations fortes. L\u0026rsquo;un des plus grands parcs aventure de Belgique, niché dans un écrin de verdure en Brabant wallon.\nPériode : Toute l\u0026rsquo;année (week-ends + vacances scolaires ; tous les jours en été)\nTarifs : À partir de ~22 € selon parcours\nDepuis Bruxelles : ~25 min (E411, sortie Wavre)\nRue Sainte-Anne 154, 1300 Wavre\nSite web → 🧗 Ecopark Adventures (Tournai) # Parc aventure sur le site de la Carrière de l\u0026rsquo;Orient — accrobranche, filets suspendus et la plus longue tyrolienne de Belgique (306 m au-dessus du lac !). Également : piscine en été, pédalos sur le lac et cadre naturel exceptionnel. Idéal pour une journée entre sensations fortes et détente au bord de l\u0026rsquo;eau, en famille ou entre amis.\nPériode : Avril à octobre\nTarifs : À partir de ~20 €\nDepuis Bruxelles : ~1h (E42, sortie Tournai)\nRue de l\u0026#39;Orient 1, 7500 Tournai\nSite web → 🏄 Dock79 (Saint-Ghislain) # Parc de loisirs multi-activités au bord d\u0026rsquo;un lac de 8 hectares, près de Mons — 6 activités en un lieu : 12 parcours d\u0026rsquo;accrobranche, téléski nautique (wakeboard/ski), aquapark gonflable sur le lac, salle d\u0026rsquo;escalade de bloc (800 m²), escape game extérieur et padel. Bar avec terrasse panoramique sur le lac. Ambiance sportive et décontractée.\nPériode : Mars à octobre (escalade toute l\u0026rsquo;année)\nTarifs : Variables selon activité (~15-30 €)\nDepuis Bruxelles : ~50 min (E19/E42, sortie Saint-Ghislain)\nRue de la Hamaide 79, 7333 Saint-Ghislain\nSite web → ","date":"7 janvier 2026","externalUrl":null,"permalink":"/sorties/parcs/parcs-attractions/","section":"Sorties","summary":"Les meilleurs parcs d’attractions accessibles depuis la Belgique — sensations fortes, univers féeriques et divertissement pour toute la famille.","title":"Parcs d'attractions","type":"sorties"},{"content":"","date":"June 7, 2026","externalUrl":null,"permalink":"/en/sorties/parcs/","section":"Outings","summary":"Theme parks and wildlife \u0026 nature parks — all our outdoor activities.","title":"Parks","type":"sorties"},{"content":"","date":"June 7, 2026","externalUrl":null,"permalink":"/en/tags/parks/","section":"Tags","summary":"","title":"Parks","type":"tags"},{"content":"","date":"7 janvier 2026","externalUrl":null,"permalink":"/categories/sorties/","section":"Categories","summary":"","title":"Sorties","type":"categories"},{"content":"","date":"7 janvier 2026","externalUrl":null,"permalink":"/tags/th%C3%A9%C3%A2tre/","section":"Tags","summary":"","title":"Théâtre","type":"tags"},{"content":"Une sélection de théâtres en Belgique et dans le Nord de la France — salles patrimoniales, scènes contemporaines et lieux insolites. De la comédie de boulevard aux créations contemporaines, en passant par le théâtre de marionnettes pour petits et grands.\nBruxelles # 🎭 Théâtre Royal des Galeries # Niché au cœur des Galeries Royales Saint-Hubert, le Théâtre Royal des Galeries est une institution bruxelloise depuis 1847. Sa salle à l\u0026rsquo;italienne de 850 places accueille une programmation de comédies, pièces de boulevard et grands classiques revisités — avec une troupe permanente (la Compagnie des Galeries) qui perpétue la tradition du théâtre populaire de qualité. Ambiance élégante, excellente acoustique et vue imprenable depuis la corbeille.\nMétro : De Brouckère (lignes 1, 5) ou Gare Centrale — 5 min à pied\nBilletterie : Du mardi au vendredi, 11h–18h\nGalerie du Roi 32, 1000 Bruxelles\nSite web → 🎭 Théâtre Royal du Parc # Construit en 1782 sous l\u0026rsquo;occupation autrichienne, le Théâtre Royal du Parc est l\u0026rsquo;un des plus anciens théâtres de Bruxelles. Réputé pour ses adaptations spectaculaires de grandes œuvres littéraires — Le Fantôme de l\u0026rsquo;Opéra, Le Masque de Fer, Le Mariage de Figaro — accessibles à toutes les générations. Un écrin patrimonial avec bistrot attenant pour prolonger la soirée.\nMétro : Parc (tram 92, 93) ou Arts-Loi (lignes 1, 2, 5, 6)\nBilletterie : Du mardi au samedi, 12h–19h\nRue de la Loi 3, 1000 Bruxelles\nSite web → 🎭 Théâtre National Wallonie-Bruxelles # Le Théâtre National est la grande scène publique de la Fédération Wallonie-Bruxelles — un bâtiment contemporain (2004) avec trois salles (750, 250 places et studio) au cœur de Bruxelles. Programmation ambitieuse de créations contemporaines, danse, cirque et spectacles pluridisciplinaires. Un lieu de référence pour découvrir la scène belge francophone actuelle et les artistes internationaux émergents.\nMétro : Rogier (lignes 2, 6) ou De Brouckère (lignes 1, 5)\nRestaurant \u0026amp; bar : Sur place, ouvert les soirs de spectacle\nBoulevard Émile Jacqmain 111-115, 1000 Bruxelles\nSite web → 🎭 Théâtre des Martyrs # Installé sur la magnifique Place des Martyrs (néoclassique, XVIIIe siècle), le Théâtre des Martyrs propose un répertoire contemporain exigeant — textes d\u0026rsquo;auteurs vivants, nouvelles écritures scéniques et mises en scène inventives. Deux salles intimistes qui favorisent la proximité avec les comédiens. Un lieu essentiel pour les amateurs de théâtre d\u0026rsquo;auteur à Bruxelles.\nMétro : De Brouckère (lignes 1, 5) — 3 min à pied\nBilletterie : 02 223 32 08\nPlace des Martyrs 22, 1000 Bruxelles\nSite web → 🎭 Théâtre Le Public # Théâtre à la programmation généreuse et populaire — comédies, drames contemporains, créations et classiques revisités dans une atmosphère chaleureuse. Trois salles (dont un café-théâtre intimiste) et une librairie sur place. Le Public est reconnu pour son engagement en faveur de la diversité des écritures et sa fidélité aux auteurs belges. Service navette et parking partenaire.\nMétro : Madou (lignes 2, 6) ou Maelbeek (lignes 1, 5)\nLibrairie : Filigranes sur place, ouverte avant et après spectacle\nRue Braemt 64-70, 1210 Bruxelles\nSite web → 🎭 Théâtre Royal de Toone # Le dernier théâtre de marionnettes traditionnelles bruxelloises encore en activité — une tradition ininterrompue depuis 1830 ! Installé au fond d\u0026rsquo;une impasse médiévale classée (Schuddeveld), dans une maison de 1696 à deux pas de la Grand-Place. Marionnettes à tringle manipulées par Toone VIII (Nicolas Géal), répertoire allant de Faust à Dr Jekyll en passant par les classiques en brusseleir. Estaminet folklorique au rez-de-chaussée et musée de la marionnette à l\u0026rsquo;étage.\nAccès : Gare Centrale — 5 min à pied (Îlot Sacré)\nPublic : Adultes et familles — spectacles en français, néerlandais, brusseleir, anglais\nImpasse Sainte-Pétronille 66, Rue du Marché-aux-Herbes, 1000 Bruxelles\nSite web → 🧸 Théâtre Royal du Peruchet # Théâtre de marionnettes à fils pour le jeune public depuis 1929 — le plus ancien théâtre de marionnettes de Bruxelles, installé à Ixelles depuis plus de 50 ans. Spectacles enchanteurs pour enfants dès 3-4 ans (La Chèvre de Monsieur Seguin, Le Petit Prince, Pinocchio…), musée international de la marionnette et académie de construction/manipulation pour adultes. Ambiance magique et artisanale dans un petit théâtre à taille humaine. Festival international JEM chaque année.\nTram : 8, 25 (arrêt Boondael Gare) — Bus 41\nTarifs : 10 € (enfant) / 12 € (adulte) — réservation par téléphone ou e-mail\nAvenue de la Forêt 50, 1050 Ixelles\nSite web → Wallonie # 🎭 Théâtre Le Palace (Ath) # L\u0026rsquo;un des seuls témoignages d\u0026rsquo;architecture Art Nouveau à Ath — un magnifique bâtiment sur la Grand-Place abritant la Maison Culturelle d\u0026rsquo;Ath. Salle de 552 places avec équipement technique de pointe, accueillant théâtre, concerts, humour, danse et jeune public. Également cinéma (L\u0026rsquo;Écran, 220 places) et Centre des Arts de la Rue avec résidences d\u0026rsquo;artistes. Un pôle culturel dynamique en Hainaut occidental.\nParking : Grand-Place et environs\nBilletterie : Du mardi au vendredi, 10h–18h / samedi 10h–13h\nRue de Brantignies 4, 7800 Ath\nSite web → 🎭 Théâtre Royal de Mons # Superbe théâtre à l\u0026rsquo;italienne situé directement sur la Grand-Place de Mons — un écrin de velours grenat au cœur de la cité. Géré par Mars (Mons arts de la scène), il propose une programmation variée : théâtre, danse, musique, humour et opéra. La Salle des Redoutes, rénovée en 2015, offre une vue imprenable sur la Grand-Place pour les petites formes et réceptions.\nParking : Parking Grand-Place (souterrain)\nBilletterie : VisitMons, Grand-Place 27 ou Ticketmaster\nGrand-Place, 7000 Mons\nSite web → 🎭 Théâtre de Namur # Centre dramatique reconnu par la Fédération Wallonie-Bruxelles, le Théâtre de Namur est installé en plein centre-ville. Une soixantaine de spectacles par saison — théâtre, danse, cirque, concerts et expositions. Programmation éclectique qui mêle créations belges et accueils internationaux dans un bâtiment historique rénové.\nBilletterie : 081 22 60 26 — du lundi au samedi, 11h–18h\nPlace du Théâtre 2, 5000 Namur\nSite web → 🎭 Théâtre de Liège # Centre scénique de la Fédération Wallonie-Bruxelles, le Théâtre de Liège est installé depuis 2013 dans le bâtiment rénové de l\u0026rsquo;Émulation — un écrin contemporain sur la Place du 20-Août. Trois salles, un espace d\u0026rsquo;exposition, un restaurant et une librairie. Programmation résolument contemporaine et internationale : théâtre, danse, performance, cirque. Un lieu incontournable de la création en Wallonie.\nParking partenaire : My Park (Rue Sœurs de Hasque) — 7h pour 5 €\nTaxi partenaire : Taxis Melkior — 5% de réduction sur présentation du billet\nPlace du 20-Août 16, 4000 Liège\nSite web → 🎭 Théâtre Jean Vilar (Louvain-la-Neuve) # Fondé en 1968 et installé à Louvain-la-Neuve depuis 1975, l\u0026rsquo;Atelier Théâtre Jean Vilar jouit d\u0026rsquo;un rayonnement international avec plus de 500 productions à son actif. Grande salle et petite salle intimiste (Théâtre du Blocry) pour des créations maison et accueils de compagnies prestigieuses. Rattaché à l\u0026rsquo;UCLouvain, il conjugue exigence artistique et ouverture au public étudiant et familial.\nTrain : Gare de Louvain-la-Neuve — 10 min à pied\nPlace Rabelais 51, 1348 Louvain-la-Neuve\nSite web → Lille \u0026amp; Nord de la France # 🎭 Théâtre Sébastopol # Lieu incontournable de la vie culturelle lilloise depuis plus de 120 ans (construit en 1903). Salle de 1.152 places avec une acoustique parfaite et une excellente visibilité. Programmation grand public et variée : comédies, comédies musicales, concerts, one-man-shows, opérettes et spectacles de variétés. Les plus grands artistes français et internationaux s\u0026rsquo;y produisent.\nMétro : République Beaux-Arts (ligne 1) — 5 min à pied\nBilletterie : Mercredi et vendredi, 12h30–18h\nPlace Sébastopol, 59000 Lille\nSite web → 🎭 Théâtre du Nord (CDN) # Centre Dramatique National installé dans l\u0026rsquo;ancienne Grande Garde (XVIIIe siècle) sur la Grand\u0026rsquo;Place de Lille — un monument historique reconverti en théâtre moderne. Deux salles (444 places et studio de 100 places) et une école supérieure d\u0026rsquo;art dramatique (l\u0026rsquo;École du Nord). Programmation de créations contemporaines, classiques revisités et formes hybrides (cirque, musique). Dirigé par David Bobée depuis 2021.\nMétro : Rihour (ligne 1)\nBilletterie : Du mardi au vendredi, 12h30–19h / samedi 14h–19h\n4 Place du Général-de-Gaulle, 59000 Lille\nSite web → 🎭 La Comédie de Lille # Le \u0026ldquo;N°1 du rire\u0026rdquo; à Lille — un théâtre de 200 places spécialisé dans la comédie et l\u0026rsquo;humour. Programmation 100% divertissement : comédies à succès, vaudevilles, one-man-shows et seuls-en-scène hilarants. Ambiance intimiste et conviviale, à deux pas du Théâtre Sébastopol et de la station de métro République. L\u0026rsquo;entrée spectateurs se fait au 31 Place Sébastopol.\nMétro : République Beaux-Arts (ligne 1)\nBilletterie : 03 20 53 54 94 — du lundi au vendredi, 9h–17h\n204 Rue Solférino, 59000 Lille\nSite web → ","date":"7 janvier 2026","externalUrl":null,"permalink":"/sorties/theatre/theatres-belgique/","section":"Sorties","summary":"Une sélection de théâtres en Belgique et dans le Nord de la France — des salles historiques aux scènes contemporaines.","title":"Théâtres belges et frontaliers","type":"sorties"},{"content":"","date":"May 16, 2026","externalUrl":null,"permalink":"/en/tags/beer/","section":"Tags","summary":"","title":"Beer","type":"tags"},{"content":"","date":"16 janvier 2026","externalUrl":null,"permalink":"/tags/bi%C3%A8re/","section":"Tags","summary":"","title":"Bière","type":"tags"},{"content":"","date":"16 janvier 2026","externalUrl":null,"permalink":"/tags/brasserie/","section":"Tags","summary":"","title":"Brasserie","type":"tags"},{"content":"","date":"May 16, 2026","externalUrl":null,"permalink":"/en/tags/brewery/","section":"Tags","summary":"","title":"Brewery","type":"tags"},{"content":"The craft breweries I have discovered through my tastings, sorted by country.\nUntappd\nUntappd is a social app for rating and sharing craft beer experiences. Every year, the Untappd Awards celebrate the best breweries and beers in the world, voted by a community of millions of users.\nMy profile: untappd.com/user/fduthill\n🇨🇦 Canada # Brasserie du Bas-Canada (2019) — Gatineau, QC # A craft brewery founded in 2019 in Gatineau, Quebec. Specialising in generously hopped IPAs and DIPAs, it is renowned for its juicy, tropical and intensely aromatic beers. One of the best breweries in Canada.\nWebsite: https://www.brasseriebascanada.com Messorem (2017) — Montréal, QC # Founded in 2017 in Montréal, Messorem Bracitorium (Latin for \u0026ldquo;the reaper\u0026rdquo;) is a cult craft brewery specialising in IPAs, DIPAs and TIPAs. Known for its Temporalis series and distinctive can art, it is an essential name on the Quebec craft scene.\nWebsite: https://www.messorem.co Third Moon Brewing Company (2018) — Milton, ON # Founded in 2018 in Milton, Ontario, Third Moon is renowned for its hazy IPAs and rich stouts. A limited-distribution brewery, its releases often sell out within minutes.\nWebsite: https://thirdmoonbrewing.com Badlands Brewing Company (2020) — Caledon, ON # Founded in 2020 in Caledon, Ontario, Badlands stands out with its creative IPAs and sours. Inspired by the wild landscapes of the region, it offers bold and well-hopped beers.\nWebsite: https://www.badlandsbrewing.ca Wood Brothers Brewing Co. (2019) — Glen Robertson, ON # Founded in 2019 in Canada, Wood Brothers is a family brewery specialising in pale ales and IPAs. Their fresh, fruity beers have become benchmarks on the Canadian craft scene.\nWebsite: https://www.woodbrothersbrewingtogo.com Le Ketch — Sainte-Flavie, QC # A Canadian craft brewery specialising in IPAs and characterful hopped beers. A rising name on the Canadian craft scene.\nWebsite: https://www.leketch.com Fine Balance Brewing — Kingston, ON # A Canadian brewery that lives up to its name: balanced beers, polished IPAs and mastered flavours. A discreet but formidable hop artisan.\nWebsite: https://finebalancebrewing.ca Wills Brewing — Montréal, QC # A Canadian craft brewery offering creative IPAs and pale ales. An artisanal and authentic approach to craft beer.\nWebsite: https://www.wills.beer Willibald Farm Brewery — Ayr, ON # A Canadian farm brewery set in a bucolic landscape. Willibald offers craft beers brewed with local ingredients, blending farming tradition and brewing creativity.\nWebsite: https://www.drinkwillibald.com Bad Bones Beer (2022) — Dunham, QC # Born from a recovery project after a car accident, Bad Bones is a Dunham nanobrewery specialising in ultra-hopped IPAs — NEIPAs, doubles and triples with New Zealand and American hops. A human story as much as a brewing adventure.\nWebsite: https://www.badbonesbeer.com Nano Cinco (2021) — Québec, QC # Founded in 2021 in Québec City\u0026rsquo;s Limoilou neighbourhood, Nano Cinco produces bold IPAs and creative stouts in small batches. A craft brewery focused on experimentation and regular releases.\nWebsite: https://nanocinco.com Noctem Artisans Brasseurs (2015) — Québec, QC # Opened in 2015 in Québec City, Noctem is a brewpub that has become essential on the Quebec craft scene. Known for its IPAs (including the famous Catnip), lagers and fruit beers, it blends tradition with modern trends.\nWebsite: https://www.noctem.ca Brewskey (2015) — Montréal, QC # Opened in 2015 in Old Montreal, Brewskey is a brewpub, taproom and annexe brewing on site. Thirty taps, polished food and a terrace facing the port — an essential address on the Montreal craft scene.\nWebsite: https://www.brewskey.ca Sir John Brewing Co. (2022) — Lachute, QC # Founded in 2022 in Lachute, Laurentides, Sir John is an independent brewery inspired by the American craft tradition. Creative IPAs, bourbon barrel-aged stouts and seasonal beers in a welcoming tasting room.\nWebsite: https://www.brasseriesirjohn.com All My Friends Beer Co — Bloomfield, ON # A small-batch brewery located in beautiful Bloomfield, Prince Edward County, Ontario. Known for some of Ontario\u0026rsquo;s best Hazy IPAs, crisp lagers, and fruit-forward beers, brewed with care, curiosity, and a love for flavour. Their taproom is a relaxed gathering spot for locals, travellers, and beer lovers alike.\nWebsite: https://amfbeer.com 🇺🇸 United States # The Alchemist (2003) — Stowe, VT # Founded in 2003 in Vermont, The Alchemist is the brewery that popularised the Hazy IPA with its legendary Heady Topper, considered one of the best beers in the world. An institution of American craft beer.\nWebsite: https://alchemistbeer.com Trillium Brewing Company (2013) — Boston, MA # Founded in 2013 in Boston, Trillium is one of the most acclaimed breweries on the East Coast. Its IPAs, DIPAs and farmhouse ales are regularly ranked among the best in the world. A must on the American craft scene.\nWebsite: https://www.trilliumbrewing.com Tree House Brewing Company (2011) — Charlton, MA # Founded in 2011 in Charlton, Massachusetts, Tree House has become a legend of American craft beer. Its Julius IPA is considered one of the best IPAs in the world. A cult brewery with on-site-only distribution.\nWebsite: https://treehousebrew.com Monkish Brewing Co. (2012) — Torrance, CA # Founded in 2012 in Torrance, California, Monkish is the benchmark for Hazy IPAs on the West Coast. Originally inspired by Belgian brewing traditions, it evolved towards hazy, juicy IPAs that draw queues at every release.\nWebsite: https://www.monkishbrewing.com Mortalis Brewing Company (2018) — Avon, NY # Founded in 2018 in Avon, New York State, Mortalis quickly made a name for itself with its smoothie sours and creative IPAs. Its limited-edition releases create a buzz with every drop.\nWebsite: https://www.mortalisbrewing.com Lolev Beer (2020) — Pittsburgh, PA # Founded in 2020 in Pittsburgh, Pennsylvania, Lolev Beer is a microbrewery specialising in ultra-hopped IPAs and DIPAs. Still under the radar, it is beginning to make a name on the international scene.\nWebsite: https://lolev.beer BRUJOS (2018) — Portland, OR # Founded in 2018 in Portland, Oregon, BRUJOS is a craft brewery pushing boundaries with bold IPAs, pastry stouts and tropical sours. One of the rising stars of the American craft scene.\nWebsite: https://www.brujosbrewing.com Parish Brewing Co. (2003) — Broussard, LA # Founded around 2003 in Louisiana by Andrew Godley, Parish revolutionised the Gulf Coast craft scene with Canebrake, an iconic maple syrup wheat ale. One of the most influential breweries in the American South.\nWebsite: https://parishbeer.com Finback Brewery (2011) — Queens, NY # Founded in 2011 in Glendale, Queens, Finback is renowned for its hoppy IPAs, sours and barrel-aged beers. A creative New York brewery with a tasting room and regular can releases.\nWebsite: https://finbackbrewery.com Bissell Brothers (2013) — Portland, ME # Launched in 2013 in Portland, Maine, Bissell Brothers made its mark with The Substance Ale and a range of bold IPAs. A brother-owned brewery that introduced modern styles to a region still new to craft beer.\nWebsite: https://www.bissellbrothers.com Other Half Brewing (2014) — Brooklyn, NY # Founded in 2014 in Brooklyn, Other Half has become a global benchmark for hazy IPAs and collaborations. Its ultra-hopped beers and limited releases make it one of the most sought-after breweries in the United States.\nWebsite: https://otherhalfbrewing.com Deep Fried Beers — Athens, NY # A New York State brewery known for hop-saturated IPAs and bold sours. Associated with Night School in Athens, it offers \u0026ldquo;decadent\u0026rdquo; beers that push style boundaries.\nWebsite: https://www.deepfriedbeers.com Fidens Brewing Co. (2019) — Colonie, NY # Founded in 2019 near Albany, New York State, Fidens (\u0026ldquo;courageous\u0026rdquo; in Latin) has specialised in juicy, hazy IPAs through a meticulous approach to brewing and dry-hopping.\nWebsite: https://fidensbrewing.com The Veil Brewing Co. (2016) — Richmond, VA # Opened in 2016 in Richmond\u0026rsquo;s Scott\u0026rsquo;s Addition neighbourhood, The Veil made its name with hoppy IPAs and bold sours. One of the most influential breweries on the East Coast, housed in a converted former church.\nWebsite: https://www.theveilbrewing.com Phase Three Brewing Company (2019) — Lake Zurich, IL # Founded in 2019 in Lake Zurich, Illinois, Phase Three grew from passionate brewers with backgrounds in restaurants and craft production. Polished IPAs, stouts and lagers from a modern 21,000 sq ft facility.\nWebsite: https://www.phasethreebrewing.com Foam Brewers (2016) — Burlington, VT # Opened in 2016 on the Burlington waterfront in Vermont, Foam was founded by former Switchback and Magic Hat brewers. Hazy IPAs, lagers and sours in a stunning lakeside setting on Lake Champlain.\nWebsite: https://www.foambrewers.com Outer Range Brewing Co. (2016) — Frisco, CO # Founded in late 2016 in Frisco, Colorado, Outer Range draws inspiration from Belgian beers and the Rocky Mountains. IPAs, lagers and mountain beers from an expanded taproom with restaurant and coffee shop in Summit County.\nWebsite: https://www.outerrangebrewing.com Equilibrium Brewery (2016) — Middletown, NY # Commercially brewing since 2016 in Middletown, New York State, Equilibrium applies a scientific approach to brewing for remarkably balanced IPAs and DIPAs. Founded by MIT engineers, it has become a benchmark on the New York craft scene.\nWebsite: https://www.eqbrew.com 🇬🇧 United Kingdom # Cloudwater Brew Co. (2014) — Manchester, Greater Manchester # Founded in 2014 in Manchester, Cloudwater has become one of the most awarded breweries in the UK within just a few years. Its seasonal DIPAs and hoppy pale ales have earned it numerous international awards.\nWebsite: https://cloudwaterbrew.co Track Brewing Co. (2014) — Manchester, Greater Manchester # Founded in 2014 in Manchester, Track excels in modern pale ales and IPAs. Its fresh and approachable beers, brewed in the Piccadilly quarter, have made it a pillar of the Manchester craft scene alongside Cloudwater.\nWebsite: https://www.trackbrewing.co.uk Verdant Brewing Co. (2014) — Penryn, Cornwall # Founded in 2014 in Penryn, Cornwall, Verdant is the brewery that put south-west England on the craft beer map. Its hazy, juicy and ultra-hopped IPAs are among the most sought-after in the UK.\nWebsite: https://verdantbrewing.co Pentrich Brewing Co. (2015) — Pentrich, Derbyshire # Founded in 2015 in Derbyshire, Pentrich offers a wide range of pale ales, IPAs, DIPAs and sours with creative names. An independent English brewery recognised on the British craft scene.\nWebsite: https://www.pentrichbrewing.com Azvex Brewing Co. (2021) — Liverpool, Merseyside # Founded in late 2021 in Liverpool, Azvex is an independent brewery specialising in creative IPAs, DIPAs and sours. A project born from a desire for creative freedom after the Neon Raptor experience, with a taproom and regular can releases.\nWebsite: https://www.azvexbrewing.com 🇧🇪 Belgium # La Source Beer Co. (2019) — Brussels # Active since 2019 in Brussels, La Source is an artisanal microbrewery and brewpub offering IPAs, sours, wild beers and barrel-aged stouts. Twenty taps at the bar, five connected directly to service tanks for maximum freshness.\nWebsite: https://lasourcebeer.be Misery Beer Co. (2020) — Manoir de Harzé, Ardennes # Nestled in the heart of Liège Ardennes in an authentic renovated manor house, Misery is a family microbrewery and brewpub opened in summer 2020 by Rémy and Samia. Inspired by the North American craft movement and backed by Belgian brewing training, they offer IPAs, pale ales, saison aged in foeders and stouts aged in bourbon or cognac barrels. Beyond their own creations, the manor bar hosts a selection of Belgian and international craft beers, natural wines and light fare based on local Ardennes produce.\nWebsite: https://miserybeerco.be Brasserie Surréaliste (2019) — Brussels # Opened in 2019 in Brussels\u0026rsquo; Dansaert district, Brasserie Surréaliste occupies a 1932 Art Deco building. A brewpub and restaurant offering IPAs, sours and characterful beers in a setting inspired by surrealist art.\nWebsite: https://www.brasseriesurrealiste.com 🇨🇭 Switzerland # Hoppy People (2016) — Sierre, VS # Founded in 2016 in Sierre, Valais, Hoppy People is a Swiss craft brewery specialising in IPAs, imperial stouts and beers aged in wine or spirit barrels. Solar-powered, it blends American inspiration with Swiss precision.\nWebsite: https://www.hoppypeople.ch 🇪🇸 Spain # SOMA Beer (2016) — Girona, Catalonia # Founded in 2016 near Girona, SOMA is an independent brewery specialising in NEIPAs and modern IPAs. Over a hundred experimental recipes, with weekly limited editions that surprise with every release.\nWebsite: https://soma-beer.com 🇫🇷 France # Prizm Brewing (2019) — Vendargues, Occitanie # Founded in 2019, Prizm is a French brewery specialising in IPAs and DIPAs with American and New Zealand hops. Its colourful and aromatic beers have quickly conquered the French craft scene.\nWebsite: https://www.prizmbrewing.com Fauve Craft Bière — Mauguio, Hérault # A French craft brewery offering inventive IPAs, stouts and sours. Fauve stands out with its bold recipes and strong visual identity. A major player in French craft beer.\nWebsite: https://www.fauvebiere.com Popihn — Vaumort, Yonne # A French craft brewery known for its generously hopped IPAs and DIPAs. Popihn has become a reliable name on the French craft scene thanks to its consistent and well-executed beers.\nWebsite: https://www.popihn.fr Brasserie Cambier (2014) — Croix, Hauts-de-France # Founded in 2014 in Croix, near Lille, Cambier is an urban craft brewery revisiting the brewing tradition of northern France. Its Mongy and Cambier ranges offer blondes, IPAs, triples and ephemeral beers at its on-site bar and shop.\nWebsite: https://brasserie-cambier.fr 90 BPM Brewing Co. (2020) — Ahuy, Burgundy # Founded in 2020 in Ahuy, north of Dijon, 90 BPM is a microbrewery and beer bar specialising in NEIPAs, DIPAs and Burgundy terroir beers. Over a hundred recipes, including beers aged in Burgundy wine barrels.\nWebsite: https://90bpm.fr 🇬🇷 Greece # Seven Island Brewery (2014) — Corfu, Ionian Islands # Founded in 2014 in Corfu, Seven Island is the benchmark for Greek craft beer. Specialising in bold, aromatic IPAs — including the famous Citra Crush — it exports across Europe and collaborates with breweries worldwide.\nWebsite: https://sevenislandbrewery.com 🇸🇪 Sweden # Stigbergets Bryggeri (2012) — Gothenburg, Västra Götaland # Founded in 2012 in Gothenburg, Stigbergets is the benchmark brewery in Scandinavia. Its IPAs, lagers and barrel-aged stouts have been awarded numerous times. Regularly ranked among the best breweries in Europe.\nWebsite: https://www.stigbergets.se 🇧🇷 Brazil # Spartacus Brewing (2015) — Juiz de Fora, Minas Gerais # Founded in 2015 in Brazil, Spartacus Brewing is a pioneering brewery on the Latin American craft scene. It offers bold and complex stouts, IPAs and barrel-aged beers.\nWebsite: https://www.spartacusbrewing.com 🇱🇻 Latvia # Ārpus Brewing Co. (2017) — Ādaži, Riga # Founded in 2017 on the outskirts of Riga, Ārpus is an independent Latvian microbrewery specialising in hoppy IPAs, fruity sours and imperial stouts. A benchmark for the Baltic craft scene internationally.\nWebsite: https://arpusbrewing.co 🇷🇴 Romania # Hop Hooligans (2016) — Jilava, Ilfov # Founded in 2016 in Jilava, near Bucharest, Hop Hooligans is one of the most influential craft breweries in Romania. Unfiltered NEIPAs, stouts, sours and barleywines, with a taproom in the heart of the capital.\nWebsite: https://www.hophooligans.ro 🇫🇮 Finland # Factory Brewing (2022) — Kerava, Uusimaa # Launched in 2022 in Kerava, near Helsinki, Factory is the bold brand of ETKO Brewing. Hazy IPAs, pastry stouts and barrel-aged beers brewed with premium hops.\nWebsite: https://etko.beer 🇰🇷 South Korea # Magpie Brewing Co. (2011) — Seoul, Yongsan # Founded in 2011 in Seoul\u0026rsquo;s Itaewon district, Magpie paved the way for craft beer in South Korea. Pale ales, IPAs and lagers at an iconic brewshop, with a brewery on Jeju Island since 2016.\nWebsite: https://www.magpiebrewing.com Seoul Gypsy (2014) — Seoul, Jongno # A brewpub in Seoul\u0026rsquo;s Jongno district, Seoul Gypsy experiments with IPAs and saisons. An address that revived Seosulla-gil, with beers inspired by the brewers\u0026rsquo; travels.\nWebsite: https://www.instagram.com/seoulgypsy Chillhops Brewing Co. (2017) — Seosan, Chungcheongnam-do # Founded in 2017 on Korea\u0026rsquo;s west coast, Chillhops brews beers inspired by Australia and New Zealand. Oat IPAs, lagers and sours served in Seoul at the Chillhops Itaewon Project.\nWebsite: https://www.instagram.com/chillhopsbrewingco 🇯🇵 Japan # Uchu Brewing (2016) — Hokuto, Yamanashi # Founded in 2016 in Yamanashi Prefecture, Uchu Brewing (\u0026ldquo;universe\u0026rdquo; in Japanese) is famous for its hazy IPAs and DIPAs with explosive tropical aromas. Recent collaboration with Brasserie du Bas-Canada.\nWebsite: https://uchubrewing.com ","date":"May 16, 2026","externalUrl":null,"permalink":"/en/sorties/boire-manger/craft-beer/","section":"Outings","summary":"The craft breweries I have discovered, sorted by country.","title":"Craft Beer","type":"sorties"},{"content":"","date":"May 16, 2026","externalUrl":null,"permalink":"/en/tags/craft-beer/","section":"Tags","summary":"","title":"Craft Beer","type":"tags"},{"content":"","date":"May 15, 2026","externalUrl":null,"permalink":"/en/tags/paris/","section":"Tags","summary":"","title":"Paris","type":"tags"},{"content":"","date":"May 15, 2026","externalUrl":null,"permalink":"/en/tags/theatre/","section":"Tags","summary":"","title":"Theatre","type":"tags"},{"content":"A selection of Parisian theatres to discover.\nFilter by district: All 1st 2nd 8th 9th 10th 14th 17th Théâtre de la Porte Saint-Martin (1781) # Built in 1781, the Théâtre de la Porte Saint-Martin is one of the oldest theatres in Paris. Its grand 1,000-seat auditorium hosted the premiere of Edmond Rostand\u0026rsquo;s Cyrano de Bergerac in 1897. A listed historic monument, it continues to stage plays, musicals and large-scale shows.\nDistrict: 10th (18, Boulevard Saint-Martin) Metro: Strasbourg – Saint-Denis (lines 4, 8, 9), République (lines 3, 5, 8, 9, 11) Website: https://www.portestmartin.com Théâtre du Palais-Royal (1784) # Built in 1784 within the grounds of the Palais-Royal, this listed 716-seat venue is a jewel for comedy. From Molière to Guillaume Gallienne, the theatre upholds a tradition of elegant comedies and refined shows in an exceptional historical setting.\nDistrict: 1st (38, Rue de Montpensier) Metro: Palais Royal – Musée du Louvre (lines 1, 7), Pyramides (lines 7, 14) Website: https://www.theatrepalaisroyal.com Théâtre des Variétés (1807) # Inaugurated in 1807 on Boulevard Montmartre, the Théâtre des Variétés is one of the oldest active theatres in Paris. Its Italian-style 900-seat auditorium has hosted Offenbach\u0026rsquo;s operettas, Josephine Baker\u0026rsquo;s revues and countless boulevard comedies. A listed historic monument, it remains a temple of laughter and popular entertainment.\nDistrict: 2nd (7, Boulevard Montmartre) Metro: Grands Boulevards (lines 8, 9) Website: https://www.theatre-des-varietes.fr Théâtre de la Renaissance (1838) # Founded in 1838, the Théâtre de la Renaissance is a historic 650-seat venue on Boulevard Saint-Martin. Sarah Bernhardt triumphed here at the end of the 19th century. Today it stages comedies, contemporary drama and one-person shows in an elegant Second Empire setting.\nDistrict: 10th (20, Boulevard Saint-Martin) Metro: Strasbourg – Saint-Denis (lines 4, 8, 9), République (lines 3, 5, 8, 9, 11) Website: https://www.theatredelarenaissance.com Théâtre Marigny (1855) # Located in the gardens of the Champs-Élysées, the Théâtre Marigny is one of the most prestigious theatres in Paris. Built in 1855 and reopened in 2018 after a full restoration, it features a grand 1,024-seat auditorium and a 300-seat studio. Its programme blends major comedies, classic plays and landmark shows in a sumptuous setting.\nDistrict: 8th (Carré Marigny, Avenue de Marigny) Metro: Champs-Élysées – Clemenceau (lines 1, 13), Franklin D. Roosevelt (lines 1, 9) Website: https://www.theatremarigny.fr Théâtre de la Gaîté-Montparnasse (1868) # Founded in 1868, the Théâtre de la Gaîté-Montparnasse is a 350-seat venue on Rue de la Gaîté, in the heart of the Montparnasse district. Specialising in comedies and one-person shows, it offers a varied programme in an intimate atmosphere. Its long history makes it one of the pillars of theatrical life on the Left Bank.\nDistrict: 14th (26, Rue de la Gaîté) Metro: Edgar Quinet (line 6), Gaîté (line 13), Montparnasse – Bienvenüe (lines 4, 6, 12, 13) Website: https://www.gaite.fr Théâtre Montparnasse (1886) # Founded in 1886, the Théâtre Montparnasse is a 730-seat venue on Rue de la Gaîté. A landmark for comedy and auteur theatre, it was once run by Lars Schmidt and Madeleine Renaud. Its programme blends hit comedies, revisited classics and contemporary creations.\nDistrict: 14th (31, Rue de la Gaîté) Metro: Edgar Quinet (line 6), Gaîté (line 13), Montparnasse – Bienvenüe (lines 4, 6, 12, 13) Website: https://www.theatremontparnasse.com Théâtre de Paris (1891) # Located on Rue Blanche, the Théâtre de Paris has been an institution since 1891. With its two auditoriums (850 and 200 seats), it is one of the leading comedy venues in Paris. From Sacha Guitry to Pierre Palmade, the biggest names in French humour and boulevard theatre have performed here.\nDistrict: 9th (15, Rue Blanche) Metro: Trinité – d\u0026rsquo;Estienne d\u0026rsquo;Orves (line 12), Blanche (line 2) Website: https://www.theatredeparis.com Théâtre des Mathurins (1897) # Founded in 1897, the Théâtre des Mathurins is an intimate 370-seat venue in the Madeleine district. Specialising in boulevard comedies and contemporary plays, it has hosted playwrights such as Jean Anouilh and Marcel Achard. A warm and welcoming setting for an evening of laughter.\nDistrict: 8th (36, Rue des Mathurins) Metro: Havre – Caumartin (lines 3, 9), Madeleine (lines 8, 12, 14) Website: https://www.theatredesmathurins.com Théâtre Antoine (1897) # Founded in 1897 by André Antoine, a pioneer of naturalist theatre, this 700-seat venue on Boulevard de Strasbourg is now a cornerstone of Parisian comedy. Its programme features crowd-pleasing comedies often led by well-known film actors.\nDistrict: 10th (14, Boulevard de Strasbourg) Metro: Strasbourg – Saint-Denis (lines 4, 8, 9), République (lines 3, 5, 8, 9, 11) Website: https://www.theatre-antoine.com Théâtre Michel (1906) # Founded in 1906, the Théâtre Michel is a 450-seat venue on Rue des Mathurins, steps from the Madeleine. Dedicated to boulevard comedies and light plays, it is appreciated for its friendly atmosphere and crowd-pleasing programme. Many hit comedies have premiered here before touring across France.\nDistrict: 8th (38, Rue des Mathurins) Metro: Havre – Caumartin (lines 3, 9), Madeleine (lines 8, 12, 14) Website: https://www.theatre-michel.fr Théâtre La Bruyère (1906) # Founded in 1906, the Théâtre La Bruyère is an intimate 300-seat venue on Rue La Bruyère, in the Nouvelle-Athènes district. Its small capacity creates a privileged setting for comedies and auteur plays where the closeness to the performers makes every show a vivid experience. It has launched many talents and remains a landmark for discerning theatre-goers.\nDistrict: 9th (5, Rue La Bruyère) Metro: Saint-Georges (line 12), Pigalle (lines 2, 12) Website: https://www.theatrelabruyere.com Théâtre Édouard VII (1913) # Inaugurated in 1913, the Théâtre Édouard VII is an intimate Italian-style venue with 690 seats, nestled in the heart of the Opéra district. Renowned for its programme of boulevard plays and contemporary comedies, it is named after King Edward VII of England, a great lover of Paris.\nDistrict: 9th (Place Édouard VII) Metro: Opéra (lines 3, 7, 8), Madeleine (lines 8, 12, 14) Website: https://www.theatreedouard7.com Théâtre Mogador (1919) # Inaugurated in 1919, the Théâtre Mogador is an immense 1,600-seat venue on Rue de Mogador, near the Opéra. The premier destination for musicals in Paris, it has hosted international productions such as The Lion King, Mamma Mia! and Les Misérables. Its scale and stage make it the ideal theatre for large-scale musical shows.\nDistrict: 9th (25, Rue de Mogador) Metro: Trinité – d\u0026rsquo;Estienne d\u0026rsquo;Orves (line 12), Chaussée d\u0026rsquo;Antin – La Fayette (lines 7, 9) Website: https://www.mogador.net Théâtre des Nouveautés (1921) # Inaugurated in 1921, the Théâtre des Nouveautés is the temple of vaudeville and light comedy. Its 580-seat auditorium on Boulevard Poissonnière programmes exclusively comedies, often starring well-known French film and television actors.\nDistrict: 9th (24, Boulevard Poissonnière) Metro: Grands Boulevards (lines 8, 9) Website: https://www.theatredesnouveautes.fr Théâtre de la Michodière (1925) # Built in 1925 in Art Deco style, the Théâtre de la Michodière is a 700-seat venue dedicated to comedy for nearly a century. Its elegance and acoustics make it a sought-after location for boulevard comedies by the finest contemporary playwrights.\nDistrict: 2nd (4 bis, Rue de la Michodière) Metro: Quatre-Septembre (line 3), Opéra (lines 3, 7, 8) Website: https://www.michodiere.com Théâtre Saint-Georges (1929) # Inaugurated in 1929, the Théâtre Saint-Georges is an elegant 500-seat venue on Rue Saint-Georges. With its Art Deco façade and refined interior, it programmes comedies, contemporary theatre and classic plays. Many Parisian boulevard hits have been created or revived here.\nDistrict: 9th (51, Rue Saint-Georges) Metro: Saint-Georges (line 12), Notre-Dame-de-Lorette (line 12) Website: https://www.theatre-saint-georges.com Théâtre Hébertot (1940) # An intimate 620-seat venue on Avenue de Villiers, the Théâtre Hébertot has been staging comedies and contemporary theatre since 1940. Known for the quality of its scripts and the closeness between performers and audience, it remains a favourite among Parisian theatre-goers.\nDistrict: 17th (78 bis, Boulevard des Batignolles) Metro: Villiers (lines 2, 3), Rome (line 2) Website: https://www.theatrehebertot.com Théâtre Fontaine (1946) # Founded in 1946, the Théâtre Fontaine is a 600-seat venue on Rue Fontaine, in the heart of the Pigalle district. Specialising in comedy and boulevard theatre, it has hosted memorable shows featuring the biggest names on the French stage. Its warm atmosphere and crowd-pleasing programme make it a must for comedy lovers.\nDistrict: 9th (10, Rue Fontaine) Metro: Blanche (line 2), Pigalle (lines 2, 12) Website: https://www.theatrefontaine.com ","date":"May 15, 2026","externalUrl":null,"permalink":"/en/sorties/theatre/theatres-de-paris/","section":"Outings","summary":"A selection of Parisian theatres to discover.","title":"Theatres in Paris","type":"sorties"},{"content":"","date":"April 24, 2026","externalUrl":null,"permalink":"/en/tags/concert/","section":"Tags","summary":"","title":"Concert","type":"tags"},{"content":"","date":"April 24, 2026","externalUrl":null,"permalink":"/en/tags/electro-rock/","section":"Tags","summary":"","title":"Electro-Rock","type":"tags"},{"content":"","date":"April 24, 2026","externalUrl":null,"permalink":"/en/tags/lille/","section":"Tags","summary":"","title":"Lille","type":"tags"},{"content":"","date":"April 24, 2026","externalUrl":null,"permalink":"/en/categories/music/","section":"Categories","summary":"","title":"Music","type":"categories"},{"content":"","date":"April 24, 2026","externalUrl":null,"permalink":"/en/sorties/musique/","section":"Outings","summary":"","title":"Music","type":"sorties"},{"content":"","date":"24 janvier 2026","externalUrl":null,"permalink":"/categories/musique/","section":"Categories","summary":"","title":"Musique","type":"categories"},{"content":"","date":"April 24, 2026","externalUrl":null,"permalink":"/en/tags/rock/","section":"Tags","summary":"","title":"Rock","type":"tags"},{"content":" The Band # Skip the Use is a high-energy French rock band from Lille, formed in 2008 around frontman Mat Bastard. Their sound blends electro-rock, punk, funk, and hip-hop — all of which comes alive on stage with infectious energy, bouncing musicians, and anthemic choruses. They won a Victoire de la Musique in 2013 (Can Be Late), became festival staples across Europe, and have always stayed true to their Northern French roots.\nAfter a hiatus in 2016 and a reformation in 2019 with a refreshed lineup (Enzo Gabert on drums and Nelson Martins on bass), the band continued evolving with Past \u0026amp; Future, then Human Disorder (2022) — an intense post-pandemic album.\nLove \u0026amp; Anxiety (2026) # Released on April 24, 2026, Love \u0026amp; Anxiety is described by Mat Bastard as a \u0026ldquo;fresh start after a necessary pause to level up.\u0026rdquo; The album explores human dualities — light and darkness, calm and rage — across 14 tracks that move through genres without settling.\nI discovered the album without knowing what to expect and it\u0026rsquo;s a great surprise: STU plays across multiple registers and the whole thing demands repeat listens.\nMy favourite tracks:\nNot Too Late Good Old Days Grew Up Mad Also: Say That You Love Me, Distorter, We Are Good…\nLive # I had tickets to see them at La Madeleine (Lille) on December 16, 2022 — but the show was cancelled. Major disappointment at the time.\nI finally got to see them live at the Ancienne Belgique (AB, Brussels) on December 8, 2025, with Elvis Black Star as the opening act. The energy on stage is exactly what you\u0026rsquo;d expect from Skip the Use — impossible to stand still.\nUpcoming dates:\nL\u0026rsquo;Aéronef, Lille — January 22, 2027 (one of my favourite venues) Sceneo, Longuenesse — January 23, 2027 Cirque Royal, Brussels — February 12, 2027 ","date":"April 24, 2026","externalUrl":null,"permalink":"/en/sorties/musique/skip-the-use/","section":"Outings","summary":"Skip the Use and the Love \u0026 Anxiety album — high-voltage rock from Lille.","title":"Skip the Use","type":"sorties"},{"content":"","date":"January 16, 2026","externalUrl":null,"permalink":"/en/tags/hastings/","section":"Tags","summary":"","title":"Hastings","type":"tags"},{"content":" The Band # Kid Kapichi is unfiltered British punk, formed in Hastings in 2013 by Jack Wilson (vocals/guitar) and Ben Beetham. Joined by Eddie Lewis (bass) and George MacDonald (drums), they built an explosive live reputation before breaking internationally — personally invited by Liam Gallagher to play the Royal Albert Hall in 2022, supporting Frank Carter \u0026amp; The Rattlesnakes, and touring with Nothing But Thieves.\nIn May 2025, Ben and George amicably left the band after over a decade. Jack and Eddie continue with a refreshed lineup: Lee Martin (guitar, ex-Saint Agnes) and Miles Gill (drums, ex-ROAM) — mates from Hastings since their teenage years. Kid Kapichi 2.0 is born, more determined than ever.\nIf you like: Frank Carter \u0026amp; The Rattlesnakes, The Clash, Demob Happy, Nothing But Thieves, Pixies.\nDiscography # Album Year Label This Time Next Year 2021 Independent Here\u0026rsquo;s What You Could Have Won 2022 Spinefarm There Goes the Neighbourhood 2024 Spinefarm Fearless Nature 2026 Spinefarm Fearless Nature (2026) # Released January 16, 2026, Fearless Nature marks a turning point. Written during a period of personal upheaval for Jack Wilson, the album is more introspective than its predecessors — the writing once fueled by anger is now driven by vulnerability and fear. A pivotal, therapeutic work that opens a new chapter without losing any of the band\u0026rsquo;s punk force.\n\u0026ldquo;Meeting the energy of The Clash with the melancholy of the Pixies, modernising them at every turn, Kid Kapichi reveal themselves in a radiant new light\u0026rdquo; — Rolling Stone\nTracklist:\nLeader Of The Free World Intervention Shoe Size Stainless Steel Worst Kept Secret Dark Days Are Coming Patience If You\u0026rsquo;ve Got Legs Head Right Saviour Rabbit Hole Essential tracks:\nStainless Steel — the lead single, raw introspection laid bare Dark Days Are Coming — gripping social critique Shoe Size — classic Kapichi punk energy \u0026ldquo;Down The Rabbit Hole\u0026rdquo; Tour 2026 # Kid Kapichi embark on their biggest-ever European headline tour in late 2026:\nDate City Venue Nov 22 Hamburg Uebel \u0026amp; Gefährlich Nov 23 Wiesbaden Kesselhaus Nov 25 Amsterdam Melkweg Max Nov 26 Antwerp Trix Nov 28 Paris Le Trabendo (~€24) Nov 30 Berlin SO36 Dec 1 Munich Strom Dec 4 Milan Legend Club Dec 5 Zurich Komplex Klub Dec 6 Cologne Gebäude 9 Dec 7 Lille L\u0026rsquo;Aéronef Dec 9 Nantes Le Ferrailleur Dec 10 Bordeaux Rock School Barbey ","date":"January 16, 2026","externalUrl":null,"permalink":"/en/sorties/musique/kid-kapichi/","section":"Outings","summary":"Kid Kapichi — razor-sharp British punk from Hastings, blending social rage with raw introspection.","title":"Kid Kapichi","type":"sorties"},{"content":"","date":"January 16, 2026","externalUrl":null,"permalink":"/en/tags/punk/","section":"Tags","summary":"","title":"Punk","type":"tags"},{"content":"","date":"January 16, 2026","externalUrl":null,"permalink":"/en/tags/uk/","section":"Tags","summary":"","title":"UK","type":"tags"},{"content":"","date":"November 1, 2025","externalUrl":null,"permalink":"/en/tags/cooking/","section":"Tags","summary":"","title":"Cooking","type":"tags"},{"content":"Here are some recipes we have already tried:\nVeal sauté with carrots, ras el hanout and preserved lemon # https://www.papillesetpupilles.fr/2025/03/saute-de-veau-aux-carottes-ras-el-hanout-et-citron-confit.html/\nRoasted fennel with honey and balsamic, parmesan and pumpkin seeds # https://www.saveursfrance.com/fenouil-miel-et-balsamique-parmesan/\nVegetarian Curry Parmentier with Sweet Potatoes and Cashew Nuts # https://www.facebook.com/story.php?story_fbid=122144649746343633\u0026id=61560308991103\u0026mibextid=wwXIfr\u0026rdid=Uozz15IAsYbQUSGv#\nChicken thigh tagine with 6 vegetables # https://www.colruyt.be/fr/recettes/tajine-aux-hauts-de-cuisses-de-poulet-et-aux-6-legumes\nVegetable tagine with raisins # https://www.delhaize.be/fr/recettes/recetteDetails/Tajine-de-legumes-aux-raisins/\nMeatball tagine with roasted tomatoes # https://www.delhaize.be/fr/recettes/recetteDetails/Tajine-de-boulettes-aux-tomates-roties/\nSouthern-style vegetable shepherd\u0026rsquo;s pie # https://cuisine.journaldesfemmes.fr/recette/343510-hachis-parmentier-aux-legumes-du-sud\nVegetable-stuffed cannelloni # https://www.cuisineaz.com/recettes/cannellonis-farcis-aux-legumes-47033.aspx\nThe authentic Tarte Tatin recipe # https://www.youtube.com/watch?v=HFjTdgh_oKQ\nButternut squash pasta with chipolatas # https://www.colruyt.be/fr/recettes/pates-a-la-courge-butternut-et-aux-chipolatas\nSalmon, ricotta and spinach cannelloni # https://www.cuisineactuelle.fr/culture-food/les-petits-plus-en-cuisine/actu-food/cannelloni-au-saumon-ricotta-et-epinards-la-recette-italienne-tres-facile-193217\nPenne with fennel, tomatoes and poultry chipolatas # https://www.colruyt.be/fr/recettes/pennes-au-fenouil-aux-tomates-et-aux-chipolatas-de-volaille\nCoconut chicken and cashew nut tart # https://www.chefclub.tv/fr/recettes/daily/8d2cef3d-a6a8-47b9-b480-07b8f60a1b29/tarte-poulet-coco-et-noix-de-cajou-en-cuisine-avec-mc-au-naturel/\nCoconut ginger chicken tart, Tartes Françoise style # https://toquedechoc.com/2019/08/tarte-poulet-coco-gingembre-facon-tartes-francoise/\n","date":"November 1, 2025","externalUrl":null,"permalink":"/en/sorties/boire-manger/recettes-de-cuisine/","section":"Outings","summary":"Here are some recipes we have already tried.","title":"Cooking Recipes","type":"sorties"},{"content":"","date":"1 janvier 2025","externalUrl":null,"permalink":"/tags/cuisine/","section":"Tags","summary":"","title":"Cuisine","type":"tags"},{"content":"","date":"1 janvier 2025","externalUrl":null,"permalink":"/tags/recettes/","section":"Tags","summary":"","title":"Recettes","type":"tags"},{"content":"","date":"November 1, 2025","externalUrl":null,"permalink":"/en/tags/recipes/","section":"Tags","summary":"","title":"Recipes","type":"tags"},{"content":"","date":"November 1, 2025","externalUrl":null,"permalink":"/en/categories/restaurants/","section":"Categories","summary":"","title":"Restaurants","type":"categories"},{"content":"","date":"1 janvier 2025","externalUrl":null,"permalink":"/categories/resto/","section":"Categories","summary":"","title":"Resto","type":"categories"},{"content":"","date":"28 janvier 2025","externalUrl":null,"permalink":"/tags/2025/","section":"Tags","summary":"","title":"2025","type":"tags"},{"content":"","date":"July 28, 2025","externalUrl":null,"permalink":"/en/categories/asia/","section":"Categories","summary":"","title":"Asia","type":"categories"},{"content":"","date":"July 28, 2025","externalUrl":null,"permalink":"/en/voyages/asie/","section":"Travels","summary":"","title":"Asia","type":"voyages"},{"content":"","date":"28 janvier 2025","externalUrl":null,"permalink":"/categories/asie/","section":"Categories","summary":"","title":"Asie","type":"categories"},{"content":"","date":"July 28, 2025","externalUrl":null,"permalink":"/en/tags/bali/","section":"Tags","summary":"","title":"Bali","type":"tags"},{"content":"Off to Indonesia for a 2-week trip between the Island of the Gods and the Island of Fire. On the agenda: volcano ascents, visits to majestic temples, discovering Hindu culture, walks and relaxation among the rice terraces… not forgetting the mie goreng and dardar gulung!\nDay 1: Departure # Airline: Qatar Airways Brussels (9am) – Doha (4:45pm) Duration: 6h45 Doha (5:30pm) – Denpasar (8:25am) Duration: 9h55 Day 2: Arrival in Bali \u0026amp; Ubud # Arrival at 8:25am Immigration, luggage, customs Driver takes us to the hotel (1h30) Briefing by Bali Passion We enjoy the hotel\u0026rsquo;s Afternoon Tea Drop off luggage / Rest Day 3: Ubud \u0026amp; Taman Ayun # Visit of the rice terraces around the hotel Bukit Campuhan Monkey Forest Taman Ayun Kopi Luwak Legong Dance at Ubud Palace Day 4: Mount Batur # Early morning ascent of Mount Batur Descent of Mount Batur by bicycle Accident and off to the hospital Return to hotel Day 5: On the road to Munduk # Jatiluwih rice terraces Bedugul market Lake Dana Bratan Banyumala waterfalls Arrival at hotel Sanak Retreat Massage session for the girls Day 6: Munduk # Hotel swimming pool Guided tour of the primary forest Canoe on Lake Tambligan Banjar hot springs Arrival at hotel Taman Sari in Pemuteran Day 7: Pemuteran # Snorkelling at Menjagan Visit of Puri Melanting temple Warung De\u0026rsquo;Lekong Day 8: Kawah Ijen # Early morning to go to Java Ferry Breakfast at the foot of Kawah Ijen Ascent of Kawah Ijen Descent and fruit shopping at the market Drive to the foot of Mount Bromo Hotel Joglo Kecombrang Bromo Day 9: Mount Bromo # Early morning to watch the sunrise over Mount Bromo Many Jeeps Superb sunrise over the different peaks: Mount Batok and Mount Seremu Back down by jeep to the foot of Bromo We discover the plain we crossed at night Ascent to the crater, accessible via stairs We head to Surabaya station but the driver and guide prefer to drop us off at Mojokerto We ask to go to Madakaripura waterfalls first As expected, we arrive well ahead of time so we decide to have a coffee across from the station A station employee shows us where to wait for the train and stays with us chatting and taking photos until our departure for Yogyakarta Our new guide Johannes (Jean) meets us at the platform exit and drives us to the Phoenix hotel Day 10: Borobudur, Candirejo \u0026amp; Candi Pawon # Early breakfast Visit of Borobudur site Visit of the traditional village of Candirejo by horse-drawn carriage Visit of Pawon temple Return to the Phoenix hotel Swimming pool Visit of Malioboro street Day 11: Merapi, Sultan\u0026rsquo;s Palace, Taman Sari \u0026amp; Prambanan # Jeep tour of Merapi volcano Story of the eruption and the village destruction Visit of the Sultan\u0026rsquo;s Palace with a very friendly French-speaking guide Visit of the puppet museum Visit of Taman Sari Purchase of delicious Bakpia in an alley near Taman Sari Visit of Prambanan Return to the Phoenix hotel Day 12: Nusa Penida # Early morning to get to Yogya airport Domestic flight to Denpasar with Lion Air Transfer to Sanur to take the Speed Boat to Nusa Penida Driver takes us to Villa Panorama We enjoy the private swimming pool Day 13: Diamond Beach, Atuh Beach \u0026amp; Goa Guri Putri # Breakfast prepared by locals: banana pancakes among other things We head to Diamond Beach Atuh Beach Visit of the underground Hindu temple Goa Guri Putri Dinner at The Terrace Day 14: Snorkelling, Crystal Bay, Angel\u0026rsquo;s Billabong, Broken Beach, Kelingking Beach # Snorkelling to observe manta rays We stop at Crystal Bay and Alix suggests going to the secret beach of Pandan Beach Direction Angel\u0026rsquo;s Billabong and Broken Beach Then the most photographed beach of Nusa Penida: Kelingking Beach Day 15: Return to Bali and visit to Uluwatu # We enjoy the pool before leaving Nusa Penida Speedboat to Sanur where we are welcomed by our last guide for the end of the trip Direction southern Bali to Uluwatu — many thieving monkeys Rather than watching the Fire Dance at Uluwatu, our guide suggests going to see this show at Melasti Dinner on Jimbaran beach Arrival at the last hotel, Kashantee Village Day 16: Tanah Lot \u0026amp; Seminyak # Visit of Tanah Lot Balinese family massage The trip comes to an end and we head to Denpasar airport Day 17: Return to Belgium # Take-off from Denpasar at 1:05am, arriving in Doha at 5:40am We use some Avios points for a coffee at the Harrods Tea Room Take-off to Brussels at 8:55am, landing at 2:40pm ","date":"July 28, 2025","externalUrl":null,"permalink":"/en/voyages/asie/bali-java/","section":"Travels","summary":"Off to Indonesia for a 2-week trip between the Island of the Gods and the Island of Fire. On the agenda: volcano ascents, visits to majestic temples, discovering Hindu culture, walks and relaxation among the rice terraces… not forgetting the mie goreng and dardar gulung!","title":"Bali \u0026 Java","type":"voyages"},{"content":"","date":"July 28, 2025","externalUrl":null,"permalink":"/en/tags/indonesia/","section":"Tags","summary":"","title":"Indonesia","type":"tags"},{"content":"","date":"28 janvier 2025","externalUrl":null,"permalink":"/tags/indon%C3%A9sie/","section":"Tags","summary":"","title":"Indonésie","type":"tags"},{"content":"","date":"July 28, 2025","externalUrl":null,"permalink":"/en/tags/java/","section":"Tags","summary":"","title":"Java","type":"tags"},{"content":"","date":"June 22, 2025","externalUrl":null,"permalink":"/en/tags/japan/","section":"Tags","summary":"","title":"Japan","type":"tags"},{"content":"","date":"22 janvier 2025","externalUrl":null,"permalink":"/tags/japon/","section":"Tags","summary":"","title":"Japon","type":"tags"},{"content":"","date":"June 22, 2025","externalUrl":null,"permalink":"/en/tags/kyoto/","section":"Tags","summary":"","title":"Kyoto","type":"tags"},{"content":"Less than 48 hours to visit one of the iconic cities of the Land of the Rising Sun…\nActivities # Landed in Japan at Osaka (Kansai Airport) Flights Brussels–Munich and Munich–Osaka Finish the online procedure on the official site so you get the QR code and can skip filling out paperwork when you arrive in Japan The Klook app is really handy for buying train tickets I’d bought my ticket ahead of time—just flashed the QR at the gate to get onto the Haruka platform to Kyoto Some carriages have reserved seating, others are non-reserved The train is decked out in Hello Kitty Kyoto Station is huge. Use your train QR at the gates to tap out. You can withdraw cash at the station near a tourist desk, where you can also buy a transit card for ¥1,100 One Day Pass website: https://oneday-pass.kyoto/?lang=en Left our suitcases at Hotel Rings Kyoto: https://hotel-rings.com/en/ ","date":"June 22, 2025","externalUrl":null,"permalink":"/en/voyages/asie/kyoto/","section":"Travels","summary":"Less than 48 hours to visit one of the iconic cities of the Land of the Rising Sun…","title":"Kyoto","type":"voyages"},{"content":"","date":"January 8, 2025","externalUrl":null,"permalink":"/en/tags/city-trip/","section":"Tags","summary":"","title":"City Trip","type":"tags"},{"content":"","date":"January 8, 2025","externalUrl":null,"permalink":"/en/tags/france/","section":"Tags","summary":"","title":"France","type":"tags"},{"content":"A few handy tips for visiting Paris…\nTransport / Logistics # The Citymapper app for getting around town. Set up a Navigo pass on your phone with the Bonjour RATP app: add it to Apple Wallet on iPhone, pay contactlessly, and skip queues at metro ticket machines. Luggage: Bounce or Nannybag. At Gare du Nord, be cautious with left luggage: there have been safety incidents (bomb alerts linked to bags have already disrupted or shut down baggage services). Batobus: hop-on hop-off, nine stops on the Seine — a nice alternative to the metro to see Paris from the river. Accommodation # Prefer Airbnb in Paris: Flat near Montmartre, Flat near Gare du Nord, Another flat near Gare du Nord. Alternative: stay outside Paris (often cheaper). Example: Ibis Styles Paris Romainville, about 300 m from metro line 5 into the centre. Museums \u0026amp; monuments # Louvre — guided tour: book long in advance. Musée Carnavalet — history of Paris: a guided tour is recommended (thematic tour “The museum essentials”) — check the calendar with filters. Palais Garnier — self-guided tours, guided tours, or immersive game Arsène Lupin and the opera’s secrets. Hôtel des Invalides — immersive show Aura Experience. BnF — free, glorious library; Galerie Vivienne is right next door. Musée d’Orsay — essential; guided tours for families or adults the masterpieces — book well ahead. Musée Grévin — often long queues, but kids love it. Near Théâtre des Variétés and Théâtre des Nouveautés. Eiffel Tower — tickets, especially in advance during school holidays; sparkle every evening (about five minutes at the start of each hour) — since July 2024, Tour Eiffel Effect, immersive experience on the first floor. Sainte-Chapelle — advance tickets and commented tours; best on a sunny day for the stained glass. Notre-Dame — reopened 7 December 2024; book online, mobile app. Basilica of Sacré-Cœur — dome visit for a great view; attending a Mass (four daily) is a nice way to visit. Eternelle Notre-Dame — virtual tour, beautiful, highly recommended. Theatres # Read reviews on Ticketac. Mon jour de chance at Théâtre Fontaine — really good, we strongly recommend it. Une idée géniale — seen in Brussels at Théâtre des Galeries; in Paris at Théâtre des Variétés until 27 April 2025. ADN at Théâtre Michel — fun thriller, gripping pace, sets and projected images. Entertainment # Le Grand Rex — Paris’s largest screen with optional guided visit or cinema-themed escape room; La Féerie des Eaux over the Christmas period. Outdoor escape games — Atlantide app, Sous surveillance mission in the Marais from Place des Vosges (free, geolocation). Organised escapes: Butte-aux-Cailles via My Urban Experience. Seine cruise — La Croisière des Mystères with Vedettes de Paris, embarkation near the Eiffel Tower. Walks # Plenty of walks on the Paris je t’aime site. Paris neighbourhood-by-neighbourhood shopping trails on Visit Paris Region. Restaurants # Google Maps with filters, Mapstr, TripAdvisor. Bib Gourmand for great value meals. Cantine De Sam (near Théâtre Fontaine) or Baba next door; Afendi Lebanese near Théâtre Antoine; Eats Thyme Lebanese near the Louvre / Palais-Royal (Ma Table Libanaise cookbook); Lazzi before Théâtre Édouard VII (direct theatre entrance from the restaurant). For quirky picks, try list-style articles such as Topito. Always double-check the place still exists and is open when you visit. ","date":"January 8, 2025","externalUrl":null,"permalink":"/en/voyages/europe/paris/","section":"Travels","summary":"Useful tips for visiting Paris.","title":"Paris","type":"voyages"},{"content":"","date":"October 26, 2024","externalUrl":null,"permalink":"/en/tags/2024/","section":"Tags","summary":"","title":"2024","type":"tags"},{"content":"","date":"October 26, 2024","externalUrl":null,"permalink":"/en/categories/america/","section":"Categories","summary":"","title":"America","type":"categories"},{"content":"","date":"October 26, 2024","externalUrl":null,"permalink":"/en/voyages/amerique/","section":"Travels","summary":"","title":"Americas","type":"voyages"},{"content":"","date":"26 janvier 2024","externalUrl":null,"permalink":"/categories/amerique/","section":"Categories","summary":"","title":"Amerique","type":"categories"},{"content":"","date":"October 26, 2024","externalUrl":null,"permalink":"/en/tags/canada/","section":"Tags","summary":"","title":"Canada","type":"tags"},{"content":"A city trip between two Canadian capitals: the cobblestone streets of Old Montréal, the train to Ottawa and Parliament Hill. Bonus: a giant spider and a UNESCO-listed canal.\nDay 1: Montréal # Check-in at Hôtel Bonaventure Montréal, perched on the roof of the Place Bonaventure Pavilion with its 2.5-acre garden and heated outdoor pool First encounter with the hotel\u0026rsquo;s resident squirrels — not so surprising when you know the property maintains a real natural park on its rooftops Drinks at Brewskey in the old town, a speakeasy-style cocktail bar tucked into the cobblestone streets of Vieux-Montréal Stroll along the Old Port, redesigned in 1992 for the city\u0026rsquo;s 350th anniversary, stretching 2.5 km along the St. Lawrence River Quai de l\u0026rsquo;Horloge: a summer urban beach at the foot of the Tour du Havre (1922), built in memory of Canadian sailors who fell during the First World War — 45 m tall with 192 steps to the top Grande Roue de Montréal: 60 m high, 42 climate-controlled gondolas, panoramic views over the river and the downtown skyline A stop in front of Chapelle Notre-Dame-de-Bon-Secours, founded in 1657 by Marguerite Bourgeoys — known as \u0026ldquo;the sailors\u0026rsquo; church\u0026rdquo; for the model ships hanging as votive offerings from its ceiling A walk around Marché Bonsecours, an 1847 neoclassical building with a silver dome visible from the St. Lawrence, formerly used as a provisional parliamentary venue A must-stop at Messorem Bracitorium microbrewery near the Lachine Canal, renowned for its wild ales and mixed oak barrel fermentations Day 2: Ottawa # Montréal Central Station is directly accessible from Hôtel Bonaventure via the underground RESO network — handy with luggage Train journey Montréal → Ottawa in about 2 hours with VIA Rail Ottawa\u0026rsquo;s station is on the outskirts (Vanier neighbourhood, ~5 km from the centre): an Uber is essential to reach Hôtel Metcalfe by Gray Collection Territorial Prerogative sculpture on Sparks Street, Ottawa\u0026rsquo;s historic pedestrian street Guided tour of the Parliament of Canada: sessions have been held in the West Block since the renovation of the Centre Block (Peace Tower), expected to last until 2030 Wandering around Parliament Hill, a national heritage site overlooking the Ottawa River, home to the Centennial Flame lit in 1967 Statue of William Lyon Mackenzie King, the longest-serving Prime Minister in Canadian history (1921–1948) A walk along the Rideau Canal, built between 1826 and 1832 and designated a UNESCO World Heritage Site in 2007 — in winter, its 7.8 km freeze into the world\u0026rsquo;s largest naturally skating rink A stop in front of Maman by Louise Bourgeois, outside the National Gallery of Canada: 9 m tall in steel and bronze, carrying 26 white marble eggs in its sac — one of only 6 replicas in the world (Bilbao, London, Ottawa, St. Petersburg, Seoul, Tokyo) Notre-Dame Cathedral Basilica of Ottawa, the city\u0026rsquo;s oldest church (1832), with its twin towers added in 1879 An obligatory stop at Brasserie du Bas Canada in Gatineau, just across the Ottawa River 1 night at Metcalfe Hotel by Gray Collection, a 4-star boutique hotel steps from Parliament Hill ","date":"October 26, 2024","externalUrl":null,"permalink":"/en/voyages/amerique/montreal-ottawa/","section":"Travels","summary":"A city trip between two Canadian capitals: the cobblestone streets of Old Montréal, the train to Ottawa and Parliament Hill. Bonus: a giant spider and a UNESCO-listed canal.","title":"Montréal \u0026 Ottawa","type":"voyages"},{"content":"","date":"1 janvier 2024","externalUrl":null,"permalink":"/tags/cor%C3%A9e-du-sud/","section":"Tags","summary":"","title":"Corée Du Sud","type":"tags"},{"content":"Less than 48 hours to visit Seoul, capital of the \u0026ldquo;Land of the Morning Calm\u0026rdquo;.\nActivities # Exploring around the neighbourhoods we\u0026rsquo;d already scoped out:\nInsa-dong Samseong-dong Cheonggyecheon Stream Jongmyo Temple Jogye Temple Gwanghwamun Namdemun Dongdaemun Gwangjang Market Other standout spots:\nMyeong-dong, basically a shopping area Yeoudi-do, a park on a small island in the river, right inside a business district Jamsil, for its little lake near a theme park, the country\u0026rsquo;s tallest tower for a panoramic sweep over Seoul, the shopping strips, and the Olympic Park a bit further away Itaewon, the foreigners\u0026rsquo; neighbourhood. Loads of international restaurants you won\u0026rsquo;t find elsewhere. Leeum Museum nearby Seoul Forest, a park when you need a break from the city Gangnam, business hub with tons of restaurants Bongeunsa Temple COEX, halfway between a shopping mall and a business complex Seodaemun Prison, a blunt reminder of Japanese occupation and how far it went Korean dishes # Bibimbap Samgyetang Dakgalbi Jjimdak Bulgogi Kimbap Sushi / sashimi (hwae) Barbecue eats like samgyeopsal Craft beers # Neighbourhood: Yongsan-dong / Itaewon-dong border (subway: Noksapyeong) Neighbourhood: Nogosan-dong (subway: Sinchon) Neighbourhood: Banpo-dong (subway: Sinbanpo) Neighbourhood: near Changdeokgung Seoul Gipsy Hannam Taproom (neighbourhood: Itaewon-dong, subway: Hangangjin) Neighbourhood: Yongsan-dong / Itaewon-dong border (subway: Noksapyeong) Other breweries:\nArt Monster (Seoul, near Changdeokgung) Ggeek Beer Company (Seoul, Euljiro subway) Playground Brewery (Incheon) Gorilla Brewing (Busan) The trip # Brussels–Warsaw and Warsaw–Seoul flights operated by LOT Land in Seoul around 6:30 a.m. If you\u0026rsquo;re exempt from K-ETA you still need to fill in the traveller arrival card Skip it if you have K-ETA or a residence card Immigration checks You can swap a bit of cash right after customs for buying a T-Money card Follow the Airport Railroad signs down to level B1 T-Money top-ups need cash You can buy a loaded T-Money card on the express train to Seoul (AREX) Plenty of machines to grab an express ticket into Seoul Or catch a non-direct train—way cheaper Arrival at Seoul Station. Bought a T-Money card (₩4,000) Seoullo 7017 is Seoul\u0026rsquo;s answer to Paris\u0026rsquo;s Coulée verte or New York\u0026rsquo;s High Line Swapped won back to euros at Money Box Loaded the T-Money card with ₩20,000 ₩1,400 each ride Tap in and tap out at the subway gates Hotel 28 in Myeong-dong ","date":"June 1, 2024","externalUrl":null,"permalink":"/en/voyages/asie/seoul/","section":"Travels","summary":"Less than 48 hours to visit Seoul, capital of the “Land of the Morning Calm”.","title":"Seoul","type":"voyages"},{"content":"","date":"June 1, 2024","externalUrl":null,"permalink":"/en/tags/south-korea/","section":"Tags","summary":"","title":"South Korea","type":"tags"},{"content":"","date":"April 14, 2024","externalUrl":null,"permalink":"/en/tags/2019/","section":"Tags","summary":"","title":"2019","type":"tags"},{"content":"","date":"14 janvier 2024","externalUrl":null,"permalink":"/tags/italie/","section":"Tags","summary":"","title":"Italie","type":"tags"},{"content":"","date":"April 14, 2024","externalUrl":null,"permalink":"/en/tags/italy/","section":"Tags","summary":"","title":"Italy","type":"tags"},{"content":" Day 1: Palermo # landed at Palermo airport at 6:40 p.m. Trinacria Express train into the city centre (central station) dropped our bags at the apartment on Via Vittorio Emanuele watched the festive lights from the balcony evening walk through the streets near the port first taste of brioche col tuppo with Sicilian gelato at Gelateria La Kala Day 2: Palermo # left our bags somewhere safe, 2-hour guided tour of Palermo via Airbnb, leaving from Piazza Bologni stopped at Pasticceria Costa for cannoli route: Foro Italico – Porta Felice – Piazza Marina – Corso Vittorio Emanuele – Piazza Pretoria – Quattro Canti – Ballarò glass of « Sangue » (“Sicilian blood”) at Taverna Azzura (Vucciria)—a typical sweet wine somewhere between Marsala and Zibibbo dinner and our first caponata free time: Villa Bonanno the kids had their first granita train out to the airport to pick up the rental car arrived at our place in Scopello (Visicari) Day 3: Zingaro Nature Reserve # pool after breakfast hike in Zingaro nature reserve met Peppe and his tuna sandwiches (panino con tonno affumicato, orosicilia.com) picnic near Cala del Varo, then on toward Cala Berretta and Cala Disa dinner at Torre Bennistra, looking out over the Tonnara di Scopello Day 4: Segesta # pool in the morning delicious caponata made by the owners’ family visit to the Segesta archaeological park: the temple and the Hellenistic theatre back to the pool and a barbecue Day 5: Favignana # wandered the garden at our lodging drove to Trapani for the Egadi islands rented bikes on Favignana stunning coves and beaches ferry back around 6:30 p.m. dinner in Scopello at Isonzo Cinque Day 6: Erice # left Visicari cable car up to Erice (on Mondays it opens at 1 p.m.) hillside views from the egg-shaped cabins short loop (3 km) or longer one (4 km) beautiful medieval hill town with sea views pastries at Antica Pasticceria Del Convento (genovesi filled with custard, ricotta or hazelnuts) walked up to Castello di Venere cable car down around 4 p.m. drove on to Agrigento quick swim in the pool Day 7: Agrigento \u0026amp; the Valley of the Temples # breakfast by the pool morning at the pool visit to the Valley of the Temples park Scala dei Turchi drinks at bar Acanthus fruit stop in Gela arrived at “La Dimora del Delcano” around 9 p.m. Day 8: Noto # Noto, Ragusa Day 10: Climbing Mount Etna # Day 12: Taormina # Day 13: Lipari # exploring Lipari Day 14: Vulcano # Vulcano—mud baths / spa Day 16: Stromboli # ascent of Stromboli—5 p.m. to 11 p.m. Day 17: Salina # exploring Salina Day 19: Back to Brussels # leaving Cefalù to catch our flight from Palermo ","date":"April 14, 2024","externalUrl":null,"permalink":"/en/voyages/europe/sicile-les-iles-eoliennes/","section":"Travels","summary":"19 days between Palermo, Scopello, Agrigento, Taormina, Lipari, Vulcano, Stromboli and Cefalù.","title":"Sicily \u0026 the Aeolian Islands","type":"voyages"},{"content":"","date":"1 janvier 2024","externalUrl":null,"permalink":"/tags/bal%C3%A9ares/","section":"Tags","summary":"","title":"Baléares","type":"tags"},{"content":"","date":"April 1, 2024","externalUrl":null,"permalink":"/en/tags/balearic-islands/","section":"Tags","summary":"","title":"Balearic Islands","type":"tags"},{"content":"","date":"1 janvier 2024","externalUrl":null,"permalink":"/tags/espagne/","section":"Tags","summary":"","title":"Espagne","type":"tags"},{"content":"","date":"April 1, 2024","externalUrl":null,"permalink":"/en/tags/minorca/","section":"Tags","summary":"","title":"Minorca","type":"tags"},{"content":" Day 1: Departure # Departure from Brussels Charleroi with Ryanair Arrival at Mahón Airport around 19:30 Baggage reclaim and rental car (Renault Captur) Day 2: Visit to Ciutadella # Meet-up with the manager of Villa Oliver Off to Ciutadella Stroll through the streets of Ciutadella Breakfast at Herbera and local speciality: Menorcan ensaïmades Day 8: # Short walk at Pont d’en Gil Far de Punta Nati Visit to the Lithica site ","date":"April 1, 2024","externalUrl":null,"permalink":"/en/voyages/europe/minorque/","section":"Travels","summary":"A week-long stay in Minorca. Visit to Ciutadella, coastal hikes and discovering the island.","title":"Minorca","type":"voyages"},{"content":"","date":"April 1, 2024","externalUrl":null,"permalink":"/en/tags/spain/","section":"Tags","summary":"","title":"Spain","type":"tags"},{"content":"","date":"March 31, 2024","externalUrl":null,"permalink":"/en/tags/forest-national/","section":"Tags","summary":"","title":"Forest National","type":"tags"},{"content":"The last Shaka Ponk concert at the Forest National arena.\nA fiery concert 15 Videos \u0026#9654; Twisted Mind 1:41 \u0026#9654; Wanna Get Free - Light Effects 0:42 \u0026#9654; Sex Ball 3:22 \u0026#9654; I\u0026#39;m Picky 0:31 \u0026#9654; I\u0026#39;m Picky (Unplugged) 0:23 \u0026#9654; Wanna Get Free 0:54 \u0026#9654; Circle Pit 0:41 \u0026#9654; Smells Like Teen Spirit - Crowd Surfing 0:50 \u0026#9654; Rusty Fonky - Godspel Intro 3:00 \u0026#9654; 13000 Heures 2:03 \u0026#9654; Rusty Fonky - Crowd Surfing 5:06 \u0026#9654; Tout le monde danse 1:24 \u0026#9654; Je m\u0026#39;avance 0:52 \u0026#9654; 13000 Heures - Love \u0026amp; Amazing ambiance 0:49 \u0026#9654; J\u0026#39;aime pas les gens - Stand up in crowd 1:27 ","date":"March 31, 2024","externalUrl":null,"permalink":"/en/sorties/musique/shaka-ponk-2/","section":"Outings","summary":"The last Shaka Ponk concert at the Forest National arena.","title":"Shaka Ponk","type":"sorties"},{"content":"One of my favourite bands. What can I say? Simply perfect. A subtle blend of pure energy and sensitivity.\n","date":"March 29, 2024","externalUrl":null,"permalink":"/en/sorties/musique/frank-carter-the-rattlesnakes/","section":"Outings","summary":"One of my favourite bands. A subtle blend of pure energy and sensitivity.","title":"Frank Carter \u0026 The Rattlesnakes","type":"sorties"},{"content":"","date":"28 janvier 2024","externalUrl":null,"permalink":"/tags/caf%C3%A9/","section":"Tags","summary":"","title":"Café","type":"tags"},{"content":"","date":"March 28, 2024","externalUrl":null,"permalink":"/en/tags/coffee/","section":"Tags","summary":"","title":"Coffee","type":"tags"},{"content":"","date":"28 janvier 2024","externalUrl":null,"permalink":"/tags/%C3%A9v%C3%A9nements/","section":"Tags","summary":"","title":"Événements","type":"tags"},{"content":"Une sélection d\u0026rsquo;événements récurrents à ne pas manquer — spectacles en plein air, visites éphémères et expériences culturelles uniques. Pensez à réserver dès l\u0026rsquo;ouverture des billetteries, ces événements affichent souvent complet en quelques jours !\nFévrier (2) # 💡 Bright Brussels Festival # Festival des lumières de Bruxelles — un parcours nocturne fascinant à travers le centre historique, composé d\u0026rsquo;installations lumineuses artistiques, interactives et poétiques. Plus de 20 œuvres d\u0026rsquo;artistes belges et internationaux illuminent les sites patrimoniaux emblématiques : Parc de Bruxelles, Mont des Arts, Place Royale, MIM, La Monnaie… En 2026 : 10e édition anniversaire avec 450.000 visiteurs. Gratuit et accessible à tous — un événement hivernal incontournable.\nPériode : Mi-février (12-15 février 2026), de 18h30 à 23h\nAccès : Gratuit\nFréquence : Annuel\nCentre historique de Bruxelles (Parc de Bruxelles → La Monnaie)\nSite web → 💡 Lichtfestival Gent (Fête des Lumières de Gand) # Tous les 3 ans, Gand s\u0026rsquo;illumine avec des œuvres d\u0026rsquo;artistes nationaux et internationaux — installations lumineuses, spectacles et performances sur un parcours de 5 km à travers le centre historique. Gratuit et spectaculaire. La dernière édition (2024) s\u0026rsquo;est tenue du 31 janvier au 4 février.\nProchaine édition : 2027 (dates à annoncer)\nAccès : Gratuit\nFréquence : Tous les 3 ans\nCentre historique de Gand\nSite web → 🎭 Carnaval de Binche # L\u0026rsquo;un des carnavals les plus extraordinaires au monde, inscrit au patrimoine culturel immatériel de l\u0026rsquo;UNESCO depuis 2003. Le clou du spectacle : les Gilles, personnages emblématiques en costume brodé et chapeau à plumes d\u0026rsquo;autruche de 3 kg, qui défilent au son des tambours et lancent des oranges dans la foule (porter du rouge pour être privilégié !). Tout commence dès le dimanche du carnaval avec le bal des Gilles à l\u0026rsquo;aube, suivi de trois jours de festivités : le Dimanche Gras, le Lundi Gras et surtout le Mardi Gras, apothéose du carnaval où quelque 1.000 Gilles envahissent les rues. Une tradition ancestrale qui remonte au XVe siècle, transmise de père en fils — être Gille est un honneur réservé aux hommes nés à Binche.\nPériode : Dimanche, lundi et mardi précédant le mercredi des Cendres (15-17 février 2026, apothéose le mardi 17)\nAccès : Gratuit dans les rues — tribunes payantes disponibles (~15-25 €)\nBon à savoir : Arriver tôt, la ville est envahie — prévoir le train (gare de Binche depuis La Louvière)\nFréquence : Annuel\nCentre-ville, 7130 Binche\nSite web → Mars (1) # 🏛️ BANAD Festival # Le Brussels Art Nouveau \u0026amp; Art Déco Festival — un événement annuel sur 3 week-ends qui ouvre les portes de lieux remarquables de l\u0026rsquo;architecture Art Nouveau et Art Déco bruxelloise, habituellement fermés au public. Visites guidées d\u0026rsquo;intérieurs exceptionnels (hôtels particuliers, ateliers, maisons de maître), balades thématiques à pied ou à vélo, et activités culturelles. En 2026 : 10e édition anniversaire. Les visites affichent complet très vite — réserver dès l\u0026rsquo;ouverture de la billetterie.\nPériode : Mi-mars (14-29 mars 2026, sur 3 week-ends)\nOuverture des réservations : Début février (3 février 2026 à 14h)\nTarifs : ~13 € par visite\nProchaine édition : 6-21 mars 2027\nRégion de Bruxelles-Capitale (divers lieux)\nSite web → Avril – Mai (7) # 🌷 Keukenhof # Le plus célèbre jardin de tulipes au monde : 32 hectares, 7 millions de bulbes en fleurs, pavillons thématiques (orchidées, lys), jardins d\u0026rsquo;inspiration et le Bloemencorso (corso fleuri de Noordwijk à Haarlem, le 18 avril). L\u0026rsquo;exposition florale est installée au cœur du domaine historique de Keukenhof (260 ha, 16 monuments classés) dont le jardin paysager anglais date de 1857. Une expérience visuelle et olfactive unique au printemps.\nPériode : 19 mars – 10 mai 2026 (tous les jours, 8h–19h)\nRéservation : Obligatoire en ligne — jauge quotidienne limitée, prévoir à l\u0026rsquo;avance pour le Bloemencorso (18 avril), Pâques et Koningsdag (27 avril)\nDepuis la Belgique : ~2h de route depuis Bruxelles\nStationsweg 166A, 2161 AM Lisse, Pays-Bas\nSite web → 🌿 Visites des Serres Royales de Laeken # Chaque printemps, les Serres Royales de Laeken ouvrent exceptionnellement leurs portes au public pendant trois semaines. Construites sous le règne de Léopold II à la fin du XIXe siècle, ces serres monumentales en verre et métal abritent une collection botanique remarquable — palmiers, fougères géantes, géraniums centenaires — dans un décor Art Nouveau signé Alphonse Balat. L\u0026rsquo;expérience est magique, surtout lors des visites nocturnes (vendredis, samedis et dimanches) quand les serres s\u0026rsquo;illuminent.\nPériode : Mi-avril à début mai (environ 3 semaines)\nOuverture des réservations : Fin mars / début avril — places limitées, réserver dès l\u0026rsquo;annonce officielle\nVisites nocturnes : Vendredis, samedis et dimanches en soirée\nAvenue du Parc Royal, 1020 Bruxelles\nSite web → 🌸 Festival des jacinthes du Hallerbos # Nulle part en Flandre on ne trouve autant de jacinthes sauvages que dans le Bois de Hal. Entre la mi-avril et le début du mois de mai, ces fleurs printanières créent un magnifique tapis violet sur plusieurs hectares de forêt — un spectacle unique et éphémère à ne pas manquer. Pendant la période de floraison, des navettes gratuites sont mises à disposition entre la gare de Hal et le bois, plusieurs week-ends de suite. À combiner avec une visite du centre historique de Hal.\nPériode : Mi-avril à début mai (floraison variable selon la météo)\nAccès : Gratuit — pas de billet d\u0026rsquo;entrée requis\nNavettes gratuites : Depuis la gare de Hal, les week-ends de floraison\nDépliant du parcours : Disponible à l\u0026rsquo;office du tourisme de Hal ou en téléchargement sur visithalle.be\nHogebermweg, 1500 Halle (Hallerbos)\nSite web → 🍺 Les Saveurs de Silly # Festival gastronomique annuel organisé dans la commune de Silly, mettant à l\u0026rsquo;honneur les producteurs locaux du Hainaut — bières artisanales (dont la célèbre Brasserie de Silly), fromages fermiers, charcuteries et produits du terroir. Une journée conviviale en plein air pour découvrir les saveurs de la région wallonne dans une ambiance familiale.\nPériode : Printemps (généralement avril-mai)\nOuverture des réservations : Début avril — entrée libre, mais certaines activités nécessitent une inscription\nSilly, Hainaut, Belgique\nSite web → 🎪 Namur en Mai # Festival des arts de rue, de cirque, de magie et des univers forains qui envahit le centre de Namur pendant trois jours. Une programmation ambitieuse et thématisée, spécialement conçue pour émerveiller grands et petits : créatures magiques, contes murmurés dans une cabane, ballets acrobatiques, cabarets déjantés et spectacles au hasard d\u0026rsquo;un coin de rue. Plus de la moitié des spectacles sont gratuits. Projet de l\u0026rsquo;asbl Pastoo, également à l\u0026rsquo;origine de LaSemo et Bucolic Brussels.\nPériode : 14-16 mai 2026\nAccès : Gratuit pour plus de la moitié des spectacles — entrées Article 27 disponibles pour les spectacles payants\nBilletterie : tickets.namurenmai.org\nFréquence : Annuel\nCentre-ville, 5000 Namur\nSite web → 🐉 La Ducasse de Mons (Doudou) # Festivités rituelles montoises inscrites au patrimoine immatériel de l\u0026rsquo;UNESCO. Point d\u0026rsquo;orgue : la Procession du Car d\u0026rsquo;Or (1.600 figurants, 180 musiciens, 50 cavaliers sur 3 km) le dimanche matin, suivie du Combat dit Lumeçon — un affrontement rituel entre Saint-Georges et le Dragon sur la Grand-Place, où la foule tente d\u0026rsquo;arracher un crin de la queue du dragon (porte-bonheur !). En 2026 : le 600e anniversaire de la Descente de Châsse. Également : concerts, braderie, festival de fanfares de rue.\nPériode : Fin mai – début juin (27 mai – 2 juin 2026, Lumeçon le 31 mai à 12h30)\nAccès : Gratuit\nGrand-Place et centre-ville, 7000 Mons\nSite web → 🎻 Concours Reine Elisabeth # L\u0026rsquo;un des concours de musique classique les plus prestigieux au monde, organisé à Bruxelles depuis 1937. Chaque année, une discipline différente selon un cycle de 4 ans (violon, piano, chant, violoncelle). En 2026 : session Violoncelle — édition festive marquant le 75e anniversaire du Concours, le 150e anniversaire de la naissance de la Reine Elisabeth et le 150e de Pablo Casals. Douze finalistes jouent avec orchestre au Palais des Beaux-Arts. Retransmission en direct sur Musiq3/Auvio.\nPériode : 4 mai – 10 juin 2026 (premier tour, demi-finale, finale + concerts de lauréats)\nOuverture des réservations : Abonnements dès février, tickets séparés dès mi-février\nProchain cycle : Violon 2027, Piano 2028, Chant 2029\nFlagey \u0026amp; Bozar, Bruxelles\nSite web → 🎭 Sortilèges Rue et Vous ! # Festival de théâtre de rue et d\u0026rsquo;arts forains à Court-Saint-Étienne. Spectacles de cirque, marionnettes géantes, fanfares décalées et compagnies de rue investissent les places et ruelles du village pour un week-end de magie et de surprises. Ambiance festive, familiale et totalement gratuite — un des meilleurs festivals de rue de Wallonie.\nPériode : Jeudi de l\u0026rsquo;Ascension (mai)\nAccès : Gratuit, pas de réservation nécessaire\nCourt-Saint-Étienne, Brabant Wallon\nSite web → 🎻 Concert des Lauréats (Concours Reine Elisabeth) # Les concerts de clôture du Concours Reine Elisabeth : les lauréats se produisent avec orchestre au Palais des Beaux-Arts. Le concert des 4e, 5e et 6e lauréats (avec l\u0026rsquo;Antwerp Symphony Orchestra) et le concert de clôture des trois premiers lauréats (avec le Brussels Philharmonic) sont des moments musicaux exceptionnels — l\u0026rsquo;émotion d\u0026rsquo;une compétition au plus haut niveau se mêle à la joie de la consécration.\nDates 2026 : Lundi 8 juin (4e-6e lauréats) et mercredi 10 juin (Top 3) à 20h15\nRéservation : Dès février — places très demandées\nPalais des Beaux-Arts (Bozar), 1000 Bruxelles\nSite web → Juin (1) # 🎷 Tournai Jazz Festival # Festival de jazz international dans la Cité des Cinq Clochers — 14e édition en 2026. Jazz, soul, blues, électro-jazz, nu-jazz et flamenco sur 5 jours, avec une programmation qui mêle grandes voix internationales et talents émergents belges. Concerts en salle (Maison de la Culture) et en plein air (scène gratuite sur l\u0026rsquo;Esplanade). En 2026 : Yael Naim, Luz Casal, China Moses, Shai Maestro, Selah Sue \u0026amp; The Gallands, The Herbaliser Band… et la soirée Électro-Frites Jazz (frites \u0026amp; fricadelles incluses !).\nPériode : 24-28 juin 2026\nTarifs : Concerts en salle payants, scène extérieure gratuite\nMaison de la Culture \u0026amp; Esplanade de l\u0026#39;Europe, 7500 Tournai\nSite web → Juillet (10) # 🏇 L\u0026rsquo;Ommegang de Bruxelles # Inscrit au patrimoine immatériel de l\u0026rsquo;UNESCO, l\u0026rsquo;Ommegang est un cortège historique grandiose de 1.400 figurants en costumes Renaissance sur la Grand-Place de Bruxelles. La procession illustre la présentation de Charles Quint et de son fils Philippe dans la capitale des Pays-d\u0026rsquo;en-Bas — avec chevaux, reuzen (géants), marionettentheater et groupes folkloriques. Le Village Renaissance au Sablon complète l\u0026rsquo;expérience avec joutes équestres, concours d\u0026rsquo;arbalétriers et marché d\u0026rsquo;artisans d\u0026rsquo;époque (du 1er au 4 juillet).\nPériode : Début juillet (1er et 3 juillet 2026, à partir de 20h45)\nOuverture des réservations : Printemps — tribune 55 à 85 €, gratuit hors tribunes\nGrand-Place \u0026amp; Sablon, 1000 Bruxelles\nSite web → 🎸 Rock Werchter # Le plus grand festival rock et pop de Belgique et l\u0026rsquo;un des meilleurs d\u0026rsquo;Europe — régulièrement élu \u0026ldquo;Best Major Festival\u0026rdquo; aux European Festival Awards. Line-up international de premier plan (rock, pop, indie, électro) dans un festival parfaitement organisé au cœur du Brabant flamand.\nPériode : Début juillet (2-5 juillet 2026)\nOuverture des réservations : Novembre/décembre de l\u0026rsquo;année précédente — sold out fréquent\nFestivalpark, Werchter (Rotselaar)\nSite web → 🎭 Festival d\u0026rsquo;Avignon # Le plus grand festival de théâtre et arts vivants au monde — 80e édition en 2026. La Cour d\u0026rsquo;Honneur du Palais des Papes se transforme en théâtre sous les étoiles. Le Festival IN propose ~42 productions dans 40 lieux (théâtre, danse contemporaine, performances interdisciplinaires), tandis que le Festival OFF explose avec plus de 1.000 spectacles indépendants dans 140+ lieux — des grandes scènes aux cours intérieures et coins de rue inattendus. Focus 2026 : les arts de la scène coréens.\nPériode : 4-25 juillet 2026\nOuverture des réservations : Juin — les places en Cour d\u0026rsquo;Honneur partent très vite\nBon à savoir : Festival IN + Festival OFF en simultané (rare), créant une effervescence unique dans toute la ville\nPalais des Papes \u0026amp; 40\u0026#43; lieux, 84000 Avignon\nSite web → 🎭 Spectacle à l\u0026rsquo;Abbaye de Villers-la-Ville # Depuis 40 ans, les ruines majestueuses de l\u0026rsquo;abbaye cistercienne de Villers-la-Ville accueillent chaque été un grand spectacle théâtral en plein air. Le dispositif scénique se déploie entre le cloître, la nef et le chœur — un cadre unique en Belgique. En 2026 pour le 40e anniversaire : Le Songe d\u0026rsquo;une nuit d\u0026rsquo;été de Shakespeare, mis en scène par Thierry Debroux. Représentations du mardi au samedi à 21h, ouverture des portes à 20h30.\nPériode : Mi-juillet à mi-août (14 juillet – 15 août 2026)\nOuverture des réservations : Printemps — réservation obligatoire\nDurée : 1h25\nRue de l\u0026#39;Abbaye 55, 1495 Villers-la-Ville\nSite web → 🎶 Dour Festival # Cinq jours de musique éclectique dans le Hainaut — hip-hop, électro, rock, reggae, metal — sur 8 scènes en plein air. Ambiance unique, très festive, prix abordables et programmation audacieuse qui mélange les genres. Un incontournable pour les amateurs de découvertes musicales et d\u0026rsquo;ambiance camping décontractée.\nPériode : Mi-juillet (16-19 juillet 2026)\nOuverture des réservations : Printemps\nSite du Bois de Dour, 7370 Dour\nSite web → 🎉 Les Gentse Feesten (Fêtes de Gand) # L\u0026rsquo;un des plus grands festivals urbains d\u0026rsquo;Europe — 10 jours de fête gratuite dans tout le centre historique de Gand. Concerts en plein air, théâtre de rue, DJ sets, performances artistiques, marché nocturne et ambiance de fête permanente dans les ruelles pavées entre le Gravensteen et le Korenmarkt. Plus de 2 millions de visiteurs chaque année dans une atmosphère incroyablement conviviale.\nPériode : Mi-juillet (17-26 juillet 2026), 10 jours\nAccès : Gratuit\nCentre historique de Gand\nSite web → 🎧 Tomorrowland # Le festival de musique électronique le plus emblématique au monde, dans un décor féérique et des scénographies à couper le souffle. Chaque année, des centaines de milliers de festivaliers de 200 nationalités convergent vers Boom pour un week-end de magie musicale. Line-up international de premier plan et expérience immersive unique.\nPériode : Deux week-ends en juillet (17-19 et 24-26 juillet 2026)\nOuverture des réservations : Janvier/février — sold out en quelques minutes, inscription préalable obligatoire\nDe Schorre, Boom\nSite web → 🎤 Les Francofolies de Spa # Le plus grand festival de musique francophone en Belgique, dans la ville thermale de Spa. Concerts en plein air sur la Scène Pierre Rapsat (Place Royale) et au Village Francofou, avec une programmation qui mêle têtes d\u0026rsquo;affiche et découvertes. Ambiance chaleureuse dans un cadre verdoyant, entre concerts gratuits et payants.\nPériode : Fin juillet (20-26 juillet 2026)\nOuverture des réservations : Printemps\nPlace Royale, Spa\nSite web → 🏰 Théâtre au Château de Rixensart # Chaque été, le parc du Château de Rixensart se transforme en théâtre en plein air pour une série de représentations grand public — adaptations de classiques de la littérature dans un cadre bucolique et enchanteur. Spectacles accessibles à toute la famille, à apprécier avec un pique-nique sur l\u0026rsquo;herbe avant la représentation. En 2025 : La Légende du Roi Arthur.\nPériode : Été (juillet-août)\nOuverture des réservations : Printemps — consulter le site pour les dates exactes\nChâteau de Rixensart, Rue du Château 10, 1330 Rixensart\nSite web → 👑 Visite du Palais Royal de Bruxelles # Chaque été, le Palais Royal — résidence administrative et lieu de travail du Roi — ouvre ses portes au public. Une expérience exceptionnelle où l\u0026rsquo;art, l\u0026rsquo;architecture et l\u0026rsquo;histoire s\u0026rsquo;entremêlent dans un décor habituellement réservé aux réceptions officielles et visites d\u0026rsquo;État. En 2026 : réouverture après 3 ans de travaux de rénovation, avec 4 expositions temporaires (Louise d\u0026rsquo;Orléans, Music, Sound and Imagination, Machines de Rêve, Le Palais de la Mémoire).\nPériode : 3 juillet – 16 août 2026\nTarifs : 10 € (13 ans et +), gratuit pour les -13 ans\nRéservation : Obligatoire en ligne (même pour les entrées gratuites) — ouverture le 1er juin\nPlace des Palais, 1000 Bruxelles\nSite web → 🌽 Le Labyrinthe # En 2026, Mission Interstellar Ella : rejoignez la famille Rider, crashée en plein champ de maïs lors de son voyage vers Vénus, pour une mission de sauvetage cosmique en plein air. Sur un site de 11 hectares et 6 km de sentiers, spectacles immersifs avec comédiens et robots télécommandés, énigmes, simulateur de vol astronaute. Le soir, place à l\u0026rsquo;Escape Mystery — un escape game géant en plein air. Parking gratuit sur site. Ouvert par mauvais temps (installations couvertes disponibles). Poussette tout terrain recommandée (chemins boueux). Chiens non autorisés. Pique-nique interdit — restauration sur place.\nPériode : 4 juillet – 4 octobre 2026\nHoraires en journée : Juillet–août : tous les jours de 10h à 15h30 · Septembre–octobre : week-ends de 10h à 15h30\nHoraires en soirée : Juillet–août : mer–sam de 17h à 20h · Septembre–octobre : mar–ven de 11h à 15h, sam de 16h à 18h\nTarifs : -3 ans gratuit · Enfant (-12 ans) 18 € online / 19 € sur place · À partir de 12 ans 19 € online / 20 € sur place · -10 % sur présentation de la carte Prof\nRéservation : Recommandée via booking.lelabyrinthe.be\nChemin du Hasard, 6940 Durbuy (Ardennes)\nSite web → Août (7) # 🌸 Tapis de Fleurs de Bruxelles # Tous les 2 ans, un tapis géant de fleurs (70 m × 24 m) recouvre la Grand-Place de Bruxelles — près d\u0026rsquo;un million de fleurs assemblées par 120 bénévoles en moins de 6 heures. En 2026 pour la 24e édition : thème Japon (\u0026ldquo;Neo-Hokusai\u0026rdquo;), une réinterprétation de La Grande Vague d\u0026rsquo;Hokusai en 500.000 dahlias, pour célébrer les 160 ans de relations diplomatiques Belgique-Japon. Nouveauté : un second tapis à la Bourse, inspiré du houblon. Spectacle son et lumière chaque soir de 21h à 23h.\nPériode : 13-16 août 2026\nAccès : Grand-Place libre et gratuit, balcon de l\u0026rsquo;Hôtel de Ville 8-9 €\nFréquence : Tous les 2 ans (week-end du 15 août)\nGrand-Place, 1000 Bruxelles\nSite web → 🐉 Ducasse d\u0026rsquo;Ath # La Ducasse d\u0026rsquo;Ath — cortège des 7 géants portés à dos d\u0026rsquo;homme (115-130 kg chacun !) à travers les rues de la cité. Le cheval Bayard (630 kg, 16 porteurs) danse et se cabre, le couple Goliath exécute sa danse traditionnelle sur les ponts, et le \u0026ldquo;Sauvage\u0026rdquo; terrorise les enfants. Un folklore ancestral datant du XVe siècle sur le 4e week-end d\u0026rsquo;août. Également : brûlage des marronnes, concerts, tir à l\u0026rsquo;arc et mongolfières.\nPériode : 4e week-end d\u0026rsquo;août (21-24 août 2026, cortège le dimanche 23 à 9h45)\nAccès : Gratuit\nCentre-ville, 7800 Ath\nSite web → 🌙 Nocturnes du Château de Beloeil # Spectacle son et lumière grandiose dans les jardins à la française du Château de Beloeil (le \u0026ldquo;Versailles belge\u0026rdquo;). Chaque été, une nouvelle production théâtrale en plein air — avec cascades, effets pyrotechniques et mise en scène monumentale — est présentée sur le miroir d\u0026rsquo;eau du parc. En 2026 : Le Livre de la Jungle. Une soirée magique à vivre en famille ou entre amis, à combiner avec un pique-nique dans les jardins avant le spectacle.\nPériode : Été (généralement août, plusieurs représentations)\nOuverture des réservations : Printemps — les meilleures places partent vite\nChâteau de Beloeil, Rue du Château 11, 7970 Beloeil\nSite web → 🎵 La Nuit des Chœurs # Spectacle-promenade musical unique dans les ruines de l\u0026rsquo;abbaye de Villers-la-Ville : six chœurs de renommée internationale se produisent simultanément dans les endroits les plus remarquables du site. Le spectateur déambule à son rythme, découvrant les concerts au détour d\u0026rsquo;un pan de muraille ou sous les voûtes séculaires d\u0026rsquo;une crypte. En fin de soirée, tous les artistes se retrouvent sur la scène principale pour une apothéose rehaussée d\u0026rsquo;un feu d\u0026rsquo;artifice prestigieux.\nPériode : Fin août (28-29 août 2026), de 18h à 23h45\nOuverture des réservations : Printemps — réservation obligatoire (assurance météo disponible)\nDurée : ~6h de spectacle-promenade\nAbbaye de Villers-la-Ville, 1495 Villers-la-Ville\nSite web → 🎶 Ronquières Festival # Festival de musique au pied de l\u0026rsquo;impressionnant Plan Incliné de Ronquières — un cadre unique en Belgique où les concerts sont rythmés par le passage des péniches. Trois scènes (Tribord, Colline, Babord Club) et un espace couvert de 10.000 m² pour 3 jours de pop, rock, électro et chanson française. Après 13 éditions et 450.000 festivaliers, le Ronquières Festival s\u0026rsquo;est imposé comme une référence de l\u0026rsquo;été belge — nommé aux European Festival Awards. Parkings gratuits avec navettes, accessible en train (gare de Braine-le-Comte).\nPériode : 7-9 août 2026\nTarifs : 69 € la journée / 159 € le pass 3 jours\nOuverture des réservations : Janvier — tarif résident disponible à l\u0026rsquo;Office du Tourisme de Braine-le-Comte\nPlan Incliné de Ronquières, Braine-le-Comte\nSite web → 🎪 Festival de Chassepierre # Le plus ancien festival d\u0026rsquo;arts de la rue en Europe — un rendez-vous incontournable depuis plus de 45 ans dans le petit village gaumais de 200 âmes, entre Orval et Bouillon. Quelque 50 compagnies professionnelles venues du monde entier investissent les rues, champs, places et berges de la Semois pour des spectacles de théâtre, cirque, danse, musique, marionnettes et arts plastiques. Ambiance familiale, marché artisanal et agroalimentaire, pieds dans l\u0026rsquo;herbe ou dans l\u0026rsquo;eau de la rivière.\nPériode : 15-16 août 2026\nAccès : Payant — billetterie en ligne\nAmbiance : Familiale, en plein air\nChassepierre, 6824 Florenville (Gaume)\nSite web → 🎸 Pukkelpop # L\u0026rsquo;un des plus grands festivals de musique de Belgique — 4 jours de rock, indie, électro, hip-hop et metal à Kiewit (Hasselt). Line-up international de premier plan (Tyler the Creator, Florence + The Machine, Deftones, Soulwax, Turnstile…) sur plusieurs scènes dans un cadre boisé. Ambiance jeune et éclectique, camping festif et transports en commun inclus dans le ticket (train SNCB). Combi tickets sold out en quelques heures chaque année.\nPériode : 20-23 août 2026\nTarifs : 134 € la journée / combi sold out — VIP 225 €/jour\nOuverture des réservations : Février — inscription préalable recommandée\nKempische Steenweg, Kiewit (Hasselt)\nSite web → Novembre – Janvier (2) # 🎄 Plaisirs d\u0026rsquo;Hiver # Le grand marché des fêtes de fin d\u0026rsquo;année à Bruxelles — 25e édition en 2026. Plus de 238 chalets répartis dans tout le centre-ville, grande roue, patinoire, pistes de curling, manèges, spectacle son et lumière sur la Grand-Place, sapin monumental et installations artistiques. Chaque année, une région invitée d\u0026rsquo;honneur — en 2026 : le Béarn Pyrénées et le Pays basque, avec un village dédié place de la Bourse. Un incontournable hivernal qui attire des millions de visiteurs.\nPériode : 27 novembre 2026 – 3 janvier 2027\nAccès : Gratuit (attractions et consommations payantes)\nBon à savoir : Fermeture à 18h les 24 et 31 décembre\nGrand-Place, Bourse, Sainte-Catherine, De Brouckère, 1000 Bruxelles\nSite web → 🏰 Noël au Château de Modave # Le Château de Modave ouvre ses portes en hiver pour une visite féérique : 25 salles entièrement décorées pour les fêtes de fin d\u0026rsquo;année — sapins colorés, élégantes tables de fête, bougies chatoyantes, petits lutins facétieux et animaux surprenants. Les façades du château sont illuminées dès la tombée de la nuit, créant une atmosphère magique. Ouvert tous les jours sans exception, y compris les 24, 25, 31 décembre et le 1er janvier.\nPériode : 12 décembre 2026 – 3 janvier 2027 (tous les jours, 11h–18h)\nTarifs : Adultes ~9,50 €, seniors 8 €, étudiants 5 €, -6 ans gratuit (audioguide inclus)\nDepuis Bruxelles : ~1h15 de route (province de Liège)\nRue du Château, 4577 Modave\nSite web → Toute l\u0026rsquo;année (1) # 🎶 Ma Première Fois à l\u0026rsquo;Opéra # Programme de l\u0026rsquo;Opéra National de Paris permettant aux spectateurs de 18 à 28 ans de découvrir l\u0026rsquo;opéra ou le ballet pour la première fois à un tarif très réduit (10 €). Places en catégorie 1, accueil dédié et programme d\u0026rsquo;accompagnement pour rendre l\u0026rsquo;expérience accessible. Une initiative remarquable pour démystifier l\u0026rsquo;opéra et découvrir des productions de classe mondiale à l\u0026rsquo;Opéra Bastille ou au Palais Garnier.\nPériode : Toute la saison (septembre à juillet), selon la programmation\nOuverture des réservations : Vérifier régulièrement le site — les places partent très vite\nConditions : 18–28 ans, première visite à l\u0026rsquo;Opéra de Paris\nOpéra National de Paris (Bastille \u0026amp; Garnier)\nSite web → ","date":"28 janvier 2024","externalUrl":null,"permalink":"/sorties/evenements/","section":"Sorties","summary":"Les événements et sorties incontournables à ne pas manquer chaque année.","title":"Événements à ne pas manquer","type":"sorties"},{"content":"","date":"March 28, 2024","externalUrl":null,"permalink":"/en/sorties/boire-manger/","section":"Outings","summary":"Our guides for food and drinks — specialty coffee, craft breweries and restaurants.","title":"Food \u0026 Drinks","type":"sorties"},{"content":"","date":"March 28, 2024","externalUrl":null,"permalink":"/en/tags/restaurant/","section":"Tags","summary":"","title":"Restaurant","type":"tags"},{"content":"Speciality coffee (also spelled specialty coffee) is coffee scored above 80/100 by a Q-grader, with full traceability from farm to cup — origin, variety, processing method, and roast profile known and valued.\nThe addresses below are places I have tried on my travels, sorted by country.\nCoffee Insurrection: https://www.coffeeinsurrection.com/ European Coffee Trip: https://europeancoffeetrip.com/ The World\u0026rsquo;s 100 Best Coffee Shops: https://theworlds100bestcoffeeshops.com/ 🇧🇪 Belgium # Alchemists Coffee An open laboratory and neighbourhood roastery in Ixelles, where Xavier Beressy and his team roast specialty coffees on-site. Simple, lively atmosphere, standout filter coffees and barista workshops. Belgian Aeropress Champion 2024. Rue de la Crèche 21, 1050 Ixelles\nWebsite → DRACHE Specialty Coffee Bar A cosy coffee shop on the fish market quay (Vismet), known for a creative menu: classic espressos, cold brew, and signature lattes (butterfly pea, beetroot, ube, black sesame…). Small pastry selection with vegan options. Quai au Bois à Brûler 11, 1000 Brussels\nWebsite → Gust Coffee Roasters Belgian micro-roastery south of Brussels, founded by Tanguy in 2020. Seasonal, traceable and ethical coffees, roasted to highlight each origin\u0026rsquo;s clarity and character. Online shop and subscriptions from the roastery. A. Vaucampslaan 28, 1654 Beersel\nWebsite → Jolicoeur A warm little coffee shop near Mons\u0026rsquo; Grand-Place, run by Ludovic Pirrera — a globe-trotting barista who roasts his own beans in Ghlin. Bold espresso, V60 and Aeropress, beans for sale and cupping workshops. Traceable cooperative sourcing. Rue d\u0026#39;Enghien 3, 7000 Mons\nWebsite → MOK Coffee A pioneering Belgian specialty roaster, founded in Leuven in 2012 by Jens Crabbé, two-time Belgian Cup Tasters champion. The Brussels flagship on Dansaert — housed in a former art gallery — combines roasting, an open bar, two rotating espressos and four filter options. Ranked 67th on The World\u0026rsquo;s 100 Best Coffee Shops.\nAlso at Diestsestraat 165, 3000 Leuven · Rue Saint-Laurent 36, 1000 Brussels (MOK Studio).\nRue Antoine Dansaert 196, 1000 Brussels\nWebsite → Tulipe A specialty café born from a simple idea: quality coffee that\u0026rsquo;s accessible in Woluwe-Saint-Lambert. Carefully selected beans, partner roasters, full traceability and a welcoming atmosphere — small producers, espresso and filter in a friendly setting. Avenue Albert-Elisabeth 35, 1200 Woluwe-Saint-Lambert\nWebsite → Wide Awake A contemporary Brussels roaster sourcing, roasting and serving exceptional coffees. City-centre flagship (Sainte-Catherine), plus Flagey (Lesbroussart) and Dansaert (rue de Flandre). « Released on 12 » series, subscriptions and wholesale. Rue Sainte-Catherine 2, 1000 Brussels\nWebsite → 🇫🇷 France # Coffee Makers A Lille institution since 2013: espresso bar, tea room and certified organic artisan roaster (Ludovic Fiers). Breakfast, Saturday brunch, homemade pastries, matcha and hot chocolate in a cosy city-centre coffee shop. 151 Rue Pierre Mauroy, 59800 Lille\nWebsite → Liperli Paris specialty coffee roaster open since September 2023, nestled in the 9th arrondissement. Liperli selects only coffees scored above 84 SCA, roasted on-site, and regularly offers ephemeral micro-lots and nano-lots that can\u0026rsquo;t be repeated. Kees van der Westen machine for precise espressos, gentle extractions (V60) and creative drinks. Warm atmosphere, carefully curated playlist and artisan pastries — a real favourite. 33 Rue de Douai, 75009 Paris\nWebsite → 🇬🇷 Greece # Way Cup Roaster Sifnos-based roaster founded by Isavella Venaki, born on the island, with Konstantinos Tsekouras as head barista — awarded in Italy in 2015 for his coffee work. They\u0026rsquo;ve been in coffee since 2010; roasting took shape after that prize, first on trial at a Platis Gialos beach café, then with a mill in Chrysopigi since 2019 (their Summer Spot runs in the summer months).\nAt Platis Gialos I of course had to try a flat white — and it delivered. They also sell ice cream and, of course, their coffee (beans and Nespresso-compatible capsules). A welcome stop beyond the classic Greek freddo on a Cycladic trip.\nPlatis Gialos, Sifnos (Cyclades)\nWebsite → 🇨🇦 Canada # Café Différance Quality coffee stop in Old Montreal, steps from Square-Victoria. Rotating Canadian roasters (including Bows \u0026amp; Arrows), friendly vibe and pastries from Hof Kelsten and Godley \u0026amp; Creme. The name is a philosophical wink — with an « A », not an « E ». 449 Avenue Viger Ouest, Montréal\nWebsite → Little Victories A small independent Ottawa roaster, co-founded by a roaster and a barista, with three cafés and a wholesale operation. Careful coffee culture, warm hospitality and a commitment to raising the Canadian scene. Ranked 71st on The World\u0026rsquo;s 100 Best Coffee Shops. 44 Elgin Street, Ottawa\nWebsite → 🇰🇷 South Korea # tonti Steps from Anguk station and Changdeokgung Palace, tonti hides in the quiet alleys at the foot of Bukchon Hanok Village. Creamy filter coffee, Dubancho and Ethiopian Banko Gotti, soft cookies — an affordable, photogenic stop between hanok houses and sloping lanes. 6-8 Bukchon-ro, Jongno-gu, Seoul\nWebsite → Cha.ddeul A favourite for atmosphere and views — but to be clear: it\u0026rsquo;s more of a traditional tea house than a specialty coffee shop. Cha.ddeul is one of Bukchon\u0026rsquo;s most peaceful addresses, set in a hanok at a turn in the village lanes. Silent inner courtyard, Korean teas, delicate desserts and filter coffee in a preserved, almost meditative setting.\nBetween Changdeokgung Palace and a stroll through Bukchon Hanok Village, the perfect place to slow down after Seoul\u0026rsquo;s bustle — especially in autumn when leaves fall in the garden.\nSeoul (Bukchon)\nWebsite → 🇯🇴 Jordan # Mosaic Specialty Coffee What a lovely surprise to stumble upon Mosaic Specialty Coffee down a side street in Madaba! Cosy, modern decor — this charming spot opened in early 2024, run by barista Iskandar and his wife. We received a warm welcome and enjoyed filter coffee prepared with real care. The rest of the family went for iced teas and homemade pastry. I highly recommend stopping by before or after visiting St. John the Baptist Church. Princess Haya Street, Madaba\nWebsite → ","date":"March 28, 2024","externalUrl":null,"permalink":"/en/sorties/boire-manger/cafe-de-specialite/","section":"Outings","summary":"Speciality coffee shops I have discovered, sorted by country.","title":"Speciality Coffee","type":"sorties"},{"content":"","date":"March 28, 2024","externalUrl":null,"permalink":"/en/tags/speciality-coffee/","section":"Tags","summary":"","title":"Speciality Coffee","type":"tags"},{"content":"","date":"28 janvier 2024","externalUrl":null,"permalink":"/tags/specialty-coffee/","section":"Tags","summary":"","title":"Specialty Coffee","type":"tags"},{"content":"","date":"28 janvier 2024","externalUrl":null,"permalink":"/tags/spectacles/","section":"Tags","summary":"","title":"Spectacles","type":"tags"},{"content":"","date":"March 28, 2024","externalUrl":null,"permalink":"/en/sorties/theatre/","section":"Outings","summary":"Our theatre guides — Paris, Belgium and Northern France.","title":"Theatre","type":"sorties"},{"content":"","date":"March 26, 2024","externalUrl":null,"permalink":"/en/tags/2022/","section":"Tags","summary":"","title":"2022","type":"tags"},{"content":"","date":"March 26, 2024","externalUrl":null,"permalink":"/en/tags/croatia/","section":"Tags","summary":"","title":"Croatia","type":"tags"},{"content":"Exploring Croatia from Zadar down to Dubrovnik, kicking off at Plitvice Lakes. Short hops through the Kornati and Korčula, Ston’s walls, and Mljet National Park.\nTo plan a trip to Croatia I recommend the site https://croatia.hr/, which is very well done.\nDay 1: Zadar # Departure from Brussels South Charleroi at 08:40 Arrival at Zadar Airport at 10:30 Pickup of rental car Walking tour of Zadar’s historic centre Gelato stop at aROMA gelato experience Drive to the first accommodation at Grabovac Jump in the pool Dinner and our first encounter with ćevapčići Day 2: Plitvice Lakes # Breakfast on our rental’s terrace Greeted by the Plitvice Lakes “bear” (entrance 1) Walk in the park (route K) Arrival at the second stay in Zadar Day 3: Pag Island # Breakfast by the pool Enjoying the lovely pool Heading to Pag Island Photo stop at Paški Most (Pag Bridge) Visit to Pag and Novalja Walk in the Olive Garden “at the far north of the island” Stop to buy the famous Pag cheese Day 4: Kornati # 08:15 ferry to Zaglav to visit Telašćica Nature Park Land at Zaglav, bus to Sali. No car available anymore. “We fall back on Taxi Frka…” — they drop us at Mir Lake’s entrance Great views and a walk down to the sea with a landscape of stacked stones; swim at Mir Lake Return boat at 17:50 Day 5: Canoeing \u0026amp; kayaking – Zrmanja River # Canoe-kayak on the Zrmanja River Stop to admire the Maslenica Bridge rapids Day 6: Nin # Visit to Nin Arrival at the third accommodation in Trogir Day 7: Canyoning – Cetina River # Restaurant stop on the road to Omiš Canyoning Visit to Omiš Walk toward Starigrad fortress — “a storm kept us from getting there.” Day 8: Split # Visit to Split Day 9: Trogir \u0026amp; Korčula # Breakfast in Trogir Departure for Korčula Visit to the town of Korčula Pool at our fourth rental Day 10: Pupnatska Luka # Pupnatska Luka beach Vala Luka Lumbarda Day 11: Mljet Island # Bike rental Snorkelling stops Visit to the small island Swimming in the currents Cycling to Polače Back to Korčula Day 12: Ston ramparts # Leaving Korčula (Jadrolinija) Arrival in Ston Climb up to the ramparts View over the salt pans Off to Plat for our next stay Day 13: Dubrovnik # Boat from Plat to Dubrovnik Guided tour of Dubrovnik Stations of the Cross path up to the heights of Dubrovnik Day 14: Cavtat # Morning by the sea and pool Afternoon visit to Cavtat Day 15: Krka # To Šibenik to visit Krka National Park Day 16: Return to Belgium # Last stop by the sea at Pakoštane Back to Zadar for the return flight ","date":"March 26, 2024","externalUrl":null,"permalink":"/en/voyages/europe/croatie/","section":"Travels","summary":"Exploring Croatia from Zadar down to Dubrovnik, kicking off at Plitvice Lakes. Short hops through the Kornati and Korčula, Ston’s walls, and Mljet National Park.","title":"Croatia","type":"voyages"},{"content":"","date":"March 26, 2024","externalUrl":null,"permalink":"/en/tags/dubrovnik/","section":"Tags","summary":"","title":"Dubrovnik","type":"tags"},{"content":"","date":"26 janvier 2024","externalUrl":null,"permalink":"/tags/plitvice/","section":"Tags","summary":"","title":"Plitvice","type":"tags"},{"content":"","date":"March 24, 2024","externalUrl":null,"permalink":"/en/tags/jordan/","section":"Tags","summary":"","title":"Jordan","type":"tags"},{"content":"Everyone kept telling us how great Jordan is, so we went to see for ourselves. On the itinerary: hikes in the wadis, historic sites, a night in the desert, diving and snorkelling…\nDay 1: Arrival in Jordan # Flight from Brussels Charleroi at 06:30 ETA 12:20; we landed at noon. Delayed take-off, four hours in the air. A passenger felt ill. Changed money near Europcar. Avoid the first exchange counter before the Jordan Pass desks. Black automatic Europcar Geely. Grocery stop on a boulevard in Amman plus a bakery. Arrival at the villa — settling in, pool. Dinner at FAI with valet parking. First Lemon’nanas of the trip. Kofta with tahini, kofta with tomatoes, sambousek, hummus and pesto hummus, tabbouleh, mixed grill. Day 2: Umm Qais \u0026amp; As-Salt # Umm Qais in the morning — about 1 h 50 drive GPS glitch: Cairo or Beirut airport (Israel–Palestine war context). A guide at the entrance pitches his services (15 JOD → 35 JOD in the end). Theater, temple, nymphaea, shops, Roman road. View over Lake Tiberias (Sea of Galilee). Lookouts over Syria. A drink at the Resthouse — great view. As-Salt. Pool in the afternoon. Day 3: Jerash \u0026amp; Ajloun # Jerash in the morning They tried to sell us keffiyehs and veils. We’re all dressed up… Huge site: theatres, Oval Plaza, Temple of Zeus Dinner at Um Khalil restaurant: tabbouleh, mutabbal, shanklish. Ajloun Castle in the afternoon — quick visit, juice stands. Pool. Day 4: Salt \u0026amp; Amman # Salt Amman Mount Nebo Bethany site Amman cooking experience Day 5: Dead Sea # We decide to pull over along the Dead Sea Highway at the recommended spot. Four 10-litre jugs. Pool Day 6: Ma’in \u0026amp; Madaba # Change of plans: hot springs at about 65 °C in August, plus paid entry. Zarqa Ma’in hike instead. Madaba. Pool Day 7: Dana # Wadi Bin Hammad Karak Day 8: Dana # Wadi Ghuweir Activities at Feynan Ecolodge. “Pulling into Feynan feels like a tea blended from six herbs.” Only one room rented out of 26. Stargazing and tea. Slept on the roof under open sky. Day 9: Petra # 4x4 back to the wadi entrance. Checking in and pool in Petra Day 10: Petra # Hikes. “Petra Siq by night?” Nope. Day 11: Wadi Rum # Jeep Tour Day 12: Red Sea # Pool. Dinner at Shinawo. Day 13: Red Sea # Dive with Hugo (09:30, 10–12). Seven Sisters / M42 tank. Pool. Dinner at Busha (TripAdvisor #1). Day 14: Shobak \u0026amp; Madaba # “Pool — not enough time left for snorkelling.” We skip Shobak and head back up Highway 65 from the Dead Sea. Wadi al-Hasa — packed with locals. Madaba. Nearly empty hotel. Dinner at Carob House. Day 15: Back to Belgium # Breakfast on the terrace. Return to the airport. Drop off the car. 25 JOD fine in Ajloun. Return flight 12:55. Land Brussels Charleroi 16:45. Things we would have liked to do but didn’t — lack of time or another reason… # ","date":"March 24, 2024","externalUrl":null,"permalink":"/en/voyages/asie/jordanie/","section":"Travels","summary":"Everyone kept telling us how great Jordan is, so we went to see for ourselves. On the itinerary: hikes in the wadis, historic sites, a night in the desert, diving and snorkelling…","title":"Jordan","type":"voyages"},{"content":"","date":"24 janvier 2024","externalUrl":null,"permalink":"/tags/petra/","section":"Tags","summary":"","title":"Petra","type":"tags"},{"content":"","date":"24 janvier 2024","externalUrl":null,"permalink":"/tags/wadi-rum/","section":"Tags","summary":"","title":"Wadi Rum","type":"tags"},{"content":"","date":"March 10, 2024","externalUrl":null,"permalink":"/en/tags/2020/","section":"Tags","summary":"","title":"2020","type":"tags"},{"content":"","date":"March 10, 2024","externalUrl":null,"permalink":"/en/tags/portugal/","section":"Tags","summary":"","title":"Portugal","type":"tags"},{"content":"This year, our destination was Portugal.\nDay 1: Guimarães # Depart Brussels Charleroi South station (6:50 a.m.), arrive at Porto Airport (8:15 a.m.). Pick up the rental car, then head for Guimarães. People say Portugal was born here. The town centre is a UNESCO World Heritage Site. We park at Parque das Hortas, near the Church of Our Lady of Consolation. Walk from Largo da Oliveira (Igreja e Oratórios de Nossa Senhora da Consolação e Santos Passos). We try tortas de Guimarães. First lodging: infinity pool, first gorgeous sunset.\nDay 2: Parque Nacional Peneda-Gerês \u0026amp; Ponte de Lima # The original idea was Tahiti waterfall in Gerês (Cascata do Tahiti / Cascatas de Fecha de Barjas). A GPS mix-up lands us in a tangle — there are two villages called Ermida in northern Portugal. We stop at Germil to soak up lush scenery. We end up at the “wrong” Ermida: a deserted village. The other Ermida is about an hour and forty minutes away, so we change plans and aim for Ponte de Lima instead. Swim stop along Ribeiro de Carcerelha, then Poço Negro de Carcerelha with its pond and cascade. The bridge spans the Rio Lima; we also take in the façade of Igreja de Santo António da Torre Velha. Ice cream break at Trisabordes. Back to the pool at our lodging.\nDay 3: Porto # Day 4: Trilho dos Poços Verdes - 7 Lagoas # Dinner in Guimarães’ historic centre.\nDay 5: Bom Jesus do Monte # Day 6: Amarante \u0026amp; Douro Valley # Leave our first lodging. Visit Amarante. Stop among the Douro vineyards. River cruise from Pinhão with Magnifico Douro. Arrive at our second lodging: Vumba.\nDay 7: Aveiro \u0026amp; Costa Nova # Breakfast on the terrace of the little bakery Beirão de Gema. Pool at the lodging. Visit Aveiro. Coffee at Porta do cafe.\nDay 8: Fraga de la Pena # Day 9: Parque Nacional do Buçaco \u0026amp; Coimbra # Arrive at our third lodging.\nDay 10: Mosteiro da Batalha, Nazaré \u0026amp; Peniche # Panoramic stroll at Paredes.\nDay 11: Óbidos # Visit the medieval town of Óbidos and its castle. Walk the ramparts. Arrive in Mafra for our fourth lodging.\nDay 12: Sintra # Hike up to Palácio da Pena. Visit the palace. Ramparts of the Moorish castle (Castelo dos Mouros). Quinta da Regaleira.\nDay 13: Lisbon # Pastéis de Belém — a real institution founded in 1837. Santa Maria de Belém. Jerónimos Monastery. Belém Tower. Arrive at our fifth lodging and taste Pastéis de Nata.\nDay 14: Rota Vicentina # Padel at the natural pond by our lodging. Hike on the Rota Vicentina starting from Odemira. Dinner and a close encounter with a fox.\nDay 15: Hike # Praia Do Queimado. Praia Do Sissal. Dinner in Porto Covo. Supper back at the lodge — the fox shows up again.\nDay 16: Hike # Almograve. Beja. Cap Sardão lighthouse.\nDay 17: Sagres # Praia de Odeceixe. Sagres lighthouse. Surf beach at Sagres. Arrive at our sixth — and last — lodging. Dinner in Carvoeiro overlooking the little cove beach.\nDay 18: Return to Belgium # São Gonçalo de Lagos. Ponta da Piedade.\n","date":"March 10, 2024","externalUrl":null,"permalink":"/en/voyages/europe/portugal/","section":"Travels","summary":"This year, our destination was Portugal. On the itinerary: Guimarães, Porto, the Douro Valley, Coimbra, Sintra, Lisbon, and the Rota Vicentina.","title":"Portugal","type":"voyages"},{"content":"","date":"January 26, 2024","externalUrl":null,"permalink":"/en/tags/alternative/","section":"Tags","summary":"","title":"Alternative","type":"tags"},{"content":" The Band # Dead Poet Society is dark, intense alternative rock, formed in 2013 by four students at Berklee College of Music in Boston — Jack Underkofler (vocals/guitar), Jack Collins (guitar), Will Goodroad (drums), and Dylan Brenner (bass, replacing Nick Taylor). Now based in Los Angeles, they draw from post-grunge, progressive rock, and indie to create something both visceral and hook-laden.\nThe name nods to the iconic film Dead Poets Society — and the philosophy fits: seize the moment, refuse to conform, express what burns inside. On stage, it\u0026rsquo;s a cathartic experience: relentless energy, magnetic frontman, pure intensity.\nKey influences: Royal Blood, Queens of the Stone Age, Highly Suspect, Nothing But Thieves, Led Zeppelin.\nDiscography # Album Year Label Axiom 2015 Independent -!- (The Exclamation Album) 2021 Spinefarm Fission 2024 Spinefarm Monarch 2026 Spinefarm Notable singles: .CoDA. (2020), .intoodeep. (2020), Running In Circles (2023), HURT feat. The Warning (2024), My Condition (2024), Sinner Systems (May 2026), Roach (June 2026), Cold (August 2026)\nFission (2024) # Their second album on Spinefarm is an explosive, jubilant cocktail — turbulent, anthemic, driven by themes of struggle and personal transformation. The riffs are powerful and precise, the melodies introspective, and Jack Underkofler\u0026rsquo;s voice oscillates between contained rage and soaring vulnerability.\nEssential tracks:\nMy Condition — the single that encapsulates their sound Running In Circles — unstoppable live HURT (feat. The Warning) — explosive collaboration with the Mexican trio 81 Tonnes — heavy and addictive Monarch (2026) # Third studio album, due October 2, 2026 via Spinefarm. Produced by Paul Meany (Mutemath / Twenty One Pilots), mixed by Adam Hawkins, recorded in Los Angeles. The band say they wanted to \u0026ldquo;carve out their own piece of territory\u0026rdquo; by digging deeper into what makes Dead Poet Society — weight, melody, emotional intensity.\nThree singles already set the tone:\nSinner Systems (May 2026) — dark, brooding, a mirror to excess and emotional numbness Roach (June 2026) — about those who have wronged you, taken advantage of you, hurt you Cold (August 2026) — social performance, dissociation, validation at all costs; video directed by Jack Underkofler Tracklist:\nHollywood On Fire Roach Die If You Don\u0026rsquo;t Sinner Systems Lost Cold Psalm 136 Dead On The Inside Miami For The Weekend Get Hot The Park The Art of Suffering Live # Dead Poet Society are first and foremost a live band. They\u0026rsquo;ve toured with Badflower, Biffy Clyro, and Highly Suspect, and played major European festivals (Graspop, Reading \u0026amp; Leeds, 2000Trees, Welcome to Rockville). Their set is intense, physical, cathartic — the kind of show you walk out of drained but alive.\nThey played Le Rocher de Palmer (Bordeaux) in July 2025. In fall 2026, a North American co-headlining run with Honey Revenge to launch Monarch, then a Europe / UK tour in early 2027.\nDates not to miss:\nDate City Venue Jan 21 Lisbon LAV – Lisboa Ao Vivo Jan 23 Madrid Wagon Jan 24 Barcelona Razzmatazz 2 Jan 26 Paris Alhambra Jan 28 Bristol Electric Bristol Feb 6 London Electric Ballroom Feb 9 Antwerp Trix (~€27) Feb 10 Utrecht TivoliVredenburg Feb 23 Berlin Metropol Feb 24 Cologne Essigfabrik Mar 6 Helsinki Tiivistämö Full tour (Lisbon → Helsinki, Jan–Mar 2027) and tickets via wearedps.com.\n","date":"January 26, 2024","externalUrl":null,"permalink":"/en/sorties/musique/dead-poet-society/","section":"Outings","summary":"Dead Poet Society — intense alternative rock from Los Angeles, blending sharp riffs with cathartic melodies. New album Monarch out October 2, 2026; European tour early 2027.","title":"Dead Poet Society","type":"sorties"},{"content":"","date":"January 26, 2024","externalUrl":null,"permalink":"/en/tags/los-angeles/","section":"Tags","summary":"","title":"Los Angeles","type":"tags"},{"content":"","date":"January 26, 2024","externalUrl":null,"permalink":"/en/tags/post-grunge/","section":"Tags","summary":"","title":"Post-Grunge","type":"tags"},{"content":"","date":"November 5, 2023","externalUrl":null,"permalink":"/en/tags/2023/","section":"Tags","summary":"","title":"2023","type":"tags"},{"content":"Craving a bit of blue sky at All Saints\u0026rsquo; Day. Barcelona as the destination for a colourful city break. On the agenda: Sagrada Família, Palau de la Música Catalana, Recinte Modernista de Sant Pau, not to mention traditional tapas.\nDay 1: Discovering Barcelona on foot # Departure from Brussels South Charleroi (08:25) Arrival at Barcelona El Prat Airport Aerobús A2 to Gran Comte Borrell Aspasios Market Balconies apartment (right across from Mercada San Antoni) Antic Hospital de la Santa Creu Crossing El Raval Rambla del Raval Botero’s Cat La Boqueria market Foray into the Barri Gòtic Plaça del Pi, pink façade Pont del Bisbe Plaça del Rei El Born neighbourhood and excellent coffee at Xilotera Visit to Palau de la Música Catalana Arc de Triomf Parc de la Ciutadella Down to La Barceloneta beach Over 26,000 steps this first day Day 2: Montjuïc # Off to Montjuïc Jardins de Laribal Jardí del Teatre Grec Striking MNAC (exterior) Poble Espanyol Visit to the Fiesta exhibition on Spanish traditions Olympic communications tower (Calatrava) Olympic Stadium Castell de Montjuïc Walk down to La Rambla Casa Amatller / Casa Batlló / Casa Milà (La Pedrera) Dinner at Kessler Over 31,000 steps this second day Day 3: Recinte Modernista and Sagrada Família # To Recinte Modernista de Sant Pau Passeig de Gràcia Passing the Sagrada Família Visit to the former hospital (Lluís Domènech i Montaner architecture) Dinner at Honest Green Gràcia Stop at Casa Vicens Coffee stop and sweet break at Molo Coffee Sagrada visit at 17:15 Stop at Maresme Brewery for a quality IPA Candlelight Tribute to Queen concert at Palau de la Música Catalana Walk back with nearly 34,000 steps Day 4: Park Güell \u0026amp; Casa Batlló # To Park Güell, 1h15 from the flat Les Tres Creus (182 m) Casa Trias The square with the benches Visit to La lavandiere Viaducts and hunting for the elephant Hypostyle hall and the park’s classic dragon Casa Batlló visit at 14:45 Back toward La Rambla, past the Gran Teatre del Liceu Toward the Barri Gòtic Through Plaça Reial Born quarter with Santa Maria del Mar Dinner at La Condesa (Mexican restaurant) Nearly 32,000 steps Day 5: Return to Belgium # Breakfast at the apartment Turris bakery next door Aerobús A2 to Terminal 2 Last bit of sun before boarding ","date":"November 5, 2023","externalUrl":null,"permalink":"/en/voyages/europe/barcelone/","section":"Travels","summary":"Craving a bit of blue sky at All Saints’ Day. Barcelona as the destination for a colourful city break. On the agenda: Sagrada Família, Palau de la Música Catalana, Recinte Modernista de Sant Pau, not to mention traditional tapas.","title":"Barcelona","type":"voyages"},{"content":"","date":"November 5, 2023","externalUrl":null,"permalink":"/en/tags/new-york/","section":"Tags","summary":"","title":"New York","type":"tags"},{"content":"TBA\nDay 1: TBA # Arrival at Newark Liberty International Airport — one of the three airports serving New York alongside JFK and LaGuardia, located about 25 km from midtown Manhattan on the New Jersey side Train connection via the NJ Transit app to Penn Station — far more practical and affordable than a cab from Newark Exit at Madison Square Garden, New York\u0026rsquo;s premier sports arena opened in 1968 (the fourth iteration of the building on that site), home of the Knicks (NBA) and the Rangers (NHL) Walk through the streets of NY to reach the hotel Hotel in East Village at the Moxy NYC East Village Walking tour: NoHo (North of Houston Street), the Flatiron Building — a 1902 masterpiece by Daniel Burnham, 87 m tall, whose triangular shape results from the intersection of Broadway and 5th Avenue at 23rd Street — and Times Square, named after the New York Times which moved there in 1904 Day 2: TBA # Typical East Village facades — a neighborhood once known for its anarchist and punk scene, now one of Manhattan\u0026rsquo;s most vibrant Washington Square Park and its squirrel show — at the heart of Greenwich Village, the park is dominated by the Washington Arch: first built in wood in 1889 for the centennial of George Washington\u0026rsquo;s inauguration, then rebuilt in white marble in 1892 by architect Stanford White West Village, the bohemian extension of Greenwich Village with its cobblestone streets and red-brick townhouses — a favorite neighborhood of artists and celebrities since the 1960s Walking past the bar Fedora, which makes me think of Red Hat Meatpacking District — in the 1990s the neighborhood still had over 250 slaughterhouses and cold-storage warehouses; today one of Manhattan\u0026rsquo;s trendiest areas High Line for a guided tour cancelled due to rain — a former freight rail line built in the 1930s to serve West Side factories, converted into a 2.3 km elevated park opened in 2009 I visit the High Line on my own, with beautiful views over the Hudson and Manhattan\u0026rsquo;s rooftops Street mural of Mother Teresa and Gandhi Shopping at Chelsea Market — the former Nabisco industrial complex where the Oreo cookie was first made in 1912, now a two-level food hall Striking modern architecture Hudson Yards and the Vessel, a monumental copper sculpture designed by Thomas Heatherwick, unveiled in 2019: 46 m tall, 154 interconnected flights of stairs, 2,500 steps Day 3: TBA # Renting a Citi Bike — New York\u0026rsquo;s bike-share network launched in 2013, operated by Lyft, with over 25,000 bikes available across the city Brooklyn Bridge: designed by John Roebling and built between 1869 and 1883 — Roebling died in a construction accident before completion, and his son Washington finished the project; the first suspension bridge in the world to use steel cables, 486 m between the two towers Downtown Brooklyn (sculpture of a finger pointing to the sky) Fulton Ferry Dumbo — acronym for \u0026ldquo;Down Under the Manhattan Bridge Overpass\u0026rdquo; — and the famous Washington Street perspective where the Brooklyn Bridge appears framed between two red-brick buildings, one of the most photographed views in New York Empire Fulton Ferry at the foot of the Brooklyn Bridge Times Square Domino Park, the former Domino Sugar refinery (1882–2004) converted into a public park in 2018 with a direct view of Manhattan, and a stop at Other Half Brewing, a Brooklyn microbrewery founded in 2014, renowned for its heavily hopped IPAs and limited releases View from the South Street Seaport, a 17th-century historic port district where tall ships once docked, with its restored brick warehouses The Battery, a 10-acre park at the southern tip of Manhattan — I spot the Statue of Liberty in the distance, gifted by France in 1886 and standing 93 m tall including its pedestal West Thames Park and the 9/11 Memorial: two vast reflecting pools set in the exact footprint of the Twin Towers, inaugurated on September 11, 2011, lined with the names of the 2,977 victims engraved in bronze Back for a hot dog at Crif Dogs in East Village — and discovering the speakeasy PDT (Please Don\u0026rsquo;t Tell), regularly ranked among the world\u0026rsquo;s 50 best bars, accessible only by picking up the phone in a booth hidden inside the restaurant Continue cycling Train departure to Boston ","date":"November 5, 2023","externalUrl":null,"permalink":"/en/voyages/amerique/new-york-boston/","section":"Travels","summary":"A weekend discovering the Big Apple and a week in Boston","title":"New York \u0026 Boston","type":"voyages"},{"content":"","date":"September 3, 2023","externalUrl":null,"permalink":"/en/tags/concerts/","section":"Tags","summary":"","title":"Concerts","type":"tags"},{"content":"","date":"3 janvier 2023","externalUrl":null,"permalink":"/tags/planification/","section":"Tags","summary":"","title":"Planification","type":"tags"},{"content":"","date":"September 3, 2023","externalUrl":null,"permalink":"/en/tags/planning/","section":"Tags","summary":"","title":"Planning","type":"tags"},{"content":" Planning \u0026amp; bookings # Theatres # Belgium # Théâtre Royal des Galeries (Brussels): https://www.trg.be/ Théâtre Le Palace (Ath): https://www.mcath.be/ Théâtre Royal de Mons: https://theatreroyalmons.be/ Lille # Théâtre Sébastopol: http://www.theatre-sebastopol.fr/ La Comédie de Lille: https://www.comediedelille.fr/ Paris # Théâtre de la Renaissance: https://www.theatredelarenaissance.com/ Théâtre Édouard VII: https://www.theatreedouard7.com/ Théâtre de la Porte Saint-Martin: https://www.portestmartin.com/ Théâtre de Paris: https://www.theatredeparis.com/ Théâtre des Nouveautés: https://www.theatredesnouveautes.fr/ Théâtre de la Gaité Montparnasse: https://gaite.com/ Théâtre Michel: https://www.theatre-michel.fr/ Théâtre des Mathurins: https://www.theatredesmathurins.com/ Concerts # Bands in Town: https://www.bandsintown.com/\nBelgium # Palais 12 (Brussels): https://www.palais12.com/ Forest National (Brussels): https://www.forest-national.be/fr/ ","date":"September 3, 2023","externalUrl":null,"permalink":"/en/sorties/planification-des-sorties/","section":"Outings","summary":"Bookings, theatres and concerts in Belgium, Lille and Paris.","title":"Planning Outings","type":"sorties"},{"content":"This year, after going back and forth between lots of destinations (Jordan, Morocco,…), we finally decided to set our course for Sardinia. On the agenda: hikes, kayaking, nuragic sites, beaches and coves with crystal-clear water, dolphin watching…not to mention sampling local treats like culurgiones, pane carasau, and pardulas. A pretty packed schedule to discover this Italian island south of Corsica!\nDay 1: Cagliari # Departure from Brussels South Charleroi Arrival at Cagliari Airport Picking up the rental car Walking tour of Cagliari Off to our first place to stay in the Ogliastra area Sardinia is only a little over two hours’ flight from Belgium, so you feel like you’re somewhere else in no time. The Ryanair flight goes smoothly and we touch down at Cagliari Airport around 11:40. By the time we’ve collected our bags and the rental car (a white Opel Crossland), it’s already 1:30 p.m.… Off to the Sardinian capital for a quick look around before heading to our first accommodation. While looking for a walking route, I came across the Navaway app. We start from City Hall, Santa Anne’s church, the Torre dell’Elefante, Santa Maria Cathedral, the Bastione di Saint Remy,…\nDay 2: Arbatax \u0026amp; Porto Frailis # Pool Lido di Orri beach Stroll through the village of Arbatax and its Rocce Rosse Walk out to Porto Frailis beach and the Torre di San Gemiliano Dinner in Porto Frailis First morning in Sardinia with a view of the pool, the mountain with the hilltop village of Baunei, and the sea in the background. A small surprise: a slightly cloudy sky in the distance. The plan for this first vacation day was to take it easy and unwind, making the most of the pool and nearby beaches. After a quick dip in the pool, we head to Lido di Orri. In the afternoon we decide to go all the way to the village of Arbatax, known for its famous red rocks (Rocce Rosse). On site, a huge stage is being set up for the Arbatax Music Festival. We wander the streets of Arbatax and end up on the nice little beach at Porto Frailis. It’s a small 200 m beach, sheltered from the wind by the bay and watched over by the tower of San Gemiliano. From the top of the tower you get a lovely view over Porto Frailis bay.\nDay 3: Gorropu Canyon # Hike in Gorropu Canyon Start at 1,000 m elevation at Ghenna ’e Silana Paid entry (€5) with a check on how much water you’re carrying Steady descent, losing height down to 367 m at the gorge entrance Visiting the gorge is paid as well Walk back up Cold drink at Bar Silana For our third day, the Gorropu Canyon hike is on the menu. The trailhead is at 1,000 m at Ghenna ’e Silana. There’s a fee to enter the hike (€5) and they’ll make sure you’ve brought enough water for the route. The descent is non-stop downhill (watch your knees) until you reach 367 m at the mouth of the gorge. Visiting the gorge costs extra too, but it would be a shame to come all that way down and skip it. We decided to walk back up. Back at the car park, quick stop at Bar Silana for a cold drink.\nDay 4: Cala Goloritzé # Hike from su Porteddu to Cala Goloritzé Through the village of Baunei You shouldn’t always trust Google Maps Visitor cap of 250 Booking required via an app Gorgeous hike, easier than Gorropu Canyon Swim in the sea and walk back to the start Even though we were bummed we couldn’t hop from beach to beach by Zodiac, we spotted that you can reach Cala Goloritzé cove from su Porteddu on the Golgo plateau. The hike looked doable with the kids: 142 m of ascent and 544 m of descent. Crossing the village of Baunei, a sign says not to follow Google Maps and to change direction because the road narrows to about 2 m wide.\nDay 5: Biderosa oasis # Walk through the pine forest to the first of the 5 beaches You can rent kayaks and go trekking Bird-watching spots Beach 1: crystal-clear water, hardly anyone there Beach 2: the least pretty, lots of seaweed Beaches 3 and 4: lovely, fine white sand Beach 5: pretty too but much busier Ice cream break at a food truck near beach 3 Drive to our second place to stay in Baja Sardinia Day 6: Cala Moresca, Golfo Aranci \u0026amp; Olbia # Kayaking \u0026amp; dolphins outing One double kayak and one triple kayak Dolphin watching near a fish farm Stop at Figarolo to swim and snorkel Stop at Cala Moresca’s third beach for an aperitivo: pecorino, salami, orange juice or beer Fun fact: Disney filmed part of The Little Mermaid at Cala Moresca Back to Cala Moresca’s second beach to relax Stop in Golfo Aranci for ice cream served in brioche buns Quick look around Olbia Day 7: Arzachena \u0026amp; Cala Moresca # Visit Arzachena on market day Local quirk: the mushroom Browsing among the stalls Nice staircase up to a small church Stop in San Pantaleo for ice cream Back to Cala Moresca for a hike to the Marconi semaphore Day 8: Maddalena archipelago # Ferry from Palau to the Maddalena islands (30 min, Delcomar) Across to Caprera and its 16 hiking trails Starting point: the Arbuticci fortifications Trail 14: Capa Napoletana Detour via Cala Caprerese for a picnic Discovering a superb cove with turquoise water Cala Cottici (sand like grains of rice) only accessible with a guide Return to La Maddalena, 20 km scenic road Dinner at restaurant La Toscane Day 9: Santa Teresa di Gallura # Leaving Baja Sardinia for our third accommodation Baja Sardinia beach 100 m from the apartment Stop in Santa Teresa di Gallura for a visit Torre di Longonsardo with paragliders overhead View over Reina Bianca beach Day 10: Castelsardo # Couldn’t book La Pelosa beach (750 spots gone in 2 minutes) Bought a family bundle on Alghero Experience (Neptune’s Grotto + museums) Stop at the Basilica of Saccargia Wander Castelsardo and climb up to the castle Rolled ice cream Explore the alleyways and the colourful dome Arrival at third stay: Villa Ginevra near Sassari Day 11: Capo Caccia # Neptune’s Grotto at 9 a.m. 654 steps, still in the shade (1,308 steps round trip) Really nice guided tour (English/Italian) Le Prigionette nature reserve Climb to the summit of Monte Timidome (slopes up to 30%) Stunning view at the top and meeting two donkeys Day 12: Asinara National Park # Ferry from Porto Torres (1 hr 15) Asinara Park: only residents are donkeys, including albino white donkeys Getting around: golf cart, bike, 4×4, shuttle, or on foot Arrival at Cala Reale Trails 6 and 11 toward Cala Sabina Trails very poorly marked, brutal heat Back to Trabuccato beach Takeaway pizzas from La Roccia Day 13: Bosa # Last dip, then headed for Bosa Parking behind the old tanneries Visit the castle with great views over Bosa and the Temo river Colourful streets Dinner at Bacco Bistrot Drive to our fourth and last accommodation in Guspini Day 14: Iglesias \u0026amp; Porto Flavia # Quick look at Iglesias Guided tour of Porto Flavia (50 min in English) Beach level with Porto Flavia Stop in Buggeru for ice cream and pardulas Cala del Balenetto, reachable from San Nicolò beach Small cove with transparent water and white sand, like a swimming pool Day 15: Back to Belgium # Early wake-up at 2:15 a.m. Drop off the rental car Coffee and orange juice at the airport Return flight at 6:25 a.m. Land back in Belgium under cloudy skies at 8:45 a.m. ","date":"August 18, 2023","externalUrl":null,"permalink":"/en/voyages/europe/sardaigne/","section":"Travels","summary":"After going back and forth between lots of destinations for ages, we finally decided to set our course for Sardinia. On the agenda: hikes, kayaking, nuragic sites, beaches and coves with crystal-clear water, dolphin watching…","title":"Sardinia","type":"voyages"},{"content":"","date":"1 janvier 2023","externalUrl":null,"permalink":"/tags/activit%C3%A9s/","section":"Tags","summary":"","title":"Activités","type":"tags"},{"content":"","date":"January 1, 2023","externalUrl":null,"permalink":"/en/tags/activities/","section":"Tags","summary":"","title":"Activities","type":"tags"},{"content":"","date":"1 janvier 2023","externalUrl":null,"permalink":"/tags/pluie/","section":"Tags","summary":"","title":"Pluie","type":"tags"},{"content":"","date":"January 1, 2023","externalUrl":null,"permalink":"/en/tags/rain/","section":"Tags","summary":"","title":"Rain","type":"tags"},{"content":" Indoor skydiving simulator # In Belgium:\nhttps://www.airspaceindoorskydiving.be/ http://fly-in.be/ ","date":"January 1, 2023","externalUrl":null,"permalink":"/en/sorties/quand-il-pleut/","section":"Outings","summary":"Activity ideas for rainy days.","title":"When it rains...","type":"sorties"},{"content":"Aqualibi\n","date":"March 17, 2019","externalUrl":null,"permalink":"/en/sorties/aqualibi/","section":"Outings","summary":"Aqualibi, the water park.","title":"Aqualibi","type":"sorties"},{"content":"","date":"17 janvier 2019","externalUrl":null,"permalink":"/tags/parc-aquatique/","section":"Tags","summary":"","title":"Parc Aquatique","type":"tags"},{"content":"","date":"17 janvier 2019","externalUrl":null,"permalink":"/categories/parcs/","section":"Categories","summary":"","title":"Parcs","type":"categories"},{"content":"","date":"March 17, 2019","externalUrl":null,"permalink":"/en/categories/parks/","section":"Categories","summary":"","title":"Parks","type":"categories"},{"content":"","date":"March 17, 2019","externalUrl":null,"permalink":"/en/tags/water-park/","section":"Tags","summary":"","title":"Water Park","type":"tags"},{"content":"","date":"March 1, 2019","externalUrl":null,"permalink":"/en/tags/la-cigale/","section":"Tags","summary":"","title":"La Cigale","type":"tags"},{"content":"An exceptional concert at La Cigale.\n","date":"March 1, 2019","externalUrl":null,"permalink":"/en/sorties/musique/shaka-ponk/","section":"Outings","summary":"An exceptional concert at La Cigale.","title":"Shaka Ponk","type":"sorties"},{"content":"","date":"July 30, 2018","externalUrl":null,"permalink":"/en/tags/2018/","section":"Tags","summary":"","title":"2018","type":"tags"},{"content":"This year we decided to explore southern Italy, starting from the buzzing city of Naples. On the agenda: pizza, Vespas, historic sights, a national park, beaches, gelato—in short, a packed schedule that was pure pleasure.\nDay 1: Naples # Flight into Naples, taxi to the apartment to drop the bags, then a walking tour of the city plus the Naples underground (Napoli Sotterranea). We wrapped up with Neapolitan pizza by the sea.\nIt’s only about two hours in the air from Belgium; the taxi to our flat ran us something like €25–30. We’d booked via Abritel (HomeAway) and were greeted by Gaëtano. We wandered from Piazza del Gesù Nuovo through the centro storico. San Severo Chapel was closed—it’s shut on Tuesdays—so we headed underground instead on an English-language tour that was really worth it.\nDay 2: Ischia # Breakfast at Il Chicco D’Oro, then off to Ischia. We docked at Casamicciola and spent the afternoon at the Negombo thermal baths. Back to Naples for dinner at Trattoria da Concetta.\nDay 3: Vesuvius \u0026amp; Pompeii # Breakfast at Bar Augustus, then up Vesuvius and through Pompeii. Dinner at pizzeria Al 22.\nDay 4: The Itria Valley \u0026amp; the trulli # Takeaway lunch, taxi to the airport to pick up the rental car, then on to Trito, just outside Locorotondo. We strolled Locorotondo and had dinner at Pizza Casa Pinto. We stayed at Truddhi Casa e Cucina di Puglia in Trito.\nDay 5: Martina Franca \u0026amp; Alberobello # Morning in Martina Franca—pastry break during the Belgium–England match—then Alberobello. Dinner at Il Guercio (pinseria).\nDay 6: Cisternino # A slower day: pool time, Cisternino, and gelato.\nDay 7: Polignano a Mare # Again pool plus an outing—Polignano a Mare—with gelato at Caruso.\nDay 8: Bari \u0026amp; Monopoli # Bari first, gelato at Martunicelli, then Monopoli; we had dinner there.\nDay 9: Matera # The Sassi di Matera (UNESCO World Heritage, European Capital of Culture 2019), Grotta di Vico Solitario, gelato at I Vizi degli Angeli, and a taste of the heart-shaped bread Matera is known for.\nMatera sits in Basilicata rather than Puglia proper, but the detour was worth it—the cave districts are UNESCO-listed and the city was ECOC in 2019, one of the stand-out stops of the trip.\nDay 10: Ostuni \u0026amp; Locorotondo # Ostuni, gelato at Ciccio, then dinner at Casa Pinto in Locorotondo.\nDay 11: Salento # We checked into Masseria Lu Iundulu near Lecce, visited Porto Cesareo, beach time in the afternoon, dinner at Cantine Don Carlo.\nDay 12: Otranto \u0026amp; Lecce # Otranto in the morning with excellent granita, then Lecce (near Porto Napoli). Dinner at Dall’Antiquario.\nDay 13: Gallipoli bay # A hidden-feeling swim spot near Gallipoli, Punta Pizzo, then Gallipoli itself—spritz and fish antipasti at La Spingula, Martinucci gelato for the kids, dinner back at Cantine Don Carlo (Lequile).\nDay 14: Gargano National Park # Road trip toward the Gargano, coffee (and pastry) stop in Trani, then on to Mattinata—dinner at La Terraza.\nDay 15: Mattinata to Vieste # National-park focus: boat tour of the sea caves (Grotte Marine di Mattinata) with Matteo Silvestri, half an hour swimming break, drive toward Vieste with a pause at Baia San Felice, then Vieste (jellyfish in the water, trabucci offshore). Dinner at La Scapetta d’Oro back in Mattinata.\nDay 16: A Gargano beach # Vignanotica Beach—you can add a scenic walk—and gelato at Gabrielino in Mattinata. Then we pushed on toward Caserta for the night and dinner at Tre Farine.\nBack to Belgium # After looping through Campania, Puglia (and that Basilicata side-trip), one last meal in Caserta and a flight home with full memory cards—and stomachs.\nWhat we would have liked to squeeze in # A visit to Castel del Monte The Castellana Caves The Tremiti Islands Hikes in the Murge ","date":"July 30, 2018","externalUrl":null,"permalink":"/en/voyages/europe/puglia/","section":"Travels","summary":"This year we decided to explore southern Italy, starting from the buzzing city of Naples. On the agenda: pizza, Vespas, historic sights, a national park, beaches, gelato—in short, a packed schedule that was pure pleasure.","title":"Puglia","type":"voyages"},{"content":"","date":"June 19, 2018","externalUrl":null,"permalink":"/en/tags/gand/","section":"Tags","summary":"","title":"Gand","type":"tags"},{"content":"Lovely Italian restaurant in Ghent. Located a stone\u0026rsquo;s throw from the Vrijdagsmarkt…\n","date":"June 19, 2018","externalUrl":null,"permalink":"/en/sorties/boire-manger/resto/il-mezzogiorno/","section":"Outings","summary":"Lovely Italian restaurant in Ghent, located a stone’s throw from the Vrijdagsmarkt.","title":"Il Mezzogiorno","type":"sorties"},{"content":"","date":"June 19, 2018","externalUrl":null,"permalink":"/en/tags/italian/","section":"Tags","summary":"","title":"Italian","type":"tags"},{"content":"","date":"19 janvier 2018","externalUrl":null,"permalink":"/tags/italien/","section":"Tags","summary":"","title":"Italien","type":"tags"},{"content":"A unique menu to discover the chef\u0026rsquo;s creations. A festival of flavours with every dish.\nA dynamic, friendly team. Excellent value for money.\nhttps://portfolio-restaurant.nl/\n","date":"June 19, 2018","externalUrl":null,"permalink":"/en/sorties/boire-manger/resto/portfolio/","section":"Outings","summary":"A unique menu to discover the chef’s creations. A festival of flavours with every dish.","title":"Portfolio","type":"sorties"},{"content":"","date":"June 19, 2018","externalUrl":null,"permalink":"/en/sorties/boire-manger/resto/","section":"Outings","summary":"","title":"Restaurants","type":"sorties"},{"content":"","externalUrl":null,"permalink":"/en/tags/3gpp/","section":"Tags","summary":"","title":"3gpp","type":"tags"},{"content":"3GPP Security Assurance Specifications (SCAS) are technical specifications developed by 3GPP\u0026rsquo;s SA3 working group (Security) that define security requirements and associated test cases for specific network product classes — each 3GPP-defined network function (AMF, SMF, UPF, gNB, MME, etc.) has its own SCAS document. 3GPP is the international standards body responsible for mobile telecommunications standards (comprising seven organizational partners covering Europe, US, China, Japan, Korea, India), making SCAS a globally recognized specification set rather than a national or regional scheme. Each SCAS document follows a structured approach: it identifies the assets of the network product class that require protection, performs a threat analysis describing how those assets can be exploited, defines security requirements (objectives) that mitigate the identified threats, and specifies concrete test cases to verify that a product implementation meets those requirements. SCAS specifications serve as the technical foundation for the GSMA NESAS scheme — when a vendor submits a network product for NESAS evaluation, accredited test laboratories evaluate it against the applicable SCAS test cases. Compliance is voluntary (there is no legal mandate to pass SCAS tests), but SCAS/NESAS evaluation results are increasingly used as a procurement requirement by telecom operators and are referenced by the EU 5G Security Toolbox and national security assessments. The list of adopted SCAS documents is maintained by the GSMA in FS.63 and continues to expand as 3GPP defines new network functions.\nRed Hat\u0026rsquo;s relevance to SCAS is indirect but technically significant. Red Hat does not itself develop 3GPP network functions — that is the domain of telecom equipment vendors (Ericsson, Nokia, Samsung, Mavenir, etc.) — but it provides the platform on which those network functions execute and against which SCAS test cases are ultimately run. When a SCAS test case verifies, for example, that a network function uses TLS 1.3 for its service-based interfaces, that TLS implementation is provided by the OpenSSL libraries in RHEL. When a test case checks that unauthorized access to the network function\u0026rsquo;s data is prevented, the enforcement mechanism is SELinux, Kubernetes RBAC, and network policies on OpenShift. When a test case evaluates the network function\u0026rsquo;s resilience to known CVEs, the vendor relies on Red Hat\u0026rsquo;s vulnerability management (CSAF advisories, rapid backporting, Insights-driven patching). Red Hat\u0026rsquo;s telco-specific platform hardening — including the restricted kernel (reduced attack surface for real-time workloads), FIPS 140-3 mode, seccomp profiles for containerized NFs, and the Compliance Operator\u0026rsquo;s CIS/STIG enforcement on telco clusters — directly contributes to positive SCAS evaluation outcomes. As 3GPP expands SCAS coverage to cloud-native network functions (where the boundary between the NF and its platform becomes increasingly relevant), Red Hat\u0026rsquo;s security properties will feature more prominently in SCAS evaluations.\nAdditional Information # 3GPP SCAS - Security Assurance Specifications GSMA FS.63 - List of adopted SCAS 3GPP SA3 Working Group ","externalUrl":null,"permalink":"/en/compliance/scas/","section":"Index","summary":"3GPP Security Assurance Specifications (SCAS) are technical specifications developed by 3GPP’s SA3 working group (Security) that define security requirements and associated test cases for specific network product classes — each 3GPP-defined network function (AMF, SMF, UPF, gNB, MME, etc.) has its own SCAS document. 3GPP is the international standards body responsible for mobile telecommunications standards (comprising seven organizational partners covering Europe, US, China, Japan, Korea, India), making SCAS a globally recognized specification set rather than a national or regional scheme. Each SCAS document follows a structured approach: it identifies the assets of the network product class that require protection, performs a threat analysis describing how those assets can be exploited, defines security requirements (objectives) that mitigate the identified threats, and specifies concrete test cases to verify that a product implementation meets those requirements. SCAS specifications serve as the technical foundation for the GSMA NESAS scheme — when a vendor submits a network product for NESAS evaluation, accredited test laboratories evaluate it against the applicable SCAS test cases. Compliance is voluntary (there is no legal mandate to pass SCAS tests), but SCAS/NESAS evaluation results are increasingly used as a procurement requirement by telecom operators and are referenced by the EU 5G Security Toolbox and national security assessments. The list of adopted SCAS documents is maintained by the GSMA in FS.63 and continues to expand as 3GPP defines new network functions.\n","title":"3GPP SCAS","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/5g/","section":"Tags","summary":"","title":"5g","type":"tags"},{"content":"The 5G Core (5GC) is the packet core network architecture defined by 3GPP from Release 15 onward as the control and user-plane backbone of standalone 5G deployments. It replaces the Evolved Packet Core (EPC) of 4G LTE not through incremental evolution but through a deliberate architectural break: where the EPC was built around monolithic, hardware-bound network functions interconnected by point-to-point interfaces, the 5GC is designed from the ground up around a Service-Based Architecture (SBA) — every network function exposes its capabilities as a set of services over a common HTTP/2 bus (the Service-Based Interface, SBI), and any authorised consumer NF can discover and invoke those services through the NRF (Network Repository Function) without bilateral peering agreements or proprietary protocols. This shift reflects two structural requirements of 5G that EPC could not satisfy: network slicing — the ability to run logically independent end-to-end networks (each with its own QoS, isolation, and lifecycle) on shared physical infrastructure — and cloud-native deployment, where NFs run as containerised microservices on commodity compute, can be horizontally scaled, and are managed by standard Kubernetes-compatible orchestration rather than vendor-specific element managers. The 5GC also enforces a hard separation between Control Plane (CP) and User Plane (UP) — the CUPS principle inherited from 3GPP Release 14 and fully operationalised here — so that the UPF (User Plane Function) handling packet forwarding, QoS enforcement, and traffic anchoring can be distributed to the edge independently of the control logic, enabling ultra-low-latency and MEC scenarios without redesigning the control plane. The architecture is access-agnostic: the same 5GC serves NR (New Radio), eLTE, Wi-Fi (untrusted/trusted non-3GPP access), and fixed-wireless access through a unified N2/N3 reference point toward the access network and a common UE context model in the AMF.\nThe 5GC control plane is decomposed into discrete, stateless or minimally-stateful network functions, each owning a specific slice of the session and mobility management problem. The AMF (Access and Mobility Management Function) terminates NAS signalling from the UE, manages registration, mobility, reachability, and security context — it is the single CP contact point for the access network (N2 toward the RAN, N1 toward the UE). The SMF (Session Management Function) owns PDU session lifecycle: it selects and controls the UPF (over N4 / PFCP), manages IP address allocation (via UDM or local pools), enforces policy rules from the PCF, and drives QoS negotiation end-to-end. The UPF is the sole user-plane element; it anchors PDU sessions, applies packet detection rules (PDRs) and forwarding action rules (FARs) pushed by the SMF over N4, enforces GBR and non-GBR QoS flows, performs UL/DL traffic measurement for charging, and can function as a PSA (PDU Session Anchor), an I-UPF (intermediate, for multi-homed or ULCL topologies), or a branching point for local offload. Supporting NFs include: the UDM (Unified Data Management) holding subscriber profiles and authentication vectors; the AUSF (Authentication Server Function) executing 5G-AKA or EAP-AKA\u0026rsquo; and generating the anchor key KAUSF; the PCF (Policy Control Function) providing per-session policy and QoS rules; the NSSF (Network Slice Selection Function) determining which S-NSSAI and NSI a UE is served by; the NEF (Network Exposure Function) securely brokering capabilities toward external applications and edge platforms; and the NRF acting as the service registry and discovery engine for the entire SBA. Interfaces between NFs on the SBI use OpenAPI 3.0-described REST APIs carried over HTTP/2 and secured with OAuth 2.0 (client credentials grant) and mutual TLS, making the 5GC the first 3GPP core architecture with a formally API-first inter-NF contract.\nNetwork Function Primary Role Key Interfaces AMF NAS termination, registration, mobility, security context N1 (UE), N2 (RAN), N8/N12 SMF PDU session management, UPF control, QoS, charging N4 (UPF/PFCP), N7, N10 UPF Packet forwarding, QoS enforcement, traffic anchor N4 (SMF), N3 (RAN), N6 UDM Subscriber data, authentication vectors, subscription mgmt N8, N10, N13 AUSF Authentication (5G-AKA / EAP-AKA\u0026rsquo;), key derivation N12 (AMF), N13 (UDM) PCF Policy, QoS rules, slice policy, network exposure N7 (SMF), N15 (AMF) NSSF Slice selection, S-NSSAI mapping, NSI assignment N22 (AMF) NEF Capability exposure to external AF/MEC, northbound brokering N29, N33 NRF NF registration, discovery, OAuth token endpoint Nnrf (SBI) NWDAF Network data analytics, ML model exposure, inference Nnwdaf (SBI) Standardisation of the 5GC is entirely within 3GPP, principally under SA2 (architecture), SA3 (security), CT1/CT3 (protocol and stage 3), and CT4 (core network protocols and charging). The foundational release is Release 15 (frozen June 2018), which defined the SBA, the full NF set, N1–N14 reference points, 5G-AKA, network slicing with S-NSSAI, and the NG-RAN / 5GC split. Release 16 (frozen July 2020) extended the architecture with URLLC and IIoT enhancements (time-sensitive networking, 5GLAN, ethernet PDU sessions), V2X via PC5/Uu, secondary authentication via DN-AAA, and improvements to slice-aware policy. Release 17 (frozen June 2022) introduced NPN (Non-Public Networks) for private 5G, reduced capability (RedCap) UE support, multicast/broadcast (5MBS), and enhanced slice admission control. Release 18 — the first release branded 5G Advanced (frozen 2024) — brings AI/ML integration into the core via an enhanced NWDAF (serving as both an analytics and model-training/inference platform), network automation (FEAT_NetAuto), ambient IoT, and sidelink relay enhancements. Release 19 (ongoing, targeting 2025–2026) continues the 5G Advanced track with further AI/ML-native NF interactions, enhanced NEF for edge exposure, and early 6G architectural studies. Security architecture is anchored in TS 33.501: the 5GC enforces SUPI concealment via the SUCI mechanism (public-key encryption of the subscriber identity using the home network\u0026rsquo;s public key, preventing IMSI catchers), mandates NAS integrity protection from the first message, and separates home and serving network security through the SEPP (Security Edge Protection Proxy) on the N32 roaming interface, which applies PRINS (Protocol for N32 Interconnect Security) to mediate inter-PLMN signalling — a structural improvement over the SS7/Diameter trust model of 4G roaming.\nDeployment of standalone 5GC has followed a Non-Standalone (NSA, Option 3x) → Standalone (SA, Option 2) migration path for most operators, with NSA — which reuses the EPC and adds NR as a secondary radio — remaining dominant in early 5G rollouts because it preserved existing core investments. By 2025–2026, SA deployments have expanded materially, led by operators in South Korea, Japan, the US (notably T-Mobile), China, and a growing number of European operators, as well as private network deployments where SA\u0026rsquo;s slicing and local UPF capabilities are the primary value proposition. Cloud-native 5GC — NFs packaged as containers, deployed on Kubernetes (often via CNI-specific Helm charts), and managed through ETSI NFV MANO-aligned or cloud-native orchestration (O2 interface toward O-RAN\u0026rsquo;s O-Cloud for integrated RAN+core scenarios) — is now the default procurement posture for greenfield SA cores; virtualised NFs on NFVI remain common in brownfield or hybrid deployments. The UPF distribution pattern (multiple UPFs in a ULCL or multi-homed topology, with I-UPFs at the edge anchored by a central PSA) is the primary enabler of MEC (Multi-access Edge Computing) integration, allowing traffic to break out locally at the edge without full N6 hairpin to a central data centre. Commercially, the NF vendors (Ericsson, Nokia, Huawei, ZTE, Samsung, and cloud-native specialists such as Mavenir, Parallel Wireless, and Druid Software) offer both disaggregated (per-NF) and converged (full 5GC stack) packaging; the NWDAF and NEF are emerging as the commercial leverage points for AI-driven automation and platform-as-a-service monetisation respectively. The persistent tension in SA 5GC deployments is between the architectural idealism of fully cloud-native, microserviced, stateless NFs and the operational reality of carriers who need predictable latency, five-nines availability, and regulatory compliance on infrastructure that may run on the same sites as their 4G EPC — a tension that drives most commercial 5GCs toward a pragmatic middle ground of containerised-but-not-fully-disaggregated NFs, with stateful session handling carefully isolated from stateless control logic.\nAdditional Information # 3GPP TS 23.501 – System Architecture for the 5G System 3GPP TS 33.501 – Security Architecture and Procedures for 5G System ETSI 5G overview ","externalUrl":null,"permalink":"/en/telco/5gc/","section":"Index","summary":"The 5G Core (5GC) is the packet core network architecture defined by 3GPP from Release 15 onward as the control and user-plane backbone of standalone 5G deployments. It replaces the Evolved Packet Core (EPC) of 4G LTE not through incremental evolution but through a deliberate architectural break: where the EPC was built around monolithic, hardware-bound network functions interconnected by point-to-point interfaces, the 5GC is designed from the ground up around a Service-Based Architecture (SBA) — every network function exposes its capabilities as a set of services over a common HTTP/2 bus (the Service-Based Interface, SBI), and any authorised consumer NF can discover and invoke those services through the NRF (Network Repository Function) without bilateral peering agreements or proprietary protocols. This shift reflects two structural requirements of 5G that EPC could not satisfy: network slicing — the ability to run logically independent end-to-end networks (each with its own QoS, isolation, and lifecycle) on shared physical infrastructure — and cloud-native deployment, where NFs run as containerised microservices on commodity compute, can be horizontally scaled, and are managed by standard Kubernetes-compatible orchestration rather than vendor-specific element managers. The 5GC also enforces a hard separation between Control Plane (CP) and User Plane (UP) — the CUPS principle inherited from 3GPP Release 14 and fully operationalised here — so that the UPF (User Plane Function) handling packet forwarding, QoS enforcement, and traffic anchoring can be distributed to the edge independently of the control logic, enabling ultra-low-latency and MEC scenarios without redesigning the control plane. The architecture is access-agnostic: the same 5GC serves NR (New Radio), eLTE, Wi-Fi (untrusted/trusted non-3GPP access), and fixed-wireless access through a unified N2/N3 reference point toward the access network and a common UE context model in the AMF.\n","title":"5G Core (5GC)","type":"telco"},{"content":"","externalUrl":null,"permalink":"/en/tags/5gc/","section":"Tags","summary":"","title":"5gc","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/6g/","section":"Tags","summary":"","title":"6g","type":"tags"},{"content":"6G denotes the next generation of mobile cellular systems, framed internationally as IMT-2030 by ITU-R and studied in 3GPP from Release 18 (5G Advanced) onward with dedicated 6G work items accelerating in Release 19–21. Commercial deployment is widely targeted for around 2030, following the typical decade-long cycle after 5G (IMT-2020). Unlike incremental 5G releases, 6G research programmes emphasise a native integration of AI/ML in the air interface and the core (not only as an overlay analytics function), Integrated Sensing and Communication (ISAC) — using radio resources jointly for connectivity and environment sensing — and exploration of sub-terahertz and advanced MIMO for extreme capacity and sensing resolution. Energy efficiency, ubiquitous coverage (including NTN/satellite as a first-class component), and trustworthy / resilient network operation are recurring design goals across regional initiatives (Europe’s Hexa-X / Hexa-X-II, Korea’s 6G R\u0026amp;D, Japan’s Beyond 5G, and industry forums such as Next G Alliance in North America).\nArchitecturally, 6G is expected to evolve from 5G SA rather than replace it overnight: cloud-native cores, slicing, and edge distribution remain foundational, while new functional blocks may appear for AI model lifecycle management, sensing data fusion, and cross-domain orchestration (RAN, transport, compute). 3GPP SA1 use cases for 6G include immersive XR, massive digital twin feeds, autonomous systems with stringent latency/reliability, and pervasive AI inference at the edge. RAN studies cover AI/ML for channel estimation, beam management, and resource allocation, with attention to training data governance and O-RAN-style RIC evolution. Security and privacy for sensing-derived data (localisation, imaging) are active in SA3. Standardisation remains multi-body: ITU-R WP 5D defines vision and IMT-2030 requirements; 3GPP will freeze the first 6G radio and system specifications in a release timeline still being negotiated (many observers point to 2030 for the first commercial IMT-2030 conformant systems).\nDeployment reality in the mid-2020s is pre-commercial: field trials, testbeds, and spectrum policy debates (e.g. 7–15 GHz and sub-THz bands) dominate over productised networks. Operators and vendors treat 6G as a research and standards investment parallel to ongoing 5G Advanced monetisation (RedCap, slicing, NWDAF automation). The practical bridge for enterprises today remains 5G SA + private networks + edge + AI ops; 6G narratives inform capex planning and open-RAN roadmaps rather than near-term procurement.\nAdditional Information # ITU-R IMT-2030 Framework 3GPP Release timeline Next G Alliance ","externalUrl":null,"permalink":"/en/telco/6g/","section":"Index","summary":"6G denotes the next generation of mobile cellular systems, framed internationally as IMT-2030 by ITU-R and studied in 3GPP from Release 18 (5G Advanced) onward with dedicated 6G work items accelerating in Release 19–21. Commercial deployment is widely targeted for around 2030, following the typical decade-long cycle after 5G (IMT-2020). Unlike incremental 5G releases, 6G research programmes emphasise a native integration of AI/ML in the air interface and the core (not only as an overlay analytics function), Integrated Sensing and Communication (ISAC) — using radio resources jointly for connectivity and environment sensing — and exploration of sub-terahertz and advanced MIMO for extreme capacity and sensing resolution. Energy efficiency, ubiquitous coverage (including NTN/satellite as a first-class component), and trustworthy / resilient network operation are recurring design goals across regional initiatives (Europe’s Hexa-X / Hexa-X-II, Korea’s 6G R\u0026D, Japan’s Beyond 5G, and industry forums such as Next G Alliance in North America).\n","title":"6G","type":"telco"},{"content":"","externalUrl":null,"permalink":"/en/tags/accelerator/","section":"Tags","summary":"","title":"Accelerator","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/access-control/","section":"Tags","summary":"","title":"Access-Control","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ad/","section":"Tags","summary":"","title":"Ad","type":"tags"},{"content":"Active Directory (AD) is Microsoft\u0026rsquo;s enterprise directory and identity platform, first released with Windows 2000 and now the dominant identity provider in enterprise environments worldwide. It combines four technologies into a single integrated system: LDAP as the directory access protocol for querying and modifying identity data; Kerberos 5 as the authentication protocol for issuing tickets that prove identity without transmitting passwords; DNS as the service location mechanism that clients use to discover domain controllers, Kerberos KDCs, and LDAP servers; and Group Policy as the configuration management system that pushes security settings, software installation, and policy enforcement to every joined machine. These four components are inseparable in practice: a Linux host joining an AD domain receives a Kerberos principal in AD\u0026rsquo;s KDC, a machine account object in the AD LDAP directory, a DNS record for its hostname, and (optionally) Group Policy Objects applied to it. The AD forest is the trust boundary: multiple domains can exist within a forest and all share a common schema, configuration, and Global Catalog, with transitive Kerberos trust between them.\nAD\u0026rsquo;s directory schema is LDAPv3-compatible but Microsoft-extended beyond standard RFC 2307. Every security principal (user, computer, group, service account) has a Security Identifier (SID) — a globally unique, immutable identifier that is the actual identity token in Windows access control, independent of name or DN. The SID is carried in the PAC (Privilege Attribute Certificate) embedded in every Kerberos ticket, containing the user\u0026rsquo;s SID, all group SIDs, and privilege flags — allowing Windows services and AD-aware Linux services to make authorisation decisions from the ticket alone without querying LDAP. User account attributes of security relevance include: userAccountControl (a bitmask encoding account enabled/disabled, password never expires, smart card required, trusted for delegation, and dozens more), pwdLastSet and lockoutTime for password policy enforcement, msDS-SupportedEncryptionTypes declaring which Kerberos encryption types the account supports, and altSecurityIdentities for storing certificate subject names and SSH public keys for certificate- and key-based authentication. Group Policy Objects (GPOs) are LDAP objects in the cn=Policies,cn=System container linked to sites, domains, or OUs; Windows clients process them at boot and login via the Group Policy Client service; Linux clients joined via SSSD and realmd do not process GPOs natively but can apply a subset of security policy through SSSD\u0026rsquo;s AD provider features.\nFor Linux infrastructure, AD integration is the dominant enterprise identity use case and SSSD with realmd is the standard integration path. realm join example.com performs the full join in one command: it discovers the nearest domain controller via DNS SRV records (_ldap._tcp.example.com, _kerberos._tcp.example.com), creates a machine account in AD, writes the Kerberos keytab to /etc/krb5.keytab, and configures SSSD with the ad provider. Once joined, Linux users authenticate with their AD username and password (or Kerberos ticket), group membership is resolved from AD, sudo rules can be stored in AD using the RFC 2307 schema extension or in FreeIPA trust mode, and HBAC (Host-Based Access Control) restricts which AD users may log in to which Linux hosts. AD Certificate Services (AD CS) provides the enterprise CA for issuing user and machine certificates, integrated with the AD identity store — user certificates issued by AD CS carry the user\u0026rsquo;s UPN in the SAN, enabling certificate-based authentication to Linux hosts via SSSD\u0026rsquo;s pam_cert_auth feature and FIDO2/smartcard login. Kerberos constrained delegation and resource-based constrained delegation (RBCD) allow AD-enrolled Linux services to impersonate users when accessing other Kerberos-protected services — the mechanism underlying gss-proxy and kerberised NFS, CIFS, and PostgreSQL authentication. The Azure AD / Microsoft Entra ID cloud identity service is a separate product that does not implement the same AD protocols (no LDAP, no Kerberos, no Group Policy) and integrates with Linux via OIDC/OAuth 2.0 through SSSD\u0026rsquo;s IdP provider or via the Microsoft Entra Linux agent rather than through the traditional AD domain join path.\n","externalUrl":null,"permalink":"/en/security/ad/","section":"Index","summary":"Active Directory (AD) is Microsoft’s enterprise directory and identity platform, first released with Windows 2000 and now the dominant identity provider in enterprise environments worldwide. It combines four technologies into a single integrated system: LDAP as the directory access protocol for querying and modifying identity data; Kerberos 5 as the authentication protocol for issuing tickets that prove identity without transmitting passwords; DNS as the service location mechanism that clients use to discover domain controllers, Kerberos KDCs, and LDAP servers; and Group Policy as the configuration management system that pushes security settings, software installation, and policy enforcement to every joined machine. These four components are inseparable in practice: a Linux host joining an AD domain receives a Kerberos principal in AD’s KDC, a machine account object in the AD LDAP directory, a DNS record for its hostname, and (optionally) Group Policy Objects applied to it. The AD forest is the trust boundary: multiple domains can exist within a forest and all share a common schema, configuration, and Global Catalog, with transitive Kerberos trust between them.\n","title":"AD (Active Directory)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/admission/","section":"Tags","summary":"","title":"Admission","type":"tags"},{"content":"AES (Advanced Encryption Standard), standardised as NIST FIPS 197 in 2001, is the symmetric block cipher that underlies virtually all data encryption in modern infrastructure. It was selected through a five-year open competition that evaluated 15 candidate algorithms; the winner, Rijndael (designed by Joan Daemen and Vincent Rijmen), became AES. A block cipher takes a fixed-size block of plaintext and a key and produces a fixed-size block of ciphertext — AES always operates on 128-bit (16-byte) blocks, regardless of key size. Three key lengths are standardised: AES-128 (128-bit key, 10 rounds), AES-192 (192-bit key, 12 rounds), and AES-256 (256-bit key, 14 rounds), providing 128, 192, and 256 bits of security respectively against classical attacks. AES-256 is the conservative choice for data with long confidentiality requirements and is mandated by CNSA 2.0 for national security systems; AES-128 is widely deployed in TLS and provides adequate security for most workloads. The internal structure — SubBytes, ShiftRows, MixColumns, AddRoundKey — is fully public and has withstood over two decades of cryptanalysis; the best known attacks against full-round AES are theoretical and computationally infeasible, requiring work far beyond brute force but not threatening practical security.\nA block cipher operating on raw 128-bit blocks is not directly useful for encrypting arbitrary-length data or for providing authentication. Modes of operation compose AES into schemes that handle arbitrary data and provide additional security properties. The dominant mode in modern deployments is AES-GCM (Galois/Counter Mode), an AEAD (Authenticated Encryption with Associated Data) construction that simultaneously encrypts data and produces a 128-bit authentication tag, using a keystream generated by running AES in counter mode. AES-GCM provides confidentiality, integrity, and authenticity in a single pass, is parallelisable (unlike CBC), and is hardware-accelerated on every modern CPU via AES-NI and CLMUL instructions. It is the cipher for TLS 1.3 (TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256), IPsec ESP, MACsec, WireGuard (via ChaCha20-Poly1305 as an alternative), and LUKS2. The critical operational constraint of AES-GCM is nonce uniqueness: AES-GCM is catastrophically broken if the same (key, nonce) pair is ever used to encrypt two different plaintexts — the authentication tag collapses and the keystream is exposed, allowing an adversary to recover plaintext and forge messages. The 96-bit GCM nonce must be unique per encryption with a given key; for high-throughput systems, nonce exhaustion (2^32 messages at 64-byte blocks before the 2^32 block limit becomes a concern) or random nonce collision (birthday-bound at ~2^48 with random 96-bit nonces) are real operational limits that drive AES key rotation policies. AES-GCM-SIV (RFC 8452) mitigates nonce-misuse risk by deriving a per-message subkey, providing security even if nonces are accidentally reused, at a modest performance cost. AES-CBC (Cipher Block Chaining) is a legacy mode without built-in authentication, historically dominant in TLS 1.2 and disk encryption but deprecated in TLS 1.3 and superseded by AES-XTS and AES-GCM for new deployments. AES-XTS (XEX-based Tweaked-codebook mode with ciphertext Stealing) is the standard mode for disk and storage encryption: it takes a 128-bit \u0026ldquo;tweak\u0026rdquo; (the disk sector number) as a second input, producing independent, parallelisable encryption per sector without an IV or authentication tag — the performance profile is right for block devices, though the absence of authentication means AES-XTS provides confidentiality only, not integrity.\nAES appears at every layer of the infrastructure stack in this glossary. TLS 1.3 uses AES-256-GCM or ChaCha20-Poly1305 for record encryption. LUKS2 encrypts block devices with AES-XTS-512 (two 256-bit subkeys) by default, selectable to AES-XTS-256. TDX and SEV-SNP encrypt confidential VM memory with AES-128-XTS (TDX) and AES-128-XEX (SEV) using per-VM keys managed by the CPU memory controller, at hardware speed with no software involvement. MACsec encrypts Ethernet frames with AES-GCM-128 or AES-GCM-256. IPsec ESP uses AES-GCM-128 or AES-GCM-256. HSMs use AES-256 for key wrapping (encrypting exported key material under a key-encryption key stored in the HSM). ML-KEM, ML-DSA, and SLH-DSA all use AES (or SHAKE) internally for pseudorandom generation in their parameter sets. Against quantum computers, AES is substantially more resilient than the asymmetric algorithms it works alongside: Grover\u0026rsquo;s algorithm provides a quadratic speedup for brute-forcing symmetric keys, halving the effective key length — AES-128 provides 64-bit quantum security (marginal), AES-256 provides 128-bit quantum security (considered safe). This is why the PQC transition replaces asymmetric algorithms entirely (RSA, ECDSA, ECDH → ML-KEM, ML-DSA) while retaining AES-256 as the symmetric layer, simply increasing key sizes where AES-128 was previously used.\n","externalUrl":null,"permalink":"/en/security/aes/","section":"Index","summary":"AES (Advanced Encryption Standard), standardised as NIST FIPS 197 in 2001, is the symmetric block cipher that underlies virtually all data encryption in modern infrastructure. It was selected through a five-year open competition that evaluated 15 candidate algorithms; the winner, Rijndael (designed by Joan Daemen and Vincent Rijmen), became AES. A block cipher takes a fixed-size block of plaintext and a key and produces a fixed-size block of ciphertext — AES always operates on 128-bit (16-byte) blocks, regardless of key size. Three key lengths are standardised: AES-128 (128-bit key, 10 rounds), AES-192 (192-bit key, 12 rounds), and AES-256 (256-bit key, 14 rounds), providing 128, 192, and 256 bits of security respectively against classical attacks. AES-256 is the conservative choice for data with long confidentiality requirements and is mandated by CNSA 2.0 for national security systems; AES-128 is widely deployed in TLS and provides adequate security for most workloads. The internal structure — SubBytes, ShiftRows, MixColumns, AddRoundKey — is fully public and has withstood over two decades of cryptanalysis; the best known attacks against full-round AES are theoretical and computationally infeasible, requiring work far beyond brute force but not threatening practical security.\n","title":"AES (Advanced Encryption Standard)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/agents/","section":"Tags","summary":"","title":"Agents","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ai/","section":"Tags","summary":"","title":"Ai","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ai-native/","section":"Tags","summary":"","title":"Ai-Native","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ai-ran/","section":"Tags","summary":"","title":"Ai-Ran","type":"tags"},{"content":"The AI-RAN Alliance is a global industry consortium, launched at MWC Barcelona in February 2024 and governed by a Technical Steering Committee (TSC), whose mission is to accelerate the integration of artificial intelligence into Radio Access Networks and to define what an AI-native RAN looks like in practice for 5G Advanced and 6G. The alliance deliberately positions itself as neither a marketing organisation nor a demo factory: it pursues pioneering, pre-competitive work — reference architectures, blueprints, and credible benchmarking — without getting mired in formal standards processes or IP negotiations. Its work spans three complementary objectives — AI-for-RAN (using AI/ML to improve RAN performance and efficiency), AI-and-RAN (co-locating RAN and AI workloads on shared accelerated infrastructure), and AI-on-RAN (hosting tenant-facing AI applications at the network edge for differentiated, monetisable connectivity). Founding members include Ericsson, Nokia, NVIDIA, T-Mobile, SoftBank, Samsung, AWS, Microsoft, and Arm; membership grew from a handful at launch to 130+ organisations by MWC 2026, spanning operators, NEPs, hyperscalers, silicon vendors, universities, and government research bodies across more than 17 countries.\nTechnical work is organised under the Technical Steering Committee (TSC) in three distinct layers — Working Groups (one per strategic pillar), Task Groups (cross-cutting specialist teams), and alliance-wide programmes — with a deliberate 2026 shift from scattered demos toward a deliverables engine with clearer ownership, timelines, and mandatory benchmarking plans.\nWorking Groups (three, aligned to the alliance pillars):\nWorking Group Scope AI-for-RAN AI/ML to improve RAN performance: air interface, channel estimation, radio resource management, energy efficiency, ISAC AI-and-RAN Shared infrastructure and orchestration: coexistence of RAN and AI workloads, MLOps, compute placement, interaction with O-RAN systems AI-on-RAN Edge AI applications on RAN infrastructure: differentiated connectivity, monetisation models, SLA-grade assurances Within the AI-for-RAN working group, the TSC clusters 20+ work items by RAN process timescale into three functional buckets: Air Interface \u0026amp; Signal Processing (sub-ms PHY); Resource \u0026amp; Mobility Control (10 ms → 1 s); and Network Operations \u0026amp; Automation (seconds to hours).\nTask Groups (cross-cutting, span all pillars):\nTask Group Scope Data-for-AI Data frameworks and methodologies for AI model training and inference Test Methodology Testing and validation frameworks through AI-RAN Alliance-Endorsed Labs Agentic AI (ATG) Agentic AI for autonomous network operations; open-source reference implementations Commercialization Business models, TAM/SAM analysis, and monetisation pathways for operators Programmes: RANPerf is an alliance-wide benchmarking initiative (not a working group) — every result is reported as an (algorithm, platform) pair against 3GPP-anchored test conditions, with mandatory benchmarking plans for WG demos and work items.\nArchitecturally, AI-RAN publishes reference architectures and industry blueprints, not normative interface specifications. The AI-and-RAN working group designs the AI-RAN platform — including monitoring, MLOps, distributed training, emulation frameworks, and an AI-RAN Workload Placement Function that dispatches RAN, AI-for-RAN, and AI-on-RAN workloads to optimal compute targets across edge, cloud, or data centre based on latency, cost, policy, and data sovereignty. A key architectural shift is decoupling AI-for-RAN from AI-on-RAN: RAN-internal AI optimisation and tenant-facing edge AI no longer share the same compute fate, enabling flexible orchestration by platform orchestrators and LLM routers. Relative positioning with O-RAN: the two alliances are complementary, not competing. O-RAN defines the open, interoperable RAN contract — SMO, Non-RT/Near-RT RIC, O-Cloud, O1/O2/A1/E2 — and publishes normative specifications for multi-vendor assurance. AI-RAN builds on that foundation by addressing what O-RAN does not fully specify: multi-tenant coexistence of generic AI workloads and RAN on shared GPU infrastructure, reproducible AI/ML benchmarking for RAN algorithms, and monetisation models for AI-at-the-edge. Overlap is explicit and intentional — the AI-and-RAN working group carries an active work item on interaction with O-RAN systems for orchestration and coexistence workflows — and spans RIC/xApp AI/ML, SMO-adjacent orchestration, O-Cloud resource management, and automated control loops. The division of labour remains: O-RAN specifies the open RAN contract; AI-RAN produces implementation blueprints, trial evidence, and benchmarked performance data on top of it. Two 2026 focus areas further illustrate the boundary: ISAC (Integrated Sensing and Communications) closes the implementation gap between 3GPP Rel-19 sensing KPIs and deployable AI-native sensing on shared RAN infrastructure, while the AI-RAN Security Framework addresses converged risks across the telecom control plane (RIC/E2/scheduler), AI/ML lifecycle (models, datasets, adversarial inputs), and accelerated cloud infra (Kubernetes, GPU isolation, MIG/MPS) — six vulnerability categories with proposed work items on threat modelling, secure RIC app lifecycle, GPU isolation validation, and telemetry integrity.\nMarket momentum has been rapid, but the alliance\u0026rsquo;s 2026 TSC direction emphasises execution discipline over headline demo counts. The RANPerf leaderboard — inspired by MLPerf and structured as mandatory (algorithm, platform) submissions against 3GPP-anchored channels (TR 38.901, TS 38.104), fixed datasets, and classical SoTA baselines — aims to solve the \u0026ldquo;apples-to-oranges\u0026rdquo; problem that has plagued AI/ML-in-RAN claims: reporting throughput, P99 slot latency, energy per bit, and compute consumption together so submissions cannot win on one KPI while losing on another. The AI-for-RAN working group mandates a benchmarking plan for every work item and demo; Alliance-endorsed labs provide reproducible test environments. At MWC 2026 the alliance presented 33 innovation demos and four industry blueprints, but the TSC acknowledged a persistent gap between theoretical outputs and real-world field validation — with live network trials (e.g. collaboration with South Korea\u0026rsquo;s AINA/MSIT) discussed as a flagship next step. The Call for Innovation has been narrowed to six focus areas — ISAC, Security, Agentic AI/Operations, Test \u0026amp; Benchmarking Frameworks, Network Energy Saving, and Physical AI Applications — signalling where the alliance will concentrate pre-competitive investment. Adoption remains earlier-stage than O-RAN\u0026rsquo;s specification and SCAS ecosystem: AI-RAN outputs are reference designs, blueprints, and leaderboard evidence, not conformance-testable standards. The alliance is best understood as the industry\u0026rsquo;s fast-moving innovation and benchmarking layer for AI-native RAN — bridging O-RAN\u0026rsquo;s open architecture, 3GPP\u0026rsquo;s radio specifications, and the practical deployment of AI across shared RAN infrastructure in the 6G era.\nAdditional Information # AI-RAN Alliance Publications Boosting AI-Driven Innovation in 6G with the AI-RAN Alliance, 3GPP, and O-RAN (NVIDIA Technical Blog) ","externalUrl":null,"permalink":"/en/telco/ai-ran-alliance/","section":"Index","summary":"The AI-RAN Alliance is a global industry consortium, launched at MWC Barcelona in February 2024 and governed by a Technical Steering Committee (TSC), whose mission is to accelerate the integration of artificial intelligence into Radio Access Networks and to define what an AI-native RAN looks like in practice for 5G Advanced and 6G. The alliance deliberately positions itself as neither a marketing organisation nor a demo factory: it pursues pioneering, pre-competitive work — reference architectures, blueprints, and credible benchmarking — without getting mired in formal standards processes or IP negotiations. Its work spans three complementary objectives — AI-for-RAN (using AI/ML to improve RAN performance and efficiency), AI-and-RAN (co-locating RAN and AI workloads on shared accelerated infrastructure), and AI-on-RAN (hosting tenant-facing AI applications at the network edge for differentiated, monetisable connectivity). Founding members include Ericsson, Nokia, NVIDIA, T-Mobile, SoftBank, Samsung, AWS, Microsoft, and Arm; membership grew from a handful at launch to 130+ organisations by MWC 2026, spanning operators, NEPs, hyperscalers, silicon vendors, universities, and government research bodies across more than 17 countries.\n","title":"AI-RAN Alliance","type":"telco"},{"content":"AIDE (Advanced Intrusion Detection Environment) is a host-based intrusion detection tool that implements file integrity monitoring (FIM): it builds a baseline database capturing cryptographic hashes and metadata for every file it is configured to watch, and on subsequent runs compares the live filesystem against that database, reporting anything that has been added, removed, or changed. Its security premise is detection after the fact: AIDE does not prevent modifications (that is the role of fapolicyd, SELinux, and IMA), but it provides a reliable, auditable record that modifications occurred, when a check was run, and which specific attributes changed. An attacker who compromises a system and modifies a binary, a configuration file, a cron job, or an SSH authorized_keys file will leave a fingerprint in the next AIDE check — provided the database has not also been compromised, which is the central operational concern the tool\u0026rsquo;s deployment model must address.\nAIDE\u0026rsquo;s configuration file (/etc/aide.conf on RHEL) defines the monitoring scope and the attribute groups to record. Each rule maps a path (literal or regular expression) to a named attribute group — a bitmask of properties to capture. The standard RHEL groups include: p (permissions), i (inode number), n (number of hard links), u (user/UID), g (group/GID), s (size), b (block count), m (mtime), c (ctime), a (atime), sha256 and sha512 (content hashes), acl (POSIX ACLs), xattrs (extended attributes including SELinux labels), and e2fsattrs (ext2/4 filesystem flags like immutable). A typical RHEL default rule watches /etc with all attributes including SHA-256 hash, /usr similarly, /boot fully, /var/log for additions only (since log files are expected to grow), and excludes high-churn directories like /var/spool, /tmp, and /proc to suppress noise. The attribute selection is a deliberate trade-off: capturing atime records every file read (very noisy, rarely useful), while capturing SHA-256 records content changes precisely at the cost of a full file read during each check run. The three-command operational lifecycle is: aide --init (build the baseline database at /var/lib/aide/aide.db.new.gz; the file is renamed to aide.db.gz before checks begin), aide --check (compare current filesystem against aide.db.gz and produce a report), and aide --update (re-scan and replace the database after legitimate changes have been reviewed and accepted). Checks are typically scheduled via cron or a systemd timer, and the resulting report sent to a central log or SIEM system.\nAIDE\u0026rsquo;s fundamental weakness is its offline, retrospective nature and the database trust problem. Unlike IMA, which uses the TPM to accumulate a tamper-evident runtime measurement log that cannot be silently modified without breaking the PCR chain, AIDE\u0026rsquo;s database is a file on the same filesystem it protects — an attacker with root access can modify the database to match their changes and the next AIDE check will report nothing. Mitigating this requires storing the reference database off-system: on a read-only NFS mount, in a version-controlled repository, on a write-once object store, or burned to optical media at baseline time, so that the comparison at check time uses a copy the attacker cannot reach. Similarly, AIDE cannot detect compromises that occurred before the baseline was captured: if the system was already tampered with at aide --init time, the database records the tampered state as the baseline. AIDE also does not detect in-memory-only attacks or modifications to files it is not configured to watch. These limitations define AIDE\u0026rsquo;s correct positioning in a defence stack: it is a scheduled, retrospective, file-level detection control that complements IMA\u0026rsquo;s continuous, TPM-anchored, runtime measurement, fapolicyd\u0026rsquo;s execution-time allowlisting, and SELinux\u0026rsquo;s behavioural confinement — each covering a different dimension of the same integrity problem. AIDE is a STIG and CIS Benchmark requirement for RHEL servers, satisfying NIST SP 800-53 SI-7 (Software, Firmware, and Information Integrity) and PCI DSS Requirement 11.5, and is configurable at fleet scale via the aide RHEL Ansible system role.\n","externalUrl":null,"permalink":"/en/security/aide/","section":"Index","summary":"AIDE (Advanced Intrusion Detection Environment) is a host-based intrusion detection tool that implements file integrity monitoring (FIM): it builds a baseline database capturing cryptographic hashes and metadata for every file it is configured to watch, and on subsequent runs compares the live filesystem against that database, reporting anything that has been added, removed, or changed. Its security premise is detection after the fact: AIDE does not prevent modifications (that is the role of fapolicyd, SELinux, and IMA), but it provides a reliable, auditable record that modifications occurred, when a check was run, and which specific attributes changed. An attacker who compromises a system and modifies a binary, a configuration file, a cron job, or an SSH authorized_keys file will leave a fingerprint in the next AIDE check — provided the database has not also been compromised, which is the central operational concern the tool’s deployment model must address.\n","title":"AIDE (Advanced Intrusion Detection Environment)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/aiops/","section":"Tags","summary":"","title":"Aiops","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/allowlisting/","section":"Tags","summary":"","title":"Allowlisting","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/amd/","section":"Tags","summary":"","title":"Amd","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/amf/","section":"Tags","summary":"","title":"Amf","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/android/","section":"Tags","summary":"","title":"Android","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/anssi/","section":"Tags","summary":"","title":"Anssi","type":"tags"},{"content":"SecNumCloud is a security qualification (\u0026ldquo;Visa de sécurité\u0026rdquo;) issued by ANSSI (Agence Nationale de la Sécurité des Systèmes d\u0026rsquo;Information), France\u0026rsquo;s national cybersecurity agency. Created in 2016 and currently in version 3.2 (published March 2022), it is the most demanding cloud security standard in France. SecNumCloud applies to cloud service providers offering IaaS, PaaS, SaaS, or CaaS (Container as a Service) and evaluates them against 354 requirements organized across 15 chapters (chapters 5–19) structured on ISO/IEC 27002:2013 Annex A (chapters 5–18: security policies, organization, HR security, asset management, access control, cryptography, physical security, operational security, communications security, system acquisition/development/maintenance, supplier relationships, incident management, business continuity, conformity) plus an additional chapter 19 with sovereignty-specific requirements (data localization, reversibility, and protection from extraterritorial law). The qualification is voluntary in principle — no law forces all cloud providers to obtain it — but it is effectively mandatory for providers serving French public administration, Opérateurs d\u0026rsquo;Importance Vitale (OIV), and entities handling sensitive government data, as French procurement policy (the \u0026ldquo;doctrine cloud de confiance\u0026rdquo;) requires the use of SecNumCloud-qualified providers. Version 3.2\u0026rsquo;s most significant addition is chapter 19.6, which mandates that qualified providers be headquartered in the EU, owned by European entities (individual non-EU shareholding ≤24 %, collective ≤39 %), and be immune from non-European extraterritorial legislation such as the US CLOUD Act or FISA. SecNumCloud is the model upon which France advocates for the \u0026ldquo;high+sovereignty\u0026rdquo; tier in the EU-wide EUCS scheme. Qualification is valid for 3 years with annual audits conducted by PASSI-accredited assessors.\nRed Hat is not itself a cloud service provider seeking SecNumCloud qualification, but it is a technology enabler for providers who are. The most notable Red Hat integration in the SecNumCloud ecosystem is Cloud Temple, which in 2024 became the first French provider to achieve SecNumCloud 3.2 qualification for a PaaS offering based on Red Hat OpenShift — enabling clients to run sensitive containerized workloads on a qualified platform. Cloud Temple (part of Neurones group, winner of the Red Hat Innovation Award France 2024) leverages OpenShift as its strategic platform for accelerating digital transformation through CI/CD pipelines, integrated operators, and container orchestration. Other qualified providers (OVHcloud, 3DS Outscale, S3NS) use different technology stacks — OVHcloud builds on OpenStack with its own integrated software layer, for instance — so Red Hat is not universal across all SecNumCloud providers. Red Hat\u0026rsquo;s technical capabilities map directly to SecNumCloud chapter requirements: for chapter 10 (Cryptologie), RHEL provides system-wide crypto policies and FIPS-capable modules; for chapter 9 (Contrôle d\u0026rsquo;accès), SELinux provides mandatory access control and environment isolation; for chapter 12 (Sécurité liée à l\u0026rsquo;exploitation), the Compliance Operator and OpenSCAP enable automated conformity checks against ANSSI\u0026rsquo;s hardening guides; and for chapter 19.6 (Protection vis-à-vis du droit extra-européen), Red Hat\u0026rsquo;s open-source model means providers can inspect and verify the entire software stack without dependency on opaque proprietary components. For organizations building SecNumCloud-qualified offerings on Red Hat, the \u0026ldquo;composability\u0026rdquo; principle in version 3.2 is key — a SaaS provider deploying on a SecNumCloud-qualified OpenShift platform (such as Cloud Temple\u0026rsquo;s) can focus its qualification efforts on its application layer rather than re-certifying the entire infrastructure.\nAdditional Information # ANSSI SecNumCloud FAQ SecNumCloud referential v3.2 - ANSSI List of SecNumCloud-qualified providers - ANSSI ","externalUrl":null,"permalink":"/en/compliance/secnumcloud/","section":"Index","summary":"SecNumCloud is a security qualification (“Visa de sécurité”) issued by ANSSI (Agence Nationale de la Sécurité des Systèmes d’Information), France’s national cybersecurity agency. Created in 2016 and currently in version 3.2 (published March 2022), it is the most demanding cloud security standard in France. SecNumCloud applies to cloud service providers offering IaaS, PaaS, SaaS, or CaaS (Container as a Service) and evaluates them against 354 requirements organized across 15 chapters (chapters 5–19) structured on ISO/IEC 27002:2013 Annex A (chapters 5–18: security policies, organization, HR security, asset management, access control, cryptography, physical security, operational security, communications security, system acquisition/development/maintenance, supplier relationships, incident management, business continuity, conformity) plus an additional chapter 19 with sovereignty-specific requirements (data localization, reversibility, and protection from extraterritorial law). The qualification is voluntary in principle — no law forces all cloud providers to obtain it — but it is effectively mandatory for providers serving French public administration, Opérateurs d’Importance Vitale (OIV), and entities handling sensitive government data, as French procurement policy (the “doctrine cloud de confiance”) requires the use of SecNumCloud-qualified providers. Version 3.2’s most significant addition is chapter 19.6, which mandates that qualified providers be headquartered in the EU, owned by European entities (individual non-EU shareholding ≤24 %, collective ≤39 %), and be immune from non-European extraterritorial legislation such as the US CLOUD Act or FISA. SecNumCloud is the model upon which France advocates for the “high+sovereignty” tier in the EU-wide EUCS scheme. Qualification is valid for 3 years with annual audits conducted by PASSI-accredited assessors.\n","title":"ANSSI SecNumCloud","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/api/","section":"Tags","summary":"","title":"Api","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/apparmor/","section":"Tags","summary":"","title":"Apparmor","type":"tags"},{"content":"AppArmor (Application Armor) is a Mandatory Access Control (MAC) system implemented as a major LSM (Linux Security Module), developed originally by Immunix and now maintained by Canonical. It is the default MAC system on Ubuntu, Debian, and their derivatives, and the default container confinement mechanism for containerd and Docker on those distributions. Where SELinux assigns security labels to every object on the system and enforces policy based on label interactions, AppArmor takes a fundamentally different approach: it confines programs by filesystem path. A profile for nginx lists the specific file paths that nginx is allowed to read, write, and execute, the network operations it may perform, and the Linux capabilities it may use — anything not listed is denied. No relabelling of the filesystem is required and no extended attributes are set: AppArmor\u0026rsquo;s confinement decisions are made purely from the path of the file being accessed and the identity of the confined process. This path-based model makes AppArmor profiles far simpler to read, write, and audit than SELinux policy, and eliminates the mislabelled-file failure mode that is the most common SELinux operational problem.\nAn AppArmor profile is a text file, typically stored in /etc/apparmor.d/, that specifies confinement rules for a single program identified by its executable path. Profile syntax covers: file rules (path patterns, optionally using globbing, with a permission set — r read, w write, x execute, m memory-map, k lock, l link — for example /var/log/nginx/** rw); capability rules (which Linux capabilities the process may use, e.g. capability net_bind_service); network rules (address families and socket types permitted, e.g. network inet tcp); signal rules (which signals the confined process may send and to which domains); and mount rules (which filesystem mounts are permitted). Profile transitions allow a confined process to execute a child process in a different profile, or to transition to a sub-profile for fine-grained control over helper programs. Profiles operate in one of two modes: enforce (violations are blocked and logged to the kernel audit subsystem, visible via dmesg and journalctl) and complain (violations are logged but not blocked, used to profile new applications and tune profiles before enforcement). AppArmor profiles are loaded into the kernel via apparmor_parser and the status of all loaded profiles is visible via aa-status.\nIn Kubernetes and container environments, AppArmor profiles must be pre-loaded on each node — they are not distributed with the workload manifest — and are referenced in a pod spec via securityContext.appArmorProfile (Kubernetes 1.30+, previously via annotation). Container runtimes ship a built-in docker-default / cri-containerd.apparmor.d profile that blocks the most dangerous operations (writes to /proc/sys, mount, ptrace of processes outside the container, several dangerous capabilities) while permitting everything a typical containerised application needs; this profile is applied automatically unless overridden. Custom profiles on Kubernetes nodes are typically deployed via a DaemonSet or the Security Profiles Operator. The fundamental limitation of AppArmor\u0026rsquo;s path-based model is bind mounts and overlayfs: a file accessed via a different path than the profile expects — common with container volume mounts and overlay filesystem upper layers — may not match the profile\u0026rsquo;s path rules and will either be incorrectly allowed or denied. SELinux does not have this problem because its labels are stored on the inode, not derived from the path. In practice, this means AppArmor profiles for containers require careful attention to the paths the container runtime constructs inside the overlay filesystem (/run/containerd/..., overlay upper dirs) to avoid both over-permission and spurious denials. BPF LSM can be stacked alongside AppArmor on the same system to add programmatic per-workload policy on top of AppArmor\u0026rsquo;s profile-based confinement without replacing it.\n","externalUrl":null,"permalink":"/en/security/apparmor/","section":"Index","summary":"AppArmor (Application Armor) is a Mandatory Access Control (MAC) system implemented as a major LSM (Linux Security Module), developed originally by Immunix and now maintained by Canonical. It is the default MAC system on Ubuntu, Debian, and their derivatives, and the default container confinement mechanism for containerd and Docker on those distributions. Where SELinux assigns security labels to every object on the system and enforces policy based on label interactions, AppArmor takes a fundamentally different approach: it confines programs by filesystem path. A profile for nginx lists the specific file paths that nginx is allowed to read, write, and execute, the network operations it may perform, and the Linux capabilities it may use — anything not listed is denied. No relabelling of the filesystem is required and no extended attributes are set: AppArmor’s confinement decisions are made purely from the path of the file being accessed and the identity of the confined process. This path-based model makes AppArmor profiles far simpler to read, write, and audit than SELinux policy, and eliminates the mislabelled-file failure mode that is the most common SELinux operational problem.\n","title":"AppArmor (Application Armor)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/artifacts/","section":"Tags","summary":"","title":"Artifacts","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/attention/","section":"Tags","summary":"","title":"Attention","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/attestation/","section":"Tags","summary":"","title":"Attestation","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/audit/","section":"Tags","summary":"","title":"Audit","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/authentication/","section":"Tags","summary":"","title":"Authentication","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/authorisation/","section":"Tags","summary":"","title":"Authorisation","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/automation/","section":"Tags","summary":"","title":"Automation","type":"tags"},{"content":"Autonomous Networks (AN) describe an operator evolution path toward networks that configure, optimise, secure, and heal themselves with minimal manual intervention — expressed as closed loops (sense → analyse → decide → act) spanning RAN, transport, core, and cloud infrastructure. The concept is not a single product but a maturity model: TM Forum defines Autonomous Networks Levels (ANL 0–5), from fully manual operation (L0) through assisted and partial automation (L1–L3) to high and full autonomy (L4–L5) where intent (business or service goals) is translated into technical policies and executed with human oversight only for exceptions. GSMA and major operators (e.g. TM Forum AN Leadership Council participants) align roadmaps on high autonomy by ~2027–2030 for selected domains (energy saving, fault recovery, capacity management) rather than overnight “lights-out” operations.\nTechnically, autonomy composes telemetry (PM/FM, streaming, distributed traces), analytics and AI/ML (NWDAF in 5GC, O-RAN RIC rApps/xApps, vendor SON), orchestration (Kubernetes, ONAP, TM Forum Open Digital Architecture), and policy/intent engines that map SLAs to configuration changes validated in digital twins or sandboxes before production actuation. Intent-Based Networking (IBN) APIs express what is required (latency, availability, coverage) while closed loops determine how (tilt, power, routing, scaling). Zero-Touch Provisioning and Management (ZTP, ZSM — ETSI) provide reference architectures for service and network management automation. Risks — model drift, unsafe actuation, opaque AI decisions — drive requirements for explainability, rollback, and human-in-the-loop gates at lower maturity levels.\nCommercial adoption is uneven by domain: RAN energy optimisation and anomaly detection are among the earliest production closed loops; end-to-end service provisioning across multi-vendor stacks remains largely L2–L3. Autonomous Networks intersect heavily with Open RAN (programmable RIC), cloud-native 5GC (NWDAF, closed-loop NFs), and AIOps in IT/cloud operations — but organisational silos (RAN vs core vs IT) often limit cross-domain autonomy more than technology does.\nAdditional Information # TM Forum Autonomous Networks ETSI ZSM (Zero-touch network and Service Management) GSMA Network Automation ","externalUrl":null,"permalink":"/en/telco/autonomous-networks/","section":"Index","summary":"Autonomous Networks (AN) describe an operator evolution path toward networks that configure, optimise, secure, and heal themselves with minimal manual intervention — expressed as closed loops (sense → analyse → decide → act) spanning RAN, transport, core, and cloud infrastructure. The concept is not a single product but a maturity model: TM Forum defines Autonomous Networks Levels (ANL 0–5), from fully manual operation (L0) through assisted and partial automation (L1–L3) to high and full autonomy (L4–L5) where intent (business or service goals) is translated into technical policies and executed with human oversight only for exceptions. GSMA and major operators (e.g. TM Forum AN Leadership Council participants) align roadmaps on high autonomy by ~2027–2030 for selected domains (energy saving, fault recovery, capacity management) rather than overnight “lights-out” operations.\n","title":"Autonomous Networks","type":"telco"},{"content":"","externalUrl":null,"permalink":"/en/tags/autonomous-networks/","section":"Tags","summary":"","title":"Autonomous-Networks","type":"tags"},{"content":"A bastion host (also called a jump server or jump host) is a hardened server placed at the boundary between a public network and a protected private network, through which all administrative access to internal systems must pass. Rather than exposing every server, database, or network device directly to the internet or to operator workstations, the network is designed so that only the bastion host has a publicly reachable address; internal systems accept SSH or RDP connections only from the bastion\u0026rsquo;s IP. An administrator who needs to reach an internal host connects first to the bastion — authenticating with a key, certificate, or MFA — and then hops onward to the target from there. The bastion\u0026rsquo;s narrow exposure makes it a concentrated target, which is why it receives disproportionate hardening: a minimal OS with only the necessary services running, strict firewall rules, aggressive patch cadence, and comprehensive session logging. The name comes from military fortification: a bastion is a protruding element of a castle wall designed to be defended at all costs.\nThe bastion model enforces two security properties that are otherwise difficult to achieve at scale. First, auditability: because every administrative connection flows through a single point, every session can be logged, recorded, and attributed to an individual — there is no path by which an operator can reach a production system without the bastion capturing the traffic. Second, attack surface reduction: internal hosts have no externally routable addresses and no open administrative ports facing the internet, so the only attack vector into the administrative plane is the bastion itself. Network segmentation rules enforce this geometrically: a misconfigured internal host that accidentally opens a port is still not reachable from the internet because the security group or firewall only permits ingress from the bastion\u0026rsquo;s address. The trade-off is that the bastion becomes a critical single point of failure for access and a high-value target — a compromised bastion is a compromised administrative plane.\nModern infrastructure has evolved the bastion concept in two directions. PAM platforms (CyberArk, BeyondTrust, Teleport, and others) replace or augment the raw SSH jump host with a structured access management layer: session recording, credential injection (the operator never sees the target password), RBAC-based authorization, and time-bound access grants. Zero Trust Network Access (ZTNA) solutions replace the network-layer bastion model entirely: instead of a single hardened perimeter hop, each connection is individually authenticated, authorised, and encrypted between the operator\u0026rsquo;s device and the specific target resource, with no implicit trust granted to anything on the same network segment. Both directions preserve the bastion\u0026rsquo;s core intent — no unmediated administrative access to production systems — while eliminating the single point of failure and the permanent standing access that a traditional bastion implies. In cloud environments, managed bastion services (AWS Systems Manager Session Manager, Azure Bastion) remove the need to operate a bastion host at all by proxying SSH and RDP sessions through the cloud control plane without requiring any open inbound ports.\n","externalUrl":null,"permalink":"/en/security/bastion/","section":"Index","summary":"A bastion host (also called a jump server or jump host) is a hardened server placed at the boundary between a public network and a protected private network, through which all administrative access to internal systems must pass. Rather than exposing every server, database, or network device directly to the internet or to operator workstations, the network is designed so that only the bastion host has a publicly reachable address; internal systems accept SSH or RDP connections only from the bastion’s IP. An administrator who needs to reach an internal host connects first to the bastion — authenticating with a key, certificate, or MFA — and then hops onward to the target from there. The bastion’s narrow exposure makes it a concentrated target, which is why it receives disproportionate hardening: a minimal OS with only the necessary services running, strict firewall rules, aggressive patch cadence, and comprehensive session logging. The name comes from military fortification: a bastion is a protruding element of a castle wall designed to be defended at all costs.\n","title":"Bastion Host (Jump Server)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/benchmarking/","section":"Tags","summary":"","title":"Benchmarking","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/bios/","section":"Tags","summary":"","title":"Bios","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/bluefield/","section":"Tags","summary":"","title":"Bluefield","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/boot/","section":"Tags","summary":"","title":"Boot","type":"tags"},{"content":"bootc is a CNCF sandbox project, created by Colin Walters, that applies the OCI container model to operating system delivery. Where conventional container images package an application to run inside a host OS, a bootc image packages the entire OS — kernel (under /usr/lib/modules), initrd, systemd units, firmware, and all userspace — as a standard OCI image that can be built with podman build or buildah, stored in any OCI-conformant registry, signed with standard supply chain tools, and pulled to a machine where it becomes the running system. At runtime the base OS is not running inside a container; systemd is pid 1 as usual. The container image format is purely a transport and build model, not an execution model.\nThe filesystem layout on a deployed bootc system reflects its immutability goals. /usr is mounted read-only, enforced at the kernel level via composefs: the ostree composefs backend mounts the OS tree as a verified, content-addressed filesystem so that any modification to a file — whether deliberate or from bit-rot — produces an I/O error rather than silent corruption. /etc and /var remain writable for local configuration and state. Updates work by pulling a new image version from the registry in the background; the new deployment is staged into the ostree object store and activated on the next reboot, with the previous deployment retained for instant rollback via bootc rollback. Disk images for initial provisioning (ISO, qcow2, AMI) are generated from bootc images using bootc-image-builder, which partitions the disk using the UAPI Discoverable Partitions Specification so that systemd can auto-discover and mount partitions without explicit configuration.\nThe security story is where bootc connects the rest of this glossary. Because the entire OS is a signed OCI artifact pulled from a registry, the OS image is subject to the same supply chain verification as application containers — cosign signatures, SBOMs, attestations via the OCI referrers API. At the boot level, active work integrates UKI-based measured boot so that the composefs root digest — which commits the entire OS tree — is embedded in the UKI kernel command line and therefore covered by the UKI\u0026rsquo;s Secure Boot signature and TPM PCR measurements. This creates an end-to-end chain: the LUKS volume key is sealed to PCR values that include the composefs digest, so the disk only unlocks automatically when the system has booted exactly the signed OS image enrolled at provisioning time. For CoCo and confidential computing scenarios, the same composefs digest feeds into the TEE\u0026rsquo;s attestation report — a TDX RTMR or SEV-SNP launch measurement — allowing a remote relying party to verify not just that a TEE is genuine hardware but that the specific, unmodified OS image it is running is the one the workload owner approved.\n","externalUrl":null,"permalink":"/en/security/bootc/","section":"Index","summary":"bootc is a CNCF sandbox project, created by Colin Walters, that applies the OCI container model to operating system delivery. Where conventional container images package an application to run inside a host OS, a bootc image packages the entire OS — kernel (under /usr/lib/modules), initrd, systemd units, firmware, and all userspace — as a standard OCI image that can be built with podman build or buildah, stored in any OCI-conformant registry, signed with standard supply chain tools, and pulled to a machine where it becomes the running system. At runtime the base OS is not running inside a container; systemd is pid 1 as usual. The container image format is purely a transport and build model, not an execution model.\n","title":"bootc (Bootable Containers)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/bootloader/","section":"Tags","summary":"","title":"Bootloader","type":"tags"},{"content":"A break-glass user (or break-glass account, emergency access account) is a privileged account that exists outside the normal access control workflow — bypassing PAM approval gates, MFA requirements, or SSO dependencies — and is reserved for situations where those normal mechanisms are themselves unavailable or would prevent responding to a critical incident in time. The name is a physical analogy: like the fire alarm panel behind a pane of glass that reads break glass in emergency, the account is designed so that accessing it requires a deliberate, detectable act. It is not a convenience mechanism; it is an organisational safety net for scenarios such as an identity provider outage locking all administrators out of their own infrastructure, a PAM platform failing during an active incident, or a ransomware attack disabling the tooling needed to contain it.\nThe defining properties of a well-designed break-glass account are immediate detectability, attributability, and post-use discipline. Immediate detectability means that any use of the account — including failed attempts — triggers real-time alerts to security operations, senior leadership, and the incident response chain, regardless of the state of other monitoring systems; the alert path must be independent of the systems the account might be used to access, since those may themselves be impaired. Attributability means the account is not a shared anonymous credential: it is checked out from a sealed store (a physical safe, a sealed envelope, a tightly controlled vault entry) by a named individual under documented circumstances, so that every action taken during the break-glass session can be traced to a specific person and a specific incident timeline. Post-use discipline means that once the emergency is resolved, the credential is immediately rotated or destroyed, the session recording and audit log are reviewed, the reason for use is formally documented, and a retrospective determines whether normal controls should have handled the situation and what process change would prevent the next break-glass activation — the goal being that break-glass events become rare enough that each one is individually memorable.\nBreak-glass accounts sit in deliberate tension with the zero-standing-privilege principle that PAM and just-in-time access are designed to enforce: they are, by construction, standing privileges outside normal oversight. This tension is managed through strict scope limitation (one account per critical system or control plane, as few as possible), physical or multi-party access controls on the credential itself (sealed envelope requiring two people, HSM-backed secret requiring dual approval even in an emergency), regular testing (quarterly drills to verify the account still works and alerts fire correctly), and treating every activation as an incident in its own right regardless of the reason for activation. In cloud environments, identity providers and cloud platforms provide first-class break-glass patterns: Azure Entra ID defines emergency access accounts as accounts excluded from all Conditional Access policies, stored with their credentials in a physically secured location, monitored via a dedicated sign-in alert. The Kubernetes equivalent is a static kubeconfig with a certificate-authenticated cluster-admin binding stored offline, for use when the API server\u0026rsquo;s normal authentication backends are unavailable.\n","externalUrl":null,"permalink":"/en/security/break-glass/","section":"Index","summary":"A break-glass user (or break-glass account, emergency access account) is a privileged account that exists outside the normal access control workflow — bypassing PAM approval gates, MFA requirements, or SSO dependencies — and is reserved for situations where those normal mechanisms are themselves unavailable or would prevent responding to a critical incident in time. The name is a physical analogy: like the fire alarm panel behind a pane of glass that reads break glass in emergency, the account is designed so that accessing it requires a deliberate, detectable act. It is not a convenience mechanism; it is an organisational safety net for scenarios such as an identity provider outage locking all administrators out of their own infrastructure, a PAM platform failing during an active incident, or a ransomware attack disabling the tooling needed to contain it.\n","title":"Break-Glass User (Emergency Access Account)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/bsi/","section":"Tags","summary":"","title":"Bsi","type":"tags"},{"content":"The BSI C5 (Cloud Computing Compliance Criteria Catalogue) is a German federal standard published by the BSI that defines minimum security requirements for cloud service providers. First released in 2016, the catalogue has undergone two major revisions: C5:2020 and the current C5:2026 (published 7 April 2026, replacing C5:2020). C5:2026 contains 168 criteria (up from 121 in C5:2020, a 39 % increase) structured across 17 domains aligned with ISO/IEC 27001 Annex A. The new version introduces a sub-criteria structure aligned with the European EUCS scheme, and adds five major new requirement areas: Confidential Computing (OPS-32/33: documented policies for Trusted Execution Environments and technical implementation of Remote Attestation), Container Management (OPS-34/35: lifecycle security for containerized workloads), Post-Quantum Cryptography (inventory of cryptographic assets and migration plan to quantum-resistant algorithms), AI transparency (disclosure of AI use in internal control systems), and Supply Chain Security (SBOM requirements, documented sub-processor audits). The catalogue is published in machine-readable YAML format for the first time. C5 is designed as an attestation standard (not a certification): providers undergo a Type 2 audit by an independent auditing firm (under IDW PS 880 or ISAE 3000), which verifies both the design and operational effectiveness of security controls over a period of at least six months. C5 is now effectively mandatory in two key domains: since 1 July 2025, cloud providers processing healthcare data must hold a valid C5 Type 2 attestation under §393 SGB V (Social Code, Fifth Book), and the revised BSI-KritisV (2024) requires KRITIS operators to use C5-attested cloud services in security-relevant contexts. Public-sector procurement in Germany also increasingly demands C5 attestation. C5:2026 becomes mandatory on 1 June 2027 for all audit periods starting on or after that date. During the transition: C5:2020 audits remain valid without additional requirements until 28 February 2027; between 28 February and 31 May 2027, C5:2020 is still permitted but requires a transition roadmap to C5:2026 in the system description.\nRed Hat enables cloud service providers and their customers to satisfy C5 requirements at the platform layer — and is particularly well-positioned for the new C5:2026 requirements. For the new Confidential Computing criteria (OPS-32/33): Red Hat OpenShift sandboxed containers with Trustee provide exactly the TEE and Remote Attestation capabilities C5:2026 demands, allowing CSPs to demonstrate hardware-enforced data-in-use protection with cryptographically verified execution environments. For Container Management (OPS-34/35): the OpenShift Compliance Operator, RHACS image scanning, and the Trusted Software Supply Chain portfolio address the full container lifecycle security requirements. For Post-Quantum Cryptography: RHEL\u0026rsquo;s crypto-agile architecture and system-wide cryptographic policies enable providers to inventory their cryptographic usage and plan migration paths. For the established C5 criteria, Red Hat covers cryptography (domain 10) with FIPS 140-3 validated modules; operations security (domain 12) with the Compliance Operator, Ansible for automated hardening, and RHACS for runtime threat detection; and supplier relationships (domain 15) with SBOMs, Sigstore artifact signing, and CSAF/VEX vulnerability feeds — directly satisfying C5:2026\u0026rsquo;s new SBOM mandate. C5\u0026rsquo;s corresponding criteria (Korrespondierende Kriterien), which define the cloud customer\u0026rsquo;s responsibilities at the interface with the provider, are also relevant: Red Hat\u0026rsquo;s documentation of shared responsibility models for OpenShift Dedicated and ROSA helps customers understand exactly which C5 controls they inherit from the provider versus those they must implement themselves. For German healthcare organizations subject to the §393 SGB V mandate, running workloads on a C5-attested cloud infrastructure built on RHEL and OpenShift provides a clear compliance path.\nAdditional Information # BSI C5:2026 - Official BSI C5 Criteria Catalogue - Overview Digital-Gesetz and C5 requirements - KPMG ","externalUrl":null,"permalink":"/en/compliance/bsi-c5/","section":"Index","summary":"The BSI C5 (Cloud Computing Compliance Criteria Catalogue) is a German federal standard published by the BSI that defines minimum security requirements for cloud service providers. First released in 2016, the catalogue has undergone two major revisions: C5:2020 and the current C5:2026 (published 7 April 2026, replacing C5:2020). C5:2026 contains 168 criteria (up from 121 in C5:2020, a 39 % increase) structured across 17 domains aligned with ISO/IEC 27001 Annex A. The new version introduces a sub-criteria structure aligned with the European EUCS scheme, and adds five major new requirement areas: Confidential Computing (OPS-32/33: documented policies for Trusted Execution Environments and technical implementation of Remote Attestation), Container Management (OPS-34/35: lifecycle security for containerized workloads), Post-Quantum Cryptography (inventory of cryptographic assets and migration plan to quantum-resistant algorithms), AI transparency (disclosure of AI use in internal control systems), and Supply Chain Security (SBOM requirements, documented sub-processor audits). The catalogue is published in machine-readable YAML format for the first time. C5 is designed as an attestation standard (not a certification): providers undergo a Type 2 audit by an independent auditing firm (under IDW PS 880 or ISAE 3000), which verifies both the design and operational effectiveness of security controls over a period of at least six months. C5 is now effectively mandatory in two key domains: since 1 July 2025, cloud providers processing healthcare data must hold a valid C5 Type 2 attestation under §393 SGB V (Social Code, Fifth Book), and the revised BSI-KritisV (2024) requires KRITIS operators to use C5-attested cloud services in security-relevant contexts. Public-sector procurement in Germany also increasingly demands C5 attestation. C5:2026 becomes mandatory on 1 June 2027 for all audit periods starting on or after that date. During the transition: C5:2020 audits remain valid without additional requirements until 28 February 2027; between 28 February and 31 May 2027, C5:2020 is still permitted but requires a transition roadmap to C5:2026 in the system description.\n","title":"BSI C5","type":"compliance"},{"content":"BSI IT-Grundschutz is Germany\u0026rsquo;s national framework for establishing, implementing, and certifying an Information Security Management System (ISMS). It is developed and maintained by the BSI (Bundesamt für Sicherheit in der Informationstechnik) and stands out from generic standards like ISO/IEC 27001 by its extreme level of prescriptive detail — the IT-Grundschutz Compendium contains hundreds of specific security building blocks (\u0026ldquo;Bausteine\u0026rdquo;) covering technical, organizational, infrastructure, and personnel aspects. The framework is defined across four BSI Standards: 200-1 (ISMS requirements), 200-2 (methodology with three approaches: Basis-Absicherung, Standard-Absicherung, Kern-Absicherung), 200-3 (risk analysis), and 200-4 (business continuity management). Organizations can pursue ISO 27001 certification based on IT-Grundschutz, which is recognized as equivalent to standalone ISO 27001 but with the added rigor of the BSI\u0026rsquo;s detailed control catalog. Compliance is mandatory for German federal agencies (Bundesbehörden) under the UP Bund framework and is strongly recommended — often contractually required — for KRITIS operators and public-sector contractors. A major modernization is underway: Grundschutz++, introduced in 2025–2026, replaces the traditional PDF-based building blocks with OSCAL/JSON machine-readable catalogs, aligning with the NIS2 implementation requirement for a BSI-defined \u0026ldquo;state of the art.\u0026rdquo; The classic IT-Grundschutz remains valid for audits until end of 2028.\nRed Hat\u0026rsquo;s software is widely deployed in German public administration and KRITIS environments where IT-Grundschutz compliance is either mandatory or contractually required. Red Hat supports IT-Grundschutz implementation at multiple layers. At the operating system level, RHEL provides pre-built OpenSCAP security profiles that map to BSI hardening requirements, system-wide cryptographic policies (supporting the BSI\u0026rsquo;s TR-02102 cryptographic recommendations), and SELinux confinement that implements the least-privilege principle central to Grundschutz building blocks. At the platform level, the OpenShift Compliance Operator automates continuous scanning against defined security profiles and can remediate drift — a critical capability for maintaining the ongoing compliance posture that IT-Grundschutz certification demands (not just point-in-time audits). For the transition to Grundschutz++, Red Hat\u0026rsquo;s investment in OSCAL-based compliance tooling (the complyctl CLI and Kubernetes-native toolkit) is directly aligned: both the BSI\u0026rsquo;s new framework and Red Hat\u0026rsquo;s compliance automation use OSCAL as the data format for expressing and validating security controls, enabling automated evidence generation for BSI audits. Ansible Automation Platform further supports IT-Grundschutz by codifying security configurations as repeatable playbooks, providing the documented, reproducible implementation evidence that auditors expect.\nAdditional Information # BSI IT-Grundschutz - Official IT-Grundschutz Compendium BSI Standards 200-1, 200-2, 200-3 ","externalUrl":null,"permalink":"/en/compliance/bsi-it-grundschutz/","section":"Index","summary":"BSI IT-Grundschutz is Germany’s national framework for establishing, implementing, and certifying an Information Security Management System (ISMS). It is developed and maintained by the BSI (Bundesamt für Sicherheit in der Informationstechnik) and stands out from generic standards like ISO/IEC 27001 by its extreme level of prescriptive detail — the IT-Grundschutz Compendium contains hundreds of specific security building blocks (“Bausteine”) covering technical, organizational, infrastructure, and personnel aspects. The framework is defined across four BSI Standards: 200-1 (ISMS requirements), 200-2 (methodology with three approaches: Basis-Absicherung, Standard-Absicherung, Kern-Absicherung), 200-3 (risk analysis), and 200-4 (business continuity management). Organizations can pursue ISO 27001 certification based on IT-Grundschutz, which is recognized as equivalent to standalone ISO 27001 but with the added rigor of the BSI’s detailed control catalog. Compliance is mandatory for German federal agencies (Bundesbehörden) under the UP Bund framework and is strongly recommended — often contractually required — for KRITIS operators and public-sector contractors. A major modernization is underway: Grundschutz++, introduced in 2025–2026, replaces the traditional PDF-based building blocks with OSCAL/JSON machine-readable catalogs, aligning with the NIS2 implementation requirement for a BSI-defined “state of the art.” The classic IT-Grundschutz remains valid for audits until end of 2028.\n","title":"BSI IT-Grundschutz","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/build/","section":"Tags","summary":"","title":"Build","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/cbrs/","section":"Tags","summary":"","title":"Cbrs","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ce-marking/","section":"Tags","summary":"","title":"Ce-Marking","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ceph/","section":"Tags","summary":"","title":"Ceph","type":"tags"},{"content":"cert-manager is a CNCF graduated project that brings PKI lifecycle management into Kubernetes as a first-class controller, eliminating the manual processes — CSR generation, CA submission, secret rotation, renewal tracking — that cause certificate-related outages in clusters that manage TLS manually. Its premise is that X.509 certificates should be declared as Kubernetes resources with the same GitOps-friendly, reconciliation-driven lifecycle as any other workload configuration: an operator declares the desired certificate, cert-manager continuously ensures that a valid, non-expired certificate matching that declaration exists and is stored in a Kubernetes Secret, and renews it automatically before expiry. The default renewal threshold is two-thirds of the certificate\u0026rsquo;s validity period, so a certificate with a 90-day lifetime is renewed at 60 days without operator intervention.\ncert-manager introduces four core Custom Resource Definitions that together model the complete certificate issuance pipeline. An Issuer (namespace-scoped) or ClusterIssuer (cluster-wide) defines a backend that can sign certificates — its type determines how signing happens. Built-in issuer types include: ACME (implements RFC 8555 to obtain publicly-trusted certificates from Let\u0026rsquo;s Encrypt or any ACME-compatible CA using HTTP-01 or DNS-01 challenge solvers), CA (signs with a CA key pair stored in a Kubernetes Secret, suitable for internal PKIs), Vault (delegates signing to Vault\u0026rsquo;s PKI secrets engine, the standard choice for organisations with an existing Vault-based CA hierarchy), and SelfSigned (issues certificates signed by their own private key, used primarily for bootstrapping CA certificates). The external issuer model extends this list via a standardised webhook protocol: Venafi, Google Certificate Authority Service, AWS PCA, step-ca, and many others implement cert-manager-compatible issuers as separate controllers. A Certificate resource is the human-authored declaration of what certificate is needed: the desired DNS names, SPIFFE URIs, IP addresses, key algorithm, key usages, validity duration, and a reference to the Issuer that should sign it. cert-manager\u0026rsquo;s controller watches Certificate resources, generates a private key (which never leaves the cluster node in CSI-driver deployments, and is stored in a Secret in the standard deployment), creates a CertificateRequest containing the CSR, and submits it to the referenced issuer. The CertificateRequest is the fourth CRD and the internal unit of work: it represents a single signing operation and can be approved automatically by cert-manager\u0026rsquo;s default approver or held for approval by a policy engine (approver-policy) that enforces constraints on what certificates workloads are allowed to request. Once signed, the certificate and key are stored in the Secret named in the Certificate spec, where they can be mounted by pods, consumed by Ingress controllers, or referenced by other cert-manager-aware components.\nBeyond the core Certificate resource, cert-manager ships a family of satellite components for more specialised use cases. The cert-manager CSI driver (csi-driver) mounts certificates directly into pod filesystems as ephemeral volumes, generating a unique private key per pod on the node — the key never enters a Secret or etcd, and the certificate is automatically renewed and remounted before expiry. csi-driver-spiffe extends this to deliver SPIFFE X.509-SVIDs: every pod that mounts the CSI volume receives a certificate with its SPIFFE ID in the SAN, automatically rotated, without any application code changes — a lighter-weight alternative to a full SPIRE deployment for clusters where cert-manager already manages PKI. istio-csr implements the Istio Certificate Signing Request API, allowing Istio to delegate certificate issuance for its mTLS sidecar mesh to cert-manager rather than Istio\u0026rsquo;s built-in Citadel CA, giving operators a single PKI control plane for both workload certificates and mesh identity. trust-manager handles trust bundle distribution: it watches for CA certificate changes and propagates updated trust bundles into ConfigMaps across namespaces, keeping the trust stores that applications and Ingress controllers use to verify certificates in sync with the PKI that cert-manager manages. In the PQC transition, cert-manager is the natural integration point for deploying ML-DSA certificates at scale: a ClusterIssuer backed by a Vault PKI engine configured with an ML-DSA intermediate CA, combined with cert-manager\u0026rsquo;s automatic renewal, provides the operational path for rotating an entire cluster\u0026rsquo;s TLS certificate population to quantum-safe signatures without per-service manual intervention.\n","externalUrl":null,"permalink":"/en/security/cert-manager/","section":"Index","summary":"cert-manager is a CNCF graduated project that brings PKI lifecycle management into Kubernetes as a first-class controller, eliminating the manual processes — CSR generation, CA submission, secret rotation, renewal tracking — that cause certificate-related outages in clusters that manage TLS manually. Its premise is that X.509 certificates should be declared as Kubernetes resources with the same GitOps-friendly, reconciliation-driven lifecycle as any other workload configuration: an operator declares the desired certificate, cert-manager continuously ensures that a valid, non-expired certificate matching that declaration exists and is stored in a Kubernetes Secret, and renews it automatically before expiry. The default renewal threshold is two-thirds of the certificate’s validity period, so a certificate with a 90-day lifetime is renewed at 60 days without operator intervention.\n","title":"cert-manager","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/certificates/","section":"Tags","summary":"","title":"Certificates","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/certification/","section":"Tags","summary":"","title":"Certification","type":"tags"},{"content":"Control Groups (cgroups) is a Linux kernel mechanism, introduced in 2.6.24 (2008), that organises processes into a hierarchy of named groups and uses controllers to account for and limit each group\u0026rsquo;s consumption of CPU time, memory, I/O bandwidth, and process count. Every container runtime in existence — Docker, containerd, CRI-O, Podman — uses cgroups to enforce the resource limits declared in a container spec (--memory, --cpus, requests.memory, limits.cpu). Every systemd service on a modern Linux system runs in its own cgroup slice. Without cgroups, a container or service could consume all available memory, CPU, or file descriptors, starving other workloads on the same host. The current production version is cgroups v2 (also written cgroupv2, unified hierarchy), stable since kernel 4.5 and the default on all major distributions since RHEL 9, Ubuntu 21.10, and Fedora 31.\nThe structural improvement of cgroups v2 over v1 is its unified hierarchy: in v1, each controller (cpu, memory, blkio, pids) mounted as a separate hierarchy at its own path, making cross-controller coordination difficult and policy inconsistent. In v2, all controllers share a single tree rooted at /sys/fs/cgroup, mounted as cgroup2. A cgroup in v2 is a directory; creating a subdirectory creates a child cgroup. Processes are assigned to a cgroup by writing their PID to cgroup.procs. Controllers are enabled per-level via cgroup.subtree_control: writing +memory +cpu to a parent\u0026rsquo;s cgroup.subtree_control enables those controllers for its immediate children. The no-internal-process rule requires that a cgroup with enabled controllers for its children cannot itself contain processes — it must delegate to leaf cgroups — enforcing a clean separation between structural nodes and leaf workload nodes. The key controllers in v2 are: memory (limits total memory use via memory.max, swap via memory.swap.max, and provides real memory pressure detection via memory.pressure — a major improvement over v1\u0026rsquo;s approximate OOM killer); cpu (weight-based CPU time sharing via cpu.weight and hard limits via cpu.max in the format quota period); io (per-device weight, BPS limits, and IOPS limits via io.weight, io.max); pids (maximum process/thread count via pids.max, preventing fork bombs); and cpuset (CPU and NUMA node pinning). The freezer (freeze/thaw all processes in a group atomically, used for checkpoint-restore and live migration) and hugetlb controllers are also available.\nKubernetes interacts with cgroups v2 through the container runtime (containerd, CRI-O), which creates a cgroup hierarchy per pod and per container under the kubelet\u0026rsquo;s own cgroup. The pod\u0026rsquo;s requests and limits fields map to cgroup settings: resources.requests.cpu sets cpu.weight for the scheduler\u0026rsquo;s soft guarantee, resources.limits.cpu sets cpu.max for the hard ceiling, and resources.limits.memory sets memory.max — breaching this limit triggers the Linux OOM killer against the container\u0026rsquo;s processes. Kubernetes 1.25 reached stable support for cgroup v2 (cgroup v2 feature gate graduated), enabling the QoS-based eviction and improved memory pressure handling that v2\u0026rsquo;s memory.pressure interface makes possible. systemd is the primary userspace manager of the cgroup tree on modern systems: it creates slices, scopes, and service units as cgroup subtrees, and Kubernetes node components run within the system.slice or a dedicated kubepods.slice. In the confidential computing stack, cgroups constrain the resource usage of QEMU and virt-launcher processes for KubeVirt and Kata Containers workloads on the host, and the guest kernel maintains its own independent cgroup hierarchy for workloads running inside the VM.\n","externalUrl":null,"permalink":"/en/security/cgroups/","section":"Index","summary":"Control Groups (cgroups) is a Linux kernel mechanism, introduced in 2.6.24 (2008), that organises processes into a hierarchy of named groups and uses controllers to account for and limit each group’s consumption of CPU time, memory, I/O bandwidth, and process count. Every container runtime in existence — Docker, containerd, CRI-O, Podman — uses cgroups to enforce the resource limits declared in a container spec (--memory, --cpus, requests.memory, limits.cpu). Every systemd service on a modern Linux system runs in its own cgroup slice. Without cgroups, a container or service could consume all available memory, CPU, or file descriptors, starving other workloads on the same host. The current production version is cgroups v2 (also written cgroupv2, unified hierarchy), stable since kernel 4.5 and the default on all major distributions since RHEL 9, Ubuntu 21.10, and Fedora 31.\n","title":"cgroups (Control Groups) v2","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/cis/","section":"Tags","summary":"","title":"Cis","type":"tags"},{"content":"CIS Benchmarks are detailed, prescriptive security configuration guidelines published by the Center for Internet Security (CIS), a US-based non-profit organization. They are developed through a consensus process involving cybersecurity practitioners, vendors, and government agencies, and cover over 100 technology families — operating systems (Linux, Windows, macOS), cloud platforms (AWS, Azure, GCP), container orchestrators (Kubernetes, Docker), databases, web servers, and network devices. CIS Benchmarks are international in applicability — they are not tied to any single jurisdiction — and are referenced by regulatory frameworks worldwide (NIST, PCI-DSS, HIPAA, FedRAMP, NIS2 national implementations). Each benchmark provides two recommendation levels: Level 1 (practical hardening that does not significantly impact functionality) and Level 2 (defense-in-depth settings for high-security environments). CIS Benchmarks are voluntary — no law mandates CIS compliance directly — but they are frequently required by procurement contracts, industry standards, and as evidence of \u0026ldquo;reasonable security measures\u0026rdquo; in regulatory audits. The CIS also offers CIS Controls (formerly the SANS Top 20), a prioritized set of cybersecurity best practices, and the CIS Hardened Images program for pre-configured virtual machine images.\nRed Hat has a deep, official relationship with CIS Benchmarks. The CIS Red Hat Enterprise Linux Benchmark is one of the most widely deployed CIS profiles in enterprise environments, and Red Hat ships SCAP (Security Content Automation Protocol) content that automates assessment against CIS recommendations directly within RHEL using oscap. For OpenShift, the CIS OpenShift Container Platform Benchmark (currently v1.9.0) is natively supported by the Compliance Operator, which can scan cluster nodes and the Kubernetes API against CIS profiles (ocp4-cis, ocp4-cis-node), report findings, and auto-remediate non-compliant settings. Red Hat also publishes CIS Hardened Images for RHEL on AWS, Azure, and GCP marketplaces — pre-built virtual machine images that ship already configured to CIS Level 1 or Level 2 specifications. The practical value for customers is that CIS compliance is not an afterthought but an integrated, automatable property of the platform: a new OpenShift cluster can be scanned against CIS benchmarks within minutes of deployment, drift is continuously monitored, and remediation is applied declaratively through the operator lifecycle — reducing what was traditionally weeks of manual hardening work to a policy-as-code workflow.\nAdditional Information # CIS Benchmarks - Official CIS RHEL Benchmark OpenShift Compliance Operator - CIS profiles Red Hat CIS Hardened Images ","externalUrl":null,"permalink":"/en/compliance/cis-benchmarks/","section":"Index","summary":"CIS Benchmarks are detailed, prescriptive security configuration guidelines published by the Center for Internet Security (CIS), a US-based non-profit organization. They are developed through a consensus process involving cybersecurity practitioners, vendors, and government agencies, and cover over 100 technology families — operating systems (Linux, Windows, macOS), cloud platforms (AWS, Azure, GCP), container orchestrators (Kubernetes, Docker), databases, web servers, and network devices. CIS Benchmarks are international in applicability — they are not tied to any single jurisdiction — and are referenced by regulatory frameworks worldwide (NIST, PCI-DSS, HIPAA, FedRAMP, NIS2 national implementations). Each benchmark provides two recommendation levels: Level 1 (practical hardening that does not significantly impact functionality) and Level 2 (defense-in-depth settings for high-security environments). CIS Benchmarks are voluntary — no law mandates CIS compliance directly — but they are frequently required by procurement contracts, industry standards, and as evidence of “reasonable security measures” in regulatory audits. The CIS also offers CIS Controls (formerly the SANS Top 20), a prioritized set of cybersecurity best practices, and the CIS Hardened Images program for pre-configured virtual machine images.\n","title":"CIS Benchmarks","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/cisa/","section":"Tags","summary":"","title":"Cisa","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/classified/","section":"Tags","summary":"","title":"Classified","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/closed-loop/","section":"Tags","summary":"","title":"Closed-Loop","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/cloud/","section":"Tags","summary":"","title":"Cloud","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/cloud-native/","section":"Tags","summary":"","title":"Cloud-Native","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/cncf/","section":"Tags","summary":"","title":"Cncf","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/coco/","section":"Tags","summary":"","title":"Coco","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/common-criteria/","section":"Tags","summary":"","title":"Common-Criteria","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/compliance/","section":"Tags","summary":"","title":"Compliance","type":"tags"},{"content":"composefs is a Linux filesystem technology created by Alexander Larsson and Giuseppe Scrivano at Red Hat that provides cryptographically verified, read-only filesystem trees with opportunistic file-level sharing across images. Its motivating problem is a gap that neither dm-verity nor plain overlayfs fills cleanly: dm-verity provides strong integrity over a whole block device but requires a self-contained disk image and cannot share files between images; overlayfs allows layered, shared filesystems but protects only file contents (via fs-verity) and not the directory structure or metadata — an attacker who can manipulate a file\u0026rsquo;s name, permissions, or position in the tree is not caught. composefs closes that gap by separately protecting content and metadata, then composing them at mount time.\nArchitecturally, a composefs image is a small, read-only EROFS filesystem that stores only metadata — filenames, permissions, xattrs, symlinks, and, for regular files, the expected fs-verity SHA-256 digest of the content rather than the content itself. File data lives separately in a content-addressed object store (a flat directory of files named by their content hash), which is passed to the mount as a basedir. At mount time, the kernel uses overlayfs to compose the EROFS metadata layer over the object store, producing a fully populated directory tree; when a file is read, overlayfs enforces that the backing object\u0026rsquo;s fs-verity digest matches what the metadata image recorded. The EROFS image itself can be fs-verity-verified at mount time by passing its expected digest, giving a complete chain: a single digest commits the metadata, the metadata commits every file\u0026rsquo;s content, and the kernel enforces both on every access. composefs requires no new kernel modules; it is built entirely from overlayfs (with the verity option added in kernel 6.6), EROFS, and fs-verity.\nThe primary consumers are OSTree-based systems and container runtimes. OSTree uses composefs to mount OS trees directly from its content-addressed object store rather than checking out files into a regular directory, replacing hardlink-based checkout with a verified, zero-copy mount. Container runtimes using the zstd:chunked image format can similarly compose container image layers from a shared object store, so files present in multiple images are stored once on disk and verified independently in each mount. The practical effect is that a composefs-mounted root filesystem or container image is as tamper-evident as a dm-verity image — any modification to content or structure causes an I/O error on access — while remaining as storage-efficient and incrementally updatable as a regular file tree. It is central to the verified boot story for bootc and image-based Linux systems where the running OS tree must be attested as unmodified.\n","externalUrl":null,"permalink":"/en/security/composefs/","section":"Index","summary":"composefs is a Linux filesystem technology created by Alexander Larsson and Giuseppe Scrivano at Red Hat that provides cryptographically verified, read-only filesystem trees with opportunistic file-level sharing across images. Its motivating problem is a gap that neither dm-verity nor plain overlayfs fills cleanly: dm-verity provides strong integrity over a whole block device but requires a self-contained disk image and cannot share files between images; overlayfs allows layered, shared filesystems but protects only file contents (via fs-verity) and not the directory structure or metadata — an attacker who can manipulate a file’s name, permissions, or position in the tree is not caught. composefs closes that gap by separately protecting content and metadata, then composing them at mount time.\n","title":"composefs","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/composefs/","section":"Tags","summary":"","title":"Composefs","type":"tags"},{"content":"A Confidential Cluster is a Kubernetes cluster designed so that the cloud or infrastructure operator — including hypervisor administrators, datacenter staff, and anyone who can access the underlying hardware — is entirely outside the trusted computing base. It achieves this by running every Kubernetes node, including control plane nodes, as a Confidential VM, and by extending the confidential boundary to cover not just individual workloads but the cluster\u0026rsquo;s network traffic, persistent storage, and control plane state. The goal is that a workload owner can cryptographically verify the entire cluster before trusting it, and that no privileged party outside the cluster\u0026rsquo;s own CVMs can read or tamper with workload data, cluster secrets, or etcd contents.\nThe distinction from CoCo (Confidential Containers) is architectural scope and threat model. CoCo runs individual pods inside micro-CVMs while the Kubernetes worker nodes and control plane remain on conventional (non-confidential) infrastructure — the kubelet and control plane are untrusted, and CoCo compensates with per-pod attestation and policy enforcement via Trustee. A Confidential Cluster takes the opposite approach: the entire cluster infrastructure — every worker node, every control plane node — is inside CVMs, so the kubelet, etcd, and the Kubernetes API server all run within the confidential boundary. This closes the control plane as an attack surface entirely, but requires the cluster to be built from scratch on CVM-capable hardware rather than layered onto an existing cluster. The two approaches address the same adversary (the infrastructure operator) through different architectural means, and can be combined: a Confidential Cluster running CoCo workloads gives both cluster-level and pod-level confidentiality.\nThe critical operational challenge of a Confidential Cluster is node admission: how does a new node, booting autonomously in a cloud environment, prove to the existing cluster that it is a genuine, unmodified CVM before being allowed to join and receive the encryption keys it needs to access the cluster\u0026rsquo;s state disk, network, and etcd? The answer is attestation-gated join: the bootstrapping node produces a hardware attestation report (a TDX Quote or SEV-SNP report) and presents it over an attested TLS connection to a join service running on the existing control plane; only if the report matches the expected node image measurements does the join service issue a Kubernetes bootstrap token and the storage encryption key. This means every node in the cluster has been individually attested against a known-good image before being admitted — node images built along the lines of bootc and protected at runtime by composefs naturally provide the stable, reproducible measurements that make those reference values meaningful. The result is \u0026ldquo;whole cluster\u0026rdquo; attestation: a workload owner can derive a single hardware-rooted certificate that transitively covers the node image, the cluster topology, and the configuration of every node that was ever admitted to the cluster.\nRelevant Red Hat blog posts # Confidential computing use cases (May 16, 2023) ","externalUrl":null,"permalink":"/en/security/confidential-cluster/","section":"Index","summary":"A Confidential Cluster is a Kubernetes cluster designed so that the cloud or infrastructure operator — including hypervisor administrators, datacenter staff, and anyone who can access the underlying hardware — is entirely outside the trusted computing base. It achieves this by running every Kubernetes node, including control plane nodes, as a Confidential VM, and by extending the confidential boundary to cover not just individual workloads but the cluster’s network traffic, persistent storage, and control plane state. The goal is that a workload owner can cryptographically verify the entire cluster before trusting it, and that no privileged party outside the cluster’s own CVMs can read or tamper with workload data, cluster secrets, or etcd contents.\n","title":"Confidential Cluster","type":"security"},{"content":"Confidential Containers (CoCo) is a CNCF sandbox project that lifts hardware confidential computing — TDX, SEV-SNP, Intel SGX, IBM Secure Execution — up to the Kubernetes pod level, providing a unified software layer that abstracts away the underlying TEE technology. Its defining trust model is unusually strict: the Kubernetes control plane, the kubelet, the container runtime, and the cloud operator are all treated as explicitly untrusted. Only the hardware itself and the workload owner\u0026rsquo;s own supply chain are in scope for trust.\nThe runtime layer is built on Kata Containers: each pod runs inside a lightweight VM, providing a hardware isolation boundary between the pod and the host kernel. On TEE-capable hardware, that VM is itself a confidential VM — a TDX Trust Domain or SEV-SNP guest — so even the hypervisor cannot read or tamper with pod memory. Because the Kubernetes control plane is untrusted, pod specifications delivered by it are not blindly executed; instead, a policy engine inside the confidential VM validates what the control plane claims before acting on it.\nAttestation and secret delivery are handled by Trustee, CoCo\u0026rsquo;s attestation service stack. Inside the confidential VM, an Attestation Agent (AA) collects hardware evidence (a TDX Quote or SEV-SNP attestation report) and presents it to the Key Broker Service (KBS), a relying-party service deployed in a separately trusted environment. The KBS forwards that evidence to an Attestation Service (AS) for verification against known-good reference values, and only releases secrets — decryption keys, registry credentials, sealed secrets — to pods that pass. This means container images can be stored encrypted in a public registry and pulled by an untrusted node, with decryption keys only becoming available inside the TEE after successful attestation. CoCo is the primary integration point where the low-level primitives described by TPM PCR measurements, TDX RTMRs, and SEV-SNP launch measurements become meaningful access control at the workload layer.\nRelevant Red Hat blog posts # Confidential Containers - Project website Confidential Containers - CNCF website What is the Confidential Containers project? (Oct 7, 2022) Confidential computing use cases (May 16, 2023) Exploring the OpenShift confidential containers solution (Sep 1, 2024) Use cases and ecosystem for OpenShift confidential containers (Sep 8, 2024) Secure AI inferencing: POC with NVIDIA NIM on CoCo with OpenShift AI (Mar 18, 2025) Deploy sensitive workloads with OpenShift confidential containers (Jul 30, 2025) Red Hat OpenShift sandboxed containers 1.12 and Red Hat build of Trustee 1.1 bring confidential computing to bare metal and AI workloads (Apr 13,2026) Confidential Containers workshop on Microsoft Azure Red Hat OpenShift: Learn interactively (Apr 17, 2026) An overview of confidential containers on OpenShift bare metal (Jun 4, 2026) Deploying confidential containers ","externalUrl":null,"permalink":"/en/security/coco/","section":"Index","summary":"Confidential Containers (CoCo) is a CNCF sandbox project that lifts hardware confidential computing — TDX, SEV-SNP, Intel SGX, IBM Secure Execution — up to the Kubernetes pod level, providing a unified software layer that abstracts away the underlying TEE technology. Its defining trust model is unusually strict: the Kubernetes control plane, the kubelet, the container runtime, and the cloud operator are all treated as explicitly untrusted. Only the hardware itself and the workload owner’s own supply chain are in scope for trust.\n","title":"Confidential Containers (CoCo)","type":"security"},{"content":"A Confidential GPU is a GPU whose memory, computation state, and data transfers are hardware-encrypted and isolated from the host system — extending the Trusted Execution Environment (TEE) boundary that technologies like TDX and SEV-SNP provide at the CPU level to encompass the GPU accelerator as well. The primary implementation today is NVIDIA Confidential Computing on the Hopper architecture (H100 and later), which encrypts all data resident in GPU High Bandwidth Memory (HBM) using per-context keys managed by the GPU\u0026rsquo;s on-die security processor. This means that model weights, training data, activations, and intermediate computations are cryptographically protected throughout GPU processing — a host administrator, hypervisor, or co-tenant with DMA access to the PCIe bus sees only ciphertext. The GPU also participates in a dedicated attestation flow: the NVIDIA Remote Attestation Service (NRAS) produces signed evidence that a specific GPU is genuine NVIDIA hardware running in Confidential Computing mode with unmodified firmware, analogous to how Intel DCAP or AMD KDS attest CPU TEEs. This GPU attestation is verified alongside CPU attestation before secrets (model decryption keys, dataset credentials) are released to the combined CPU+GPU TEE. The technology requires no application code changes — existing TensorFlow, PyTorch, and CUDA workloads run unmodified inside the confidential boundary. The primary threat model is the same as CPU-level confidential computing (protecting data-in-use from the infrastructure operator) but applied to the specific risk of AI workloads: model intellectual property theft, training data exfiltration, and inference input/output interception during GPU computation.\nRed Hat integrated Confidential GPU support in OpenShift sandboxed containers 1.12 (April 2026) as a Technology Preview, in collaboration with NVIDIA. The implementation extends the existing CoCo (Confidential Containers) architecture: a confidential container running inside a CPU TEE (TDX or SEV-SNP) is connected to an NVIDIA H100 GPU operating in Confidential Computing mode, creating a unified TEE spanning both CPU memory and GPU memory. Red Hat build of Trustee 1.1 adds NRAS integration, enabling the attestation service to verify GPU hardware integrity as part of the same attestation flow that validates the CPU TEE — secrets are released only when both CPU and GPU attestation pass. The OpenShift sandboxed containers operator provides automated hardware node discovery for confidential GPU-capable nodes and dynamically provisions dedicated RuntimeClasses (kata-qemu-nvidia-gpu-tdx, kata-qemu-nvidia-gpu-snp), integrating with the standard NVIDIA GPU Operator for resource management. The key use case demonstrated by Red Hat is model IP protection for distributed inference: a proprietary model vendor encrypts model weights and stores them in a standard registry; the weights are pulled by an untrusted third-party infrastructure operator running OpenShift; Trustee releases the decryption key only after verifying both the CPU TEE and the GPU TEE via NRAS — guaranteeing that the model is never exposed in plaintext outside verified hardware, even though the infrastructure is operated by someone else. This enables AI model distribution without trust assumptions about the hosting environment, addressing a critical blocker for regulated industries (healthcare AI, financial modeling) and model vendors who need to protect years of R\u0026amp;D investment.\nAdditional Information # NVIDIA Confidential Computing AI meets security: POC to run workloads in confidential containers using NVIDIA accelerated computing (Nov 12, 2024) Secure AI inferencing: POC with NVIDIA NIM on CoCo with OpenShift AI (Mar 18, 2025) Red Hat OpenShift sandboxed containers 1.12 and Red Hat build of Trustee 1.1 bring confidential computing to bare metal and AI workloads (Apr 13, 2026) Confidential Containers with NVIDIA Confidential GPU - Interactive Demo ","externalUrl":null,"permalink":"/en/security/confidential-gpu/","section":"Index","summary":"A Confidential GPU is a GPU whose memory, computation state, and data transfers are hardware-encrypted and isolated from the host system — extending the Trusted Execution Environment (TEE) boundary that technologies like TDX and SEV-SNP provide at the CPU level to encompass the GPU accelerator as well. The primary implementation today is NVIDIA Confidential Computing on the Hopper architecture (H100 and later), which encrypts all data resident in GPU High Bandwidth Memory (HBM) using per-context keys managed by the GPU’s on-die security processor. This means that model weights, training data, activations, and intermediate computations are cryptographically protected throughout GPU processing — a host administrator, hypervisor, or co-tenant with DMA access to the PCIe bus sees only ciphertext. The GPU also participates in a dedicated attestation flow: the NVIDIA Remote Attestation Service (NRAS) produces signed evidence that a specific GPU is genuine NVIDIA hardware running in Confidential Computing mode with unmodified firmware, analogous to how Intel DCAP or AMD KDS attest CPU TEEs. This GPU attestation is verified alongside CPU attestation before secrets (model decryption keys, dataset credentials) are released to the combined CPU+GPU TEE. The technology requires no application code changes — existing TensorFlow, PyTorch, and CUDA workloads run unmodified inside the confidential boundary. The primary threat model is the same as CPU-level confidential computing (protecting data-in-use from the infrastructure operator) but applied to the specific risk of AI workloads: model intellectual property theft, training data exfiltration, and inference input/output interception during GPU computation.\n","title":"Confidential GPU","type":"security"},{"content":"A Confidential VM (CVM) is a virtual machine in which the guest\u0026rsquo;s memory contents, CPU register state, and execution flow are hardware-encrypted and isolated from everything outside it: the hypervisor, the host operating system, the cloud operator, other tenants, and anyone with physical access to the machine. The isolation is enforced not by software policy but by the CPU itself, using TEE technology — Intel TDX, AMD SEV-SNP, or Arm CCA — so that no amount of privilege on the host side grants access to the guest\u0026rsquo;s private state. A CVM is the VM-granularity equivalent of what SGX enclaves provide at the process level: the key difference is that a CVM requires no application changes, making it the practical path for lifting existing workloads into a confidential computing environment.\nThe security properties of a CVM vary by underlying technology but share a common structure. Memory is encrypted with a per-VM key held inside the CPU or on-die security processor, so DRAM contents observed by the host (through DMA, memory probing, or cold-boot attack) are ciphertext. CPU register state on VM exit is either encrypted (SEV-ES and later) or mediated through a trusted module (TDX\u0026rsquo;s SEAM mode) so the hypervisor cannot read or inject guest execution state. Memory integrity protection (SEV-SNP\u0026rsquo;s Secure Nested Paging, TDX\u0026rsquo;s memory tagging) prevents the host from replaying, remapping, or aliasing guest memory pages without the guest detecting it. Together these properties enforce the defining guarantee of a CVM: the guest\u0026rsquo;s confidentiality and integrity hold even against a fully compromised hypervisor. What they do not protect against is a compromised guest OS or application — once an attacker has root inside the CVM, the TEE boundary does not save it. The threat model is the infrastructure, not the workload itself.\nThe other defining property of a CVM is attestability: the TEE hardware can produce a signed report — a TDX Quote or SEV-SNP attestation report — that cryptographically binds the CVM\u0026rsquo;s identity (its measured firmware, kernel, and initial state) to a hardware-rooted key that only genuine, unmodified hardware can produce. This report is what allows a workload owner to verify, from outside the cloud, that their CVM is running on real confidential hardware with an unmodified software stack before sending it secrets. CVMs are the runtime substrate for CoCo (Confidential Containers), where each pod runs inside a CVM; for Confidential Clusters, where every Kubernetes node is a CVM; and for Trustee, which releases secrets only to CVMs that present a valid attestation report.\nRelevant Red Hat blog posts # Confidential computing use cases (May 16, 2023) Introduction to confidential virtual machines (June 8, 2023) Confidential virtual machines versus VMs: Latency analysis (Jul 28, 2026) Confidential VMs: The core of confidential containers (Sep 15, 2025) ","externalUrl":null,"permalink":"/en/security/confidential-vm/","section":"Index","summary":"A Confidential VM (CVM) is a virtual machine in which the guest’s memory contents, CPU register state, and execution flow are hardware-encrypted and isolated from everything outside it: the hypervisor, the host operating system, the cloud operator, other tenants, and anyone with physical access to the machine. The isolation is enforced not by software policy but by the CPU itself, using TEE technology — Intel TDX, AMD SEV-SNP, or Arm CCA — so that no amount of privilege on the host side grants access to the guest’s private state. A CVM is the VM-granularity equivalent of what SGX enclaves provide at the process level: the key difference is that a CVM requires no application changes, making it the practical path for lifting existing workloads into a confidential computing environment.\n","title":"Confidential VM (CVM)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/confidential-computing/","section":"Tags","summary":"","title":"Confidential-Computing","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/configuration/","section":"Tags","summary":"","title":"Configuration","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/containers/","section":"Tags","summary":"","title":"Containers","type":"tags"},{"content":"The context window is the maximum span of tokens—input prompt plus model-generated output—that an LLM can process in a single forward pass chain without truncating or sliding attention. It is set by model architecture (positional encoding limit, e.g. 8K, 128K, 1M+ in newer models) and by practical VRAM on the serving GPU, because the KV cache scales with total sequence length. Its objective is to bound memory and compute: longer windows enable whole documents, multi-turn chat history, and large RAG payloads in one shot, but cost more on every prefill and decode step. APIs expose this as max_tokens, context limits, or model cards; exceeding it yields errors or silent truncation.\nArchitecturally, context length is the bridge between user-facing features and hardware. A CPU can assemble a 200K-token string, but the GPU must store KV states for each layer × each token; beyond context window, frameworks drop middle sections (sliding window models), summarize, or fail. RAG often fights the window by retrieving only top-k chunks; fine-tuning does not extend window unless the architecture supports it (e.g. YaRN, rope scaling). Quantization frees VRAM so more tokens fit in the same window. llm-d prefix caching helps when many requests share the same long system prompt within the window. Window size is unrelated to training corpus size—it is an inference-time limit per request.\nRed Hat documents context planning on OpenShift AI and RHEL AI: matching model SKU (8K vs 128K) to use cases, GPU HBM sizing with vLLM/NIM, and MIG profiles too small for long-context models. Guardrails may reject oversize prompts before they hit the GPU. Reference architectures for RAG recommend chunking and reranking so retrieved text fits comfortably inside the window with room for the answer. Operators validate SLOs at worst-case prompt lengths, not only average chat size.\n","externalUrl":null,"permalink":"/en/ai/context-window/","section":"Index","summary":"The context window is the maximum span of tokens—input prompt plus model-generated output—that an LLM can process in a single forward pass chain without truncating or sliding attention. It is set by model architecture (positional encoding limit, e.g. 8K, 128K, 1M+ in newer models) and by practical VRAM on the serving GPU, because the KV cache scales with total sequence length. Its objective is to bound memory and compute: longer windows enable whole documents, multi-turn chat history, and large RAG payloads in one shot, but cost more on every prefill and decode step. APIs expose this as max_tokens, context limits, or model cards; exceeding it yields errors or silent truncation.\n","title":"Context window","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/context-window/","section":"Tags","summary":"","title":"Context-Window","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/controls/","section":"Tags","summary":"","title":"Controls","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/core-network/","section":"Tags","summary":"","title":"Core-Network","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/critical-infrastructure/","section":"Tags","summary":"","title":"Critical-Infrastructure","type":"tags"},{"content":"A Certificate Revocation List (CRL) is a signed data structure, published by a Certificate Authority as part of its PKI operations, that lists the serial numbers of X.509 certificates the CA has revoked before their scheduled expiry date. A CA revokes a certificate when its private key is compromised, the subject\u0026rsquo;s identity information changes, the certificate was mis-issued, or the subject is no longer authorised. Without revocation, a compromised certificate remains trusted by all verifiers until it expires — which for long-lived CA and infrastructure certificates can be years. The CRL is the oldest revocation mechanism, defined in RFC 5280 alongside the X.509 v3 certificate format, and remains widely deployed for CA certificates, code signing certificates, and client certificates in contexts where OCSP is impractical.\nA CRL is itself a signed JWT-like structure in ASN.1/DER format: a tbsCertList (the list body containing the issuer DN, the signature algorithm, the thisUpdate timestamp, the optional nextUpdate timestamp, and the list of revoked certificate entries — each entry carrying the serial number, the revocation date, and optional reason code) plus the CA\u0026rsquo;s signature over that body. Verifiers download the CRL from the URL specified in the certificate\u0026rsquo;s CRL Distribution Point (CDP) extension, verify the CA\u0026rsquo;s signature, check that thisUpdate is not in the future and nextUpdate is not in the past (ensuring freshness), and search for the certificate\u0026rsquo;s serial number. If found, the certificate is revoked; if absent, it is currently valid. CRL reason codes (RFC 5280 §5.3.1) include keyCompromise, cACompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, removeFromCRL, and privilegeWithdrawn — the reason is informational for the verifier, but keyCompromise and cACompromise carry a revocationDate that may be set earlier than the actual compromise discovery, affecting retroactive validation. Delta CRLs (RFC 5280 §5.2.4) are incremental updates listing only changes since the last full CRL, reducing download size for large CRLs by allowing verifiers to apply deltas on top of a cached base CRL.\nCRLs have three well-known operational problems that drove the development of OCSP. Staleness: a CRL is only as current as its last publication; if a CA publishes CRLs every 24 hours and a certificate is compromised at 00:01, it will not appear in a CRL until at most 23:59 later — during which time the certificate appears valid to all verifiers. Size: a CA that has issued millions of certificates and revoked hundreds of thousands of them produces a CRL that may be tens or hundreds of megabytes, impractical to download per connection. Privacy: every verifier that downloads a CRL reveals to the CRL distribution point server which CA\u0026rsquo;s certificates it is checking, though not which specific certificate. These limitations make CRLs unsuitable as the primary revocation mechanism for web PKI leaf certificates — browsers have largely abandoned per-connection CRL fetching, relying instead on OCSP stapling or browser-vendor aggregated revocation lists (Chrome\u0026rsquo;s CRLSets, Firefox\u0026rsquo;s OneCRL). CRLs remain the correct mechanism for CA certificate revocation (where size is small and staleness is acceptable since CA certificates have long validity), for code signing certificates in offline verification scenarios (air-gapped environments can cache a CRL and verify signatures without network access), and for client certificate revocation in mTLS environments where the server controls the verification policy and can configure a tolerable maximum CRL age. In the PQC transition, CRL signatures must migrate from ECDSA/RSA to ML-DSA alongside the certificates they cover — a CA that migrates to an ML-DSA signing key must also re-sign its CRLs under the new key, and verifiers must be updated to accept ML-DSA CRL signatures.\n","externalUrl":null,"permalink":"/en/security/crl/","section":"Index","summary":"A Certificate Revocation List (CRL) is a signed data structure, published by a Certificate Authority as part of its PKI operations, that lists the serial numbers of X.509 certificates the CA has revoked before their scheduled expiry date. A CA revokes a certificate when its private key is compromised, the subject’s identity information changes, the certificate was mis-issued, or the subject is no longer authorised. Without revocation, a compromised certificate remains trusted by all verifiers until it expires — which for long-lived CA and infrastructure certificates can be years. The CRL is the oldest revocation mechanism, defined in RFC 5280 alongside the X.509 v3 certificate format, and remains widely deployed for CA certificates, code signing certificates, and client certificates in contexts where OCSP is impractical.\n","title":"CRL (Certificate Revocation List)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/cryptography/","section":"Tags","summary":"","title":"Cryptography","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/csi/","section":"Tags","summary":"","title":"Csi","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/cuda/","section":"Tags","summary":"","title":"Cuda","type":"tags"},{"content":"CUDA (Compute Unified Device Architecture) is NVIDIA\u0026rsquo;s software platform for general-purpose computing on GPUs. Its objective is to give developers a familiar C/C++ (and Fortran, Python bindings) programming model with explicit control over kernels (functions that run on the device), streams (ordered queues of work), and memory spaces (host, device, unified). CUDA sits above the GPU driver and below frameworks such as cuDNN, NCCL, and higher-level ML stacks; it is the layer that makes it practical to implement custom operators, HPC solvers, and inference engines that are not covered by a closed library. For AI, virtually every major training and inference stack ultimately depends on CUDA (or a CUDA-compatible runtime) on NVIDIA hardware.\nThe CUDA execution model is SIMT (Single Instruction, Multiple Threads): programmers write kernels as scalar thread programs; the hardware groups threads into warps of 32 that execute in lockstep. Global memory is large but high-latency; shared memory and registers are fast but limited per block. A CPU thread is heavyweight, preemptible, and optimized for irregular control flow and system calls; a CUDA thread is extremely lightweight and only efficient when workloads are regular and memory access is coalesced. Host code runs on the CPU and issues asynchronous launches; synchronization (cudaDeviceSynchronize, events) defines visibility between host and device. Multi-GPU scaling uses peer access, NCCL collectives, and NVLink/PCIe topology awareness—concerns that do not exist in single-socket CPU programming in the same form.\nRed Hat does not ship CUDA itself (it is NVIDIA proprietary) but documents and supports running CUDA workloads on RHEL and OpenShift. RHEL notes cover installing the NVIDIA driver, CUDA toolkit from NVIDIA repositories or containers, and using the NVIDIA Container Toolkit so GPU devices pass through to Podman or Kubernetes pods. OpenShift AI and OpenShift GPU operator patterns integrate device plugins and validated images for notebook and model-serving workloads. Red Hat\u0026rsquo;s AI portfolio assumes CUDA where NVIDIA GPUs are present, while keeping the operating platform (SELinux, cgroups, kABI-stable drivers where offered) under enterprise support boundaries defined in Red Hat and NVIDIA joint certification guides.\n","externalUrl":null,"permalink":"/en/ai/cuda/","section":"Index","summary":"CUDA (Compute Unified Device Architecture) is NVIDIA’s software platform for general-purpose computing on GPUs. Its objective is to give developers a familiar C/C++ (and Fortran, Python bindings) programming model with explicit control over kernels (functions that run on the device), streams (ordered queues of work), and memory spaces (host, device, unified). CUDA sits above the GPU driver and below frameworks such as cuDNN, NCCL, and higher-level ML stacks; it is the layer that makes it practical to implement custom operators, HPC solvers, and inference engines that are not covered by a closed library. For AI, virtually every major training and inference stack ultimately depends on CUDA (or a CUDA-compatible runtime) on NVIDIA hardware.\n","title":"CUDA (Compute Unified Device Architecture)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/cudnn/","section":"Tags","summary":"","title":"Cudnn","type":"tags"},{"content":"cuDNN (CUDA Deep Neural Network library) is NVIDIA’s library of highly optimized GPU kernels for operations that dominate deep learning: convolutions, matrix multiplies used in attention, pooling, normalization (batch/layer), activations, and recurrent cells. Its objective is to deliver near-peak performance on CUDA-capable GPUs without every framework author hand-writing assembly-tuned kernels. PyTorch, TensorFlow, and many inference engines call cuDNN (directly or via cuBLAS) under the hood for training and serving. cuDNN sits between raw CUDA and application code; version alignment with the CUDA toolkit and driver is mandatory for supported deployments.\nArchitecturally, cuDNN targets GPU execution only: the CPU submits operator descriptors (tensor layouts, dtypes, algorithm choices such as Winograd vs implicit GEMM for convolutions) and cuDNN selects or autotunes implementations on the device. Compared with naive CUDA loops, cuDNN exploits tensor cores, fusion opportunities, and memory layout (NCHW vs NHWC) for FP16, BF16, and FP8 where supported. It is not an alternative to NCCL (collectives across GPUs) or TensorRT (full-graph inference compilation)—it provides building blocks. On AMD hardware, ROCm uses MIOpen instead; cuDNN is NVIDIA-specific. LLM stacks increasingly lean on custom attention kernels, but cuDNN and cuBLAS still underpin many layers and legacy CV/NLP paths inside unified frameworks.\nRed Hat supports cuDNN indirectly through validated RHEL stacks with NVIDIA drivers and CUDA/cuDNN versions listed in release notes for OpenShift AI, GPU workloads, and partner matrices. Containers for NIM, vLLM, and PyTorch training images pull cuDNN-bearing layers from NVIDIA or framework publishers; Red Hat documents compatible driver/CUDA combinations on certified GPU servers rather than shipping cuDNN as a separate product. Operators treat cuDNN like any CUDA dependency: pin versions in images, test upgrades on staging clusters, and align subscription support with NVIDIA’s and Red Hat’s joint hardware guidance.\n","externalUrl":null,"permalink":"/en/ai/cudnn/","section":"Index","summary":"cuDNN (CUDA Deep Neural Network library) is NVIDIA’s library of highly optimized GPU kernels for operations that dominate deep learning: convolutions, matrix multiplies used in attention, pooling, normalization (batch/layer), activations, and recurrent cells. Its objective is to deliver near-peak performance on CUDA-capable GPUs without every framework author hand-writing assembly-tuned kernels. PyTorch, TensorFlow, and many inference engines call cuDNN (directly or via cuBLAS) under the hood for training and serving. cuDNN sits between raw CUDA and application code; version alignment with the CUDA toolkit and driver is mandatory for supported deployments.\n","title":"cuDNN (CUDA Deep Neural Network library)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/cvss/","section":"Tags","summary":"","title":"Cvss","type":"tags"},{"content":"CVSS (Common Vulnerability Scoring System) is an open framework published by FIRST (Forum of Incident Response and Security Teams) for characterising and communicating the technical severity of software vulnerabilities through a standardised numerical score. The current version is CVSS v4.0 (released November 2023), which introduced a fourth metric group and clarified nomenclature to address the persistent misuse of CVSS Base scores as standalone risk measurements. CVSS scores appear in the NVD (National Vulnerability Database), CVE entries, scanner output from Qualys, Tenable, Rapid7, Grype, and Trivy, and in compliance frameworks that specify remediation SLAs based on severity bands — \u0026ldquo;critical (9.0–10.0) within 15 days, high (7.0–8.9) within 30 days.\u0026rdquo; The score ranges from 0.0 (no impact) to 10.0 (maximum severity) and maps to five qualitative ratings: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0).\nCVSS v4.0 is composed of four metric groups with distinct purposes and distinct intended authors. The Base metrics (CVSS-B) measure the intrinsic, time-invariant characteristics of the vulnerability itself, independent of any specific deployment — the attack vector (Network, Adjacent, Local, Physical), attack complexity, attack requirements (a new v4.0 metric capturing prerequisites like race conditions), privileges required, user interaction, and the impact on confidentiality, integrity, and availability of the vulnerable system and any downstream systems. Base scores are provided by the vendor or the NVD and do not change once assigned for a given vulnerability version. The Threat metrics (formerly Temporal in v3.x, renamed to emphasise threat intelligence) adjust the Base score based on factors that change over time: primarily the Exploit Maturity metric, which captures whether a proof-of-concept exists, whether exploitation is known, or whether active exploitation is occurring — this is where KEV membership directly maps to a CVSS input. The Environmental metrics are provided by the consumer (the organisation deploying the software), not the vendor: they allow the score to be adjusted for the organisation\u0026rsquo;s specific context — whether the vulnerable component is internet-facing, whether compensating controls are in place, and how critical confidentiality, integrity, and availability are for that specific system in that organisation. The Supplemental metrics are a new v4.0 addition that add contextual information (safety impact for OT/ICS/IoT systems, response effort, provider urgency) without affecting the calculated score. The formal nomenclature introduced in v4.0 — CVSS-B, CVSS-BT, CVSS-BE, CVSS-BTE — makes explicit which metric groups were considered in a given score, preventing the common confusion between a raw Base score and a fully contextualised score.\nThe most consequential and most common CVSS misuse is treating the Base score as a complete risk assessment and prioritising remediation purely by Base score descending. The Base score assumes worst-case deployment in an unmitigated environment and no threat intelligence — it is a measure of theoretical severity, not operational risk. A CVSS 9.8 on a component that is not network-reachable in your environment, has no known exploit code, and is not in the KEV catalog represents far lower operational risk than a CVSS 6.5 that is KEV-listed and being actively used by ransomware groups. CVSS itself is explicit about this: the specification states that Base scores \u0026ldquo;should not be used alone to assess risk\u0026rdquo; and that Threat and Environmental metrics are not optional refinements but essential inputs for a meaningful score. The practical consequence for vulnerability management is a two-tier prioritisation model: KEV membership as the mandatory remediation trigger regardless of Base score, and CVSS-BTE (Base + Threat + Environmental) as the scoring basis for everything else. For SBOM-driven vulnerability management, CVSS scores from the NVD are the first-pass filter applied when correlating SBOM components against the CVE database; VEX not_affected assertions are the mechanism for suppressing false-positive CVSS hits where the vulnerable code path is not reachable in the specific product; and KEV membership is the override that escalates any surviving hit to immediate remediation priority regardless of its CVSS-B score.\n","externalUrl":null,"permalink":"/en/security/cvss/","section":"Index","summary":"CVSS (Common Vulnerability Scoring System) is an open framework published by FIRST (Forum of Incident Response and Security Teams) for characterising and communicating the technical severity of software vulnerabilities through a standardised numerical score. The current version is CVSS v4.0 (released November 2023), which introduced a fourth metric group and clarified nomenclature to address the persistent misuse of CVSS Base scores as standalone risk measurements. CVSS scores appear in the NVD (National Vulnerability Database), CVE entries, scanner output from Qualys, Tenable, Rapid7, Grype, and Trivy, and in compliance frameworks that specify remediation SLAs based on severity bands — “critical (9.0–10.0) within 15 days, high (7.0–8.9) within 30 days.” The score ranges from 0.0 (no impact) to 10.0 (maximum severity) and maps to five qualitative ratings: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0).\n","title":"CVSS (Common Vulnerability Scoring System)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/cybersecurity/","section":"Tags","summary":"","title":"Cybersecurity","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/dataplane/","section":"Tags","summary":"","title":"Dataplane","type":"tags"},{"content":"Decode is the second stage of LLM inference: after prefill has stored keys and values for the prompt, the model generates one new token per forward pass, appends it to the sequence, extends the KV cache, and repeats until a stop condition (EOS token, max length, or API limit). Its objective is fluent continuation—answer text, code, or tool-call JSON—at acceptable inter-token latency and cluster throughput (tokens per second across many concurrent sessions). Decode drives the “typing” experience in chat UIs; prefill drives how long users wait before the first character appears.\nArchitecturally, decode is usually memory-bandwidth-bound on the GPU: each step touches all model weights for a small amount of new compute, while the KV cache grows with total sequence length (prompt + generated tokens). Continuous batching in vLLM mixes decode steps from many requests in one kernel launch to raise utilization. The CPU streams tokens to clients and manages batch scheduling but does not perform the heavy matmuls. Quantization and speculative decoding target decode cost; tensor parallelism adds communication per token on multi-GPU setups. llm-d disaggregated stacks run decode on pools tuned for memory bandwidth, separate from prefill workers.\nRed Hat tuning guides for OpenShift AI emphasize decode for capacity planning: how many concurrent chats per GPU, effect of MIG slice size on cache headroom, and autoscaling on tokens/sec or queue depth. Guardrails may scan each decoded chunk or the full completion before returning to users. Production SLOs often specify p99 token latency separately from TTFT (prefill). Red Hat platforms do not change decode algorithms; they host vLLM, NIM, and llm-d with supported drivers and observability on RHEL/OpenShift.\n","externalUrl":null,"permalink":"/en/ai/decode/","section":"Index","summary":"Decode is the second stage of LLM inference: after prefill has stored keys and values for the prompt, the model generates one new token per forward pass, appends it to the sequence, extends the KV cache, and repeats until a stop condition (EOS token, max length, or API limit). Its objective is fluent continuation—answer text, code, or tool-call JSON—at acceptable inter-token latency and cluster throughput (tokens per second across many concurrent sessions). Decode drives the “typing” experience in chat UIs; prefill drives how long users wait before the first character appears.\n","title":"Decode","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/decode/","section":"Tags","summary":"","title":"Decode","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/deep-learning/","section":"Tags","summary":"","title":"Deep-Learning","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/detection/","section":"Tags","summary":"","title":"Detection","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/device-mapper/","section":"Tags","summary":"","title":"Device-Mapper","type":"tags"},{"content":"Diffie-Hellman (DH) is a key exchange protocol published by Whitfield Diffie and Martin Hellman in 1976 — the first public description of asymmetric cryptography and one of the most consequential cryptographic publications in history. Its fundamental contribution is solving the key establishment problem: two parties who have never communicated before, communicating over a channel that an adversary can fully observe, can nonetheless agree on a shared secret that the adversary cannot determine. The security of finite-field DH rests on the discrete logarithm problem: given g^a mod p and g^b mod p (the public values exchanged), computing g^ab mod p (the shared secret) requires solving for either a or b, which is computationally infeasible for sufficiently large groups. The 1976 original uses multiplicative groups of integers modulo a prime p; the security level is determined by the size of p (currently 2048-bit minimum, 3072-bit recommended) and the group\u0026rsquo;s structure. Finite-field DH is still deployed in TLS 1.2 DHE cipher suites and legacy IPsec configurations, but has been supplanted in new deployments by Elliptic Curve Diffie-Hellman (ECDH) and specifically by X25519, which provide equivalent security at dramatically smaller key sizes.\nECDH moves the discrete logarithm problem from multiplicative integer groups to elliptic curve groups, as covered in the ECC entry. X25519 (RFC 7748) is the specific ECDH instantiation using Bernstein\u0026rsquo;s Curve25519, and is the dominant modern key exchange: it is the default key exchange in TLS 1.3, SSH (since OpenSSH 6.5), WireGuard, Signal Protocol, and most modern cryptographic protocols. X25519 is a Diffie-Hellman function (not a general ECDH implementation) whose inputs are a 32-byte private scalar and a 32-byte public point, whose output is a 32-byte shared secret, and whose implementation is designed to run in constant time without branches or table lookups — eliminating the timing side-channel vulnerabilities that have historically plagued elliptic curve implementations. X448 (Curve448, RFC 7748) is a higher-security alternative with a 56-byte key size, used where a larger classical security margin is required. The critical property all DH variants provide when used with ephemeral key pairs — fresh key pairs generated per session and discarded after use — is forward secrecy: if a server\u0026rsquo;s long-term private key is later compromised, previously recorded sessions cannot be decrypted because the session keys were derived from ephemeral DH shares that no longer exist anywhere. TLS 1.3 mandates ephemeral key exchange (all DHE/ECDHE), making forward secrecy unconditional; TLS 1.2 RSA key exchange (where the client encrypts the pre-master secret under the server\u0026rsquo;s long-term RSA key) provided no forward secrecy and is the primary reason recorded TLS 1.2 traffic is HNDL-exposed even without an explicit ECDH break.\nDH in all its forms — finite-field, ECDH, X25519 — is broken by Shor\u0026rsquo;s algorithm on a CRQC. The discrete logarithm problem (both in integer groups and on elliptic curves) is solvable in polynomial time by a quantum computer, meaning all DH-based key exchanges become retroactively insecure for sessions recorded today once a CRQC exists. This is the HNDL (Harvest Now, Decrypt Later) threat: a passive adversary recording TLS 1.3 sessions using X25519 today can decrypt all of them once a CRQC is available — even though TLS 1.3 provides classical forward secrecy, it provides no quantum forward secrecy. The replacement is ML-KEM (FIPS 203), which is based on the Module Learning With Errors problem for which no efficient quantum algorithm is known. The transition is already underway: the hybrid key exchange group X25519MLKEM768 — which XORs the X25519 shared secret and the ML-KEM-768 shared secret, so the session key is secure if either component is unbroken — is the default in Chrome 131+ and available in OpenSSL 3.4+, TLS 1.3, and IPsec IKEv2 (RFC 9370). SSH hybrid key exchange (mlkem768x25519-sha256) is available in OpenSSH 9.9+. WireGuard\u0026rsquo;s hardcoded X25519 does not yet have a standardised post-quantum replacement, making the PSK option the only partial mitigation available without a protocol revision, as discussed in that entry.\n","externalUrl":null,"permalink":"/en/security/diffie-hellman/","section":"Index","summary":"Diffie-Hellman (DH) is a key exchange protocol published by Whitfield Diffie and Martin Hellman in 1976 — the first public description of asymmetric cryptography and one of the most consequential cryptographic publications in history. Its fundamental contribution is solving the key establishment problem: two parties who have never communicated before, communicating over a channel that an adversary can fully observe, can nonetheless agree on a shared secret that the adversary cannot determine. The security of finite-field DH rests on the discrete logarithm problem: given g^a mod p and g^b mod p (the public values exchanged), computing g^ab mod p (the shared secret) requires solving for either a or b, which is computationally infeasible for sufficiently large groups. The 1976 original uses multiplicative groups of integers modulo a prime p; the security level is determined by the size of p (currently 2048-bit minimum, 3072-bit recommended) and the group’s structure. Finite-field DH is still deployed in TLS 1.2 DHE cipher suites and legacy IPsec configurations, but has been supplanted in new deployments by Elliptic Curve Diffie-Hellman (ECDH) and specifically by X25519, which provide equivalent security at dramatically smaller key sizes.\n","title":"Diffie-Hellman (DH / ECDH / X25519)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/directory/","section":"Tags","summary":"","title":"Directory","type":"tags"},{"content":"DISA STIGs (Security Technical Implementation Guides) are published by the Defense Information Systems Agency (DISA), the US Department of Defense (DoD) agency responsible for IT infrastructure security standards. STIGs provide extremely prescriptive, line-item security configuration requirements for specific technology products — each STIG contains hundreds of individual \u0026ldquo;findings\u0026rdquo; (rules) specifying exact settings, permissions, and configurations required to harden a system. Unlike flexible frameworks (NIST 800-53) or guideline-oriented benchmarks (CIS), STIGs are mandatory for all DoD information systems and are referenced by the broader US federal government, defense contractors (via CMMC), and intelligence community systems. Each finding is categorized by severity: CAT I (high — failure could directly lead to loss of confidentiality, integrity, or availability), CAT II (medium), and CAT III (low). Systems must achieve full CAT I compliance and substantially address CAT II/III findings to receive an Authority to Operate (ATO). DISA publishes STIGs for hundreds of products and regularly updates them (typically quarterly). STIGs are developed in collaboration with the vendor — Red Hat, for instance, works directly with DISA to produce the RHEL STIG — and are made available to the public through DoD Cyber Exchange (public.cyber.mil). STIG compliance is verified using DISA\u0026rsquo;s STIG Viewer or automated tools like OpenSCAP that consume the machine-readable XCCDF/SCAP content.\nRed Hat has the most comprehensive DISA STIG coverage of any Linux vendor. DISA publishes official STIGs for RHEL 7, 8, 9, and 10, Red Hat OpenShift Container Platform, Red Hat Ansible Automation Controller, and JBoss Enterprise Application Platform — all developed in direct collaboration with Red Hat\u0026rsquo;s security team. Red Hat ships STIG content directly in RHEL: the scap-security-guide package includes the XCCDF profile (xccdf_org.ssgproject.content_profile_stig) enabling administrators to scan and remediate systems using oscap immediately after installation. RHEL can be installed in STIG-compliant mode from day one by selecting the STIG profile during the Anaconda installer\u0026rsquo;s security policy selection. For OpenShift, the Compliance Operator provides dedicated STIG profiles (ocp4-stig, ocp4-stig-node, rhcos4-stig) supporting the latest DISA STIG V2R3, automating cluster-wide scanning and producing machine-readable results suitable for upload to DoD\u0026rsquo;s eMASS (Enterprise Mission Assurance Support Service). Red Hat\u0026rsquo;s STIG implementation requires FIPS mode to be enabled (a prerequisite DISA mandates), which RHEL supports natively. The combination of RHEL\u0026rsquo;s built-in STIG content, OpenShift\u0026rsquo;s Compliance Operator, and Ansible\u0026rsquo;s ability to enforce STIG configurations at scale means DoD organizations and defense contractors can achieve and maintain STIG compliance as a continuous, automated property of their infrastructure rather than a periodic manual exercise.\nAdditional Information # DISA STIGs - DoD Cyber Exchange Red Hat DISA STIG - Customer Portal DISA STIG for Red Hat Enterprise Linux 9 OpenShift Compliance Operator STIG profiles ","externalUrl":null,"permalink":"/en/compliance/disa-stig/","section":"Index","summary":"DISA STIGs (Security Technical Implementation Guides) are published by the Defense Information Systems Agency (DISA), the US Department of Defense (DoD) agency responsible for IT infrastructure security standards. STIGs provide extremely prescriptive, line-item security configuration requirements for specific technology products — each STIG contains hundreds of individual “findings” (rules) specifying exact settings, permissions, and configurations required to harden a system. Unlike flexible frameworks (NIST 800-53) or guideline-oriented benchmarks (CIS), STIGs are mandatory for all DoD information systems and are referenced by the broader US federal government, defense contractors (via CMMC), and intelligence community systems. Each finding is categorized by severity: CAT I (high — failure could directly lead to loss of confidentiality, integrity, or availability), CAT II (medium), and CAT III (low). Systems must achieve full CAT I compliance and substantially address CAT II/III findings to receive an Authority to Operate (ATO). DISA publishes STIGs for hundreds of products and regularly updates them (typically quarterly). STIGs are developed in collaboration with the vendor — Red Hat, for instance, works directly with DISA to produce the RHEL STIG — and are made available to the public through DoD Cyber Exchange (public.cyber.mil). STIG compliance is verified using DISA’s STIG Viewer or automated tools like OpenSCAP that consume the machine-readable XCCDF/SCAP content.\n","title":"DISA STIG","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/distributed-serving/","section":"Tags","summary":"","title":"Distributed-Serving","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/distributed-training/","section":"Tags","summary":"","title":"Distributed-Training","type":"tags"},{"content":"dm-verity is a Linux device mapper target, available since kernel 3.4, that provides transparent read-only integrity verification for block devices. When a block device is mapped through dm-verity, every data block read from the underlying device is verified against a pre-computed Merkle tree of cryptographic hashes before being returned to the caller — any modification to any block, whether from corruption, bit rot, or deliberate tampering, produces a hash mismatch that dm-verity detects and handles according to its configured error mode. The verification is transparent to the filesystem and applications mounted above it: they read from the dm-verity device as if it were a normal block device, with no awareness that every read is being hash-checked. The security guarantee is that the integrity of the entire block device is committed to by a single root hash — a 32-byte SHA-256 value that covers the entire Merkle tree and therefore the entire data volume. If the root hash is known to be correct (because it was measured into a TPM PCR, embedded in a UKI, or signed by a Secure Boot key), then any verified read from the dm-verity device is guaranteed to return exactly the data that was present when the Merkle tree was computed.\nThe Merkle tree structure makes verification efficient. The data blocks are divided into fixed-size chunks (4096 bytes by default, matching the typical filesystem block size); each chunk\u0026rsquo;s SHA-256 hash forms a leaf node. Leaf hashes are concatenated in groups and hashed again to form the next tree level, continuing until a single root hash remains. The hash tree itself is stored in a separate contiguous region on the same device (or on a separate device), and dm-verity caches recently verified hash blocks in memory, so the amortised cost of verification is dominated by a small number of tree-level hash reads per data block access rather than a full tree traversal. The veritysetup format command (from cryptsetup) computes the hash tree and returns the root hash; veritysetup create establishes the dm-verity device mapping with the root hash as a parameter that the kernel verifies at mount time against the stored tree. Once established, the dm-verity mapping is read-only and the root hash is fixed — any attempt to write through it is rejected. Error handling offers three modes: ignore (pass the corrupted data to the caller and log), restart (trigger a kernel panic and reboot, used in production Android and Chrome OS), and panic (immediate kernel panic). Production deployments universally use restart or panic because ignore defeats the security model.\ndm-verity is the block-level integrity primitive that enables verified, immutable OS deployments at scale. In Android Verified Boot, the system and vendor partitions are dm-verity protected with root hashes stored in the boot partition and measured into the boot attestation chain — modifying a system file produces a hash mismatch that causes the device to refuse to boot into a verified state. In Chrome OS, all OS partitions are dm-verity protected, with the root hash embedded in the read-only firmware; updates replace the entire partition and recompute the tree. In bootc-based image Linux deployments, dm-verity complements composefs: dm-verity protects the block device layer where the OSTree object store lives, while composefs provides the file-level verified overlay on top. The key difference between dm-verity and fs-verity is their layer of operation: dm-verity operates below the filesystem, protecting arbitrary block devices, and cannot share data between images (two dm-verity volumes containing the same file use separate, non-shared blocks); fs-verity operates at the individual file level within a filesystem, enabling the per-file content addressing and sharing that composefs uses. dm-verity\u0026rsquo;s performance cost is minimal on sequential reads (hash tree levels are cached) but is more noticeable on random small-block I/O workloads where cache miss rates are higher — SSD-backed deployments typically see less than 5% overhead; spinning-disk deployments can see 10–20% on random workloads.\n","externalUrl":null,"permalink":"/en/security/dm-verity/","section":"Index","summary":"dm-verity is a Linux device mapper target, available since kernel 3.4, that provides transparent read-only integrity verification for block devices. When a block device is mapped through dm-verity, every data block read from the underlying device is verified against a pre-computed Merkle tree of cryptographic hashes before being returned to the caller — any modification to any block, whether from corruption, bit rot, or deliberate tampering, produces a hash mismatch that dm-verity detects and handles according to its configured error mode. The verification is transparent to the filesystem and applications mounted above it: they read from the dm-verity device as if it were a normal block device, with no awareness that every read is being hash-checked. The security guarantee is that the integrity of the entire block device is committed to by a single root hash — a 32-byte SHA-256 value that covers the entire Merkle tree and therefore the entire data volume. If the root hash is known to be correct (because it was measured into a TPM PCR, embedded in a UKI, or signed by a Secure Boot key), then any verified read from the dm-verity device is guaranteed to return exactly the data that was present when the Merkle tree was computed.\n","title":"dm-verity","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/doca/","section":"Tags","summary":"","title":"Doca","type":"tags"},{"content":"DOCA (Data Center Infrastructure on a Chip Architecture) is NVIDIA\u0026rsquo;s software framework for building and operating services on BlueField DPUs. Its objective is to standardize how operators and ISVs develop infrastructure applications—OVS offload, firewall/VNF, storage targets, RDMA/RoCE control, TLS inspection, telemetry agents—on Arm cores and hardware accelerators embedded in the NIC, using a consistent set of libraries instead of ad hoc kernel modules on the host. DOCA spans drivers, userspace APIs, reference pipelines, and marketplace-packaged applications; it is the DPU counterpart to CUDA on GPUs, oriented toward I/O and packet processing rather than tensor math.\nArchitecturally, DOCA exposes programmable pipelines (match-action tables, flow steering), Comm Channel interaction between host and DPU, GPUNetIO/RDMA hooks where relevant, and security services (IPsec, TLS, RegEx) that execute on fixed-function blocks. The host CPU runs tenant VMs, Kubernetes, and GPU workloads; the DPU CPU runs the DOCA runtime and infrastructure containers with a separate root of trust. Compared with implementing the same functions on the host, latency to the wire is lower and blast radius is smaller because compromise of a tenant workload does not automatically grant kernel networking privileges on the dataplane. Compared with a GPU, DOCA never targets FP32/FP16 matrix throughput; it targets line-rate packets, connection state, and east-west policy at 100–400 GbE scale.\nRed Hat supports DOCA in conjunction with RHEL on BlueField and OpenShift-based deployments. Operators can run RHEL on the DPU Arm cores, use DOCA applications for accelerated networking and security, and manage the host with the same RHEL/OpenShift lifecycle tooling. Red Hat and NVIDIA publish guidance for Open vSwitch offload, IPsec, cloud-native networking, and zero-trust segmentation using DOCA on OpenShift. The value for AI platforms is operational: GPU nodes stay focused on models while DOCA-backed DPUs handle cluster networking, storage initiation, and policy enforcement with a supported Linux stack on both sides of the split.\nAdditional Informnation # DPU-enabled networking with OpenShift and NVIDIA DPF (Mar 20, 2025) NVIDIA OVS-DOCA on OpenShift (Nov 24, 2025) NVIDIA OVS-DOCA via On-Cluster Layer OpenShift (May 7, 2026) ","externalUrl":null,"permalink":"/en/ai/doca/","section":"Index","summary":"DOCA (Data Center Infrastructure on a Chip Architecture) is NVIDIA’s software framework for building and operating services on BlueField DPUs. Its objective is to standardize how operators and ISVs develop infrastructure applications—OVS offload, firewall/VNF, storage targets, RDMA/RoCE control, TLS inspection, telemetry agents—on Arm cores and hardware accelerators embedded in the NIC, using a consistent set of libraries instead of ad hoc kernel modules on the host. DOCA spans drivers, userspace APIs, reference pipelines, and marketplace-packaged applications; it is the DPU counterpart to CUDA on GPUs, oriented toward I/O and packet processing rather than tensor math.\n","title":"DOCA (Data Center Infrastructure on a Chip Architecture)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/dod/","section":"Tags","summary":"","title":"Dod","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/dpdk/","section":"Tags","summary":"","title":"Dpdk","type":"tags"},{"content":"The Data Plane Development Kit (DPDK) is an open-source set of libraries and poll-mode drivers (PMDs) that move packet processing from the kernel to userspace, enabling telco and cloud applications to achieve millions of packets per second per core with predictable latency. DPDK bypasses the traditional socket stack: applications busy-poll NIC queues (or virtio/vhost rings), use hugepages to reduce TLB misses, and pin threads to NUMA-local cores — a model suited to UPF, vRouter, CG-NAT, load balancers, and 5G user-plane functions where per-packet syscall overhead is unacceptable.\nCore building blocks include Environment Abstraction Layer (EAL) for initialization and device discovery, mbuf memory pools, rte_ring queues, Hash/LPM/FIB libraries, eventdev and cryptodev for pipelines, and GPU/offload hooks in newer releases. PMDs exist for Intel, Broadcom, Mellanox/NVIDIA, Marvell, virtio, vhost-user (to OVS or VPP), and AF_XDP (hybrid kernel/userspace). Integration patterns:\nPattern Description DPDK on SR-IOV VF Dedicated NIC queues to container/VM vhost-user / virtio-user Connection to OVS-DPDK or VPP AF_PACKET / AF_XDP Lower setup cost; moderate performance DPDK in Kubernetes Userspace CNI, device plugins, Sriov-DPDK OVS-DPDK, FD.io VPP, TRex, and commercial CNFs (UPF, firewall) build on DPDK. Telco cloud-native packaging often combines DPDK dataplane containers with Kubernetes CPU isolation, hugepage emptyDir/limits, and IRQ tuning. Challenges: CPU consumption at low load (polling), debugging complexity, kernel bypass security surface, and version coupling between DPDK, NIC firmware, and distro kernels.\nDPDK is maintained by the Linux Foundation with contributions from Intel, NVIDIA, Marvell, Red Hat, and operators; it remains the de facto foundation for high-performance userspace networking alongside eBPF/XDP for complementary kernel-side fast paths.\nAdditional Information # DPDK Project DPDK Programmer’s Guide FD.io VPP (often used with DPDK) ","externalUrl":null,"permalink":"/en/telco/dpdk/","section":"Index","summary":"The Data Plane Development Kit (DPDK) is an open-source set of libraries and poll-mode drivers (PMDs) that move packet processing from the kernel to userspace, enabling telco and cloud applications to achieve millions of packets per second per core with predictable latency. DPDK bypasses the traditional socket stack: applications busy-poll NIC queues (or virtio/vhost rings), use hugepages to reduce TLB misses, and pin threads to NUMA-local cores — a model suited to UPF, vRouter, CG-NAT, load balancers, and 5G user-plane functions where per-packet syscall overhead is unacceptable.\n","title":"DPDK","type":"telco"},{"content":"","externalUrl":null,"permalink":"/en/tags/dpu/","section":"Tags","summary":"","title":"Dpu","type":"tags"},{"content":"A DPU (Data Processing Unit)—also marketed as an infrastructure processing unit or SmartNIC—is a programmable accelerator placed on the network path between servers and the fabric. Its objective is to offload infrastructure work that would otherwise consume host CPU cycles and pollute caches: virtual switching (OVS), overlay encapsulation (VXLAN/Geneve), storage initiation (NVMe-oF), firewalling, TLS termination, telemetry export, and increasingly zero-trust policy enforcement. In AI clusters, DPUs help preserve GPU servers for model compute by moving east-west networking, storage, and security functions to the NIC. A DPU is not a replacement for a training GPU; it complements it by making the surrounding data-center network and storage stack more efficient and isolatable.\nArchitecturally, a DPU combines Arm (or other) CPU cores, fixed-function network engines (RDMA, regex, crypto), and sometimes GPUs or AI engines on a single card, with direct access to host memory and PCIe switching. Software on the DPU runs a full Linux (or RTOS) stack and can host containers or micro-VMs independent of the host OS. Compared with a CPU on the server, the DPU executes dataplane and control-plane tasks at line rate without competing with application threads for last-level cache or NUMA locality; compared with a GPU, it targets I/O and packet processing rather than dense linear algebra. The host sees a standard NIC or virtio device while heavy lifting happens on-card; DOCA and vendor SDKs expose this split explicitly through APIs for flow programming, RDMA, and security services.\nRed Hat supports DPU deployments through RHEL on the DPU (Arm) and on x86 hosts, OpenShift / OpenShift Container Platform for hybrid cloud, and networking integrations (SR-IOV, NMState, Multus, where applicable). Red Hat collaborates with NVIDIA on BlueField DPUs: RHEL runs on the DPU, while OpenShift can offload virtual switching and security functions to DOCA-based services. Documentation and reference designs cover split-host models (DPU as infrastructure domain, host as tenant/GPU domain), helping operators adopt DPUs without abandoning the same RHEL/OpenShift operational model used elsewhere in the fleet.\n","externalUrl":null,"permalink":"/en/ai/dpu/","section":"Index","summary":"A DPU (Data Processing Unit)—also marketed as an infrastructure processing unit or SmartNIC—is a programmable accelerator placed on the network path between servers and the fabric. Its objective is to offload infrastructure work that would otherwise consume host CPU cycles and pollute caches: virtual switching (OVS), overlay encapsulation (VXLAN/Geneve), storage initiation (NVMe-oF), firewalling, TLS termination, telemetry export, and increasingly zero-trust policy enforcement. In AI clusters, DPUs help preserve GPU servers for model compute by moving east-west networking, storage, and security functions to the NIC. A DPU is not a replacement for a training GPU; it complements it by making the surrounding data-center network and storage stack more efficient and isolatable.\n","title":"DPU (Data Processing Unit)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/dracut/","section":"Tags","summary":"","title":"Dracut","type":"tags"},{"content":"E-ITS (Eesti infoturbestandard — Estonian Information Security Standard) is Estonia\u0026rsquo;s national information security framework, developed and maintained by the RIA (Riigi Infosüsteemi Amet — Information System Authority). It replaced the previous ISKE (Infosüsteemide kolmeastmeline etalonturbe süsteem) system, which was in effect until 31 December 2022. E-ITS entered into force in December 2022 and is mandatory for all organizations performing public duties in Estonia — state agencies, local governments, and any entity operating information systems essential for the functioning of society. Private organizations may also voluntarily adopt E-ITS to achieve their information security goals. The standard is based on the German BSI IT-Grundschutz baseline protection methodology and is designed to be fully compatible with ISO/IEC 27001 — an audited E-ITS conformity allows organizations to demonstrate compliance equivalent to the international standard. E-ITS presents a baseline protection catalog containing security modules with specific measures, organized by asset type (IT systems, networks, applications, industrial automation, vehicles, etc.). Organizations must identify their assets, determine protection needs, apply the corresponding baseline measures, and undergo periodic audits. Alternatively, organizations may satisfy their obligation by holding a valid ISO/IEC 27001 certificate and submitting it to RIA. The standard is updated annually each autumn to reflect new threats and technological developments, and RIA provides a free support application (based on the 2024 version) to guide implementers through the process.\nRed Hat\u0026rsquo;s relevance to E-ITS stems from its deployment in Estonian public sector IT infrastructure and the standard\u0026rsquo;s technical alignment with BSI IT-Grundschutz, for which Red Hat has established support. Since E-ITS inherits its structure and methodology from Grundschutz, Red Hat\u0026rsquo;s capabilities map directly: the baseline protection modules covering operating systems, container platforms, and network services correspond to RHEL and OpenShift security features. RHEL\u0026rsquo;s OpenSCAP tooling can assess systems against baselines derived from the E-ITS catalog (via its Grundschutz heritage), SELinux enforces the access control requirements E-ITS modules prescribe, and system-wide cryptographic policies satisfy the encryption measures defined in the standard. For organizations choosing the ISO 27001 compliance path (which E-ITS explicitly accepts as equivalent), Red Hat\u0026rsquo;s Compliance Operator, Ansible-enforced configurations, and documented security architecture provide the technical evidence needed for ISO 27001 certification — simultaneously satisfying E-ITS obligations. The annual update cycle of E-ITS means that organizations must continuously maintain their security posture rather than treating compliance as a point-in-time exercise; Red Hat\u0026rsquo;s continuous compliance tooling (automated scanning, drift detection, policy-as-code remediation) is specifically designed for this operational model. As Estonia continues to lead in digital government and align E-ITS with EU-wide requirements (NIS2, CRA), Red Hat\u0026rsquo;s platform provides a stable, auditable foundation that evolves alongside the standard.\nAdditional Information # E-ITS - RIA E-ITS Support Application ITVaatlik - E-ITS for public sector ","externalUrl":null,"permalink":"/en/compliance/e-its/","section":"Index","summary":"E-ITS (Eesti infoturbestandard — Estonian Information Security Standard) is Estonia’s national information security framework, developed and maintained by the RIA (Riigi Infosüsteemi Amet — Information System Authority). It replaced the previous ISKE (Infosüsteemide kolmeastmeline etalonturbe süsteem) system, which was in effect until 31 December 2022. E-ITS entered into force in December 2022 and is mandatory for all organizations performing public duties in Estonia — state agencies, local governments, and any entity operating information systems essential for the functioning of society. Private organizations may also voluntarily adopt E-ITS to achieve their information security goals. The standard is based on the German BSI IT-Grundschutz baseline protection methodology and is designed to be fully compatible with ISO/IEC 27001 — an audited E-ITS conformity allows organizations to demonstrate compliance equivalent to the international standard. E-ITS presents a baseline protection catalog containing security modules with specific measures, organized by asset type (IT systems, networks, applications, industrial automation, vehicles, etc.). Organizations must identify their assets, determine protection needs, apply the corresponding baseline measures, and undergo periodic audits. Alternatively, organizations may satisfy their obligation by holding a valid ISO/IEC 27001 certificate and submitting it to RIA. The standard is updated annually each autumn to reflect new threats and technological developments, and RIA provides a free support application (based on the 2024 version) to guide implementers through the process.\n","title":"E-ITS / ISKE (Estonian Information Security Standard)","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/eap/","section":"Tags","summary":"","title":"Eap","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ebpf/","section":"Tags","summary":"","title":"Ebpf","type":"tags"},{"content":"eBPF (Extended Berkeley Packet Filter) is a Linux kernel subsystem, its modern form dating to kernel 3.18 (2014), that allows user-authored programs to run inside the kernel with near-native performance, subject to safety guarantees enforced at load time by a verifier. The name is historical: the original BPF (Berkeley Packet Filter, 1992) was a narrow packet filtering mechanism for tools like tcpdump. eBPF extended the instruction set, registers, and capabilities far beyond packet filtering into a general-purpose in-kernel programmability platform. The central design constraint is that eBPF programs must be provably safe: they cannot crash the kernel, loop infinitely, or access memory out of bounds. The verifier statically analyses every program at load time, checking that all memory accesses are bounds-checked, all loops are bounded or unrolled, and all pointer dereferences are preceded by null checks. Only programs that pass verification are accepted; once accepted, the kernel JIT-compiles the eBPF bytecode to native machine code for the host architecture — x86-64, ARM64, RISC-V — so eBPF programs run at the same speed as compiled kernel code, not as an interpreter.\nAn eBPF program is defined by its program type, which determines where it attaches and what context it receives. Tracing programs attach to kprobes (dynamic hooks on arbitrary kernel functions, potentially unstable across kernel versions), kretprobes (function return), tracepoints (stable, curated kernel events with a documented ABI), fentry/fexit (BTF-enabled hooks on function entry/exit with lower overhead than kprobes), and uprobes/uretprobes (user-space function entry/return, allowing kernel-side instrumentation of user-space libraries without modifying application code). Networking programs attach to XDP (eXpress Data Path, in the NIC driver\u0026rsquo;s receive path before the kernel allocates a socket buffer — the earliest possible intervention point, capable of line-rate packet processing for load balancing, DDoS mitigation, and firewall), TC (Traffic Control, deeper in the kernel\u0026rsquo;s networking stack, for both ingress and egress), and socket operations hooks. Security programs attach to LSM hooks (BPF LSM, kernel 5.7) to implement custom MAC policy stacked alongside SELinux or AppArmor. cgroup programs attach to cgroup ingress/egress and socket creation hooks. State is shared between eBPF programs and with user space through eBPF maps — typed, kernel-managed key-value stores (hash maps, arrays, LRU maps, ring buffers, per-CPU maps) that persist across program invocations. CO-RE (Compile Once, Run Everywhere), enabled by BTF (BPF Type Format) metadata embedded in the kernel, allows eBPF programs compiled against one kernel version to run on different kernels without recompilation, resolving the portability problem that plagued earlier eBPF tooling.\nThe ecosystem built on eBPF covers all three layers of the infrastructure stack in this glossary. In networking, Cilium uses eBPF to implement Kubernetes network policy, service load balancing, and pod-to-pod encryption at XDP/TC, replacing iptables with a fully programmable data plane that scales to tens of thousands of pods without iptables rule explosion; Hubble builds on Cilium\u0026rsquo;s eBPF programs to provide network flow observability with pod and namespace context. In observability, tools like Pixie, Parca, Falco, and bpftrace use kprobes, uprobes, and tracepoints to collect system call traces, CPU profiles, memory allocations, and application-layer HTTP/gRPC/SQL events without any application instrumentation, with sub-microsecond overhead. In security, BPF LSM programs provide per-workload policy enforced inside the kernel, the Security Profiles Operator uses eBPF to record syscall profiles for seccomp generation, and Falco\u0026rsquo;s kernel driver uses eBPF to detect anomalous behaviour (unexpected execve, network connections from unexpected processes, privilege escalation attempts) with full container and pod context. The relationship to seccomp is complementary: seccomp operates on a static allowlist evaluated per-syscall with no kernel-side logic; eBPF LSM and tracing programs can express dynamic, context-aware policy (allow open() only for files under /app/data, deny connect() to IP ranges outside the pod\u0026rsquo;s expected endpoints) that seccomp\u0026rsquo;s BPF dialect cannot. The cost of this power is the CAP_BPF or CAP_SYS_ADMIN capability required to load eBPF programs — which is why the default container seccomp profile blocks the bpf() syscall, and why the decision to grant a workload eBPF loading privileges is a significant trust decision.\n","externalUrl":null,"permalink":"/en/security/ebpf/","section":"Index","summary":"eBPF (Extended Berkeley Packet Filter) is a Linux kernel subsystem, its modern form dating to kernel 3.18 (2014), that allows user-authored programs to run inside the kernel with near-native performance, subject to safety guarantees enforced at load time by a verifier. The name is historical: the original BPF (Berkeley Packet Filter, 1992) was a narrow packet filtering mechanism for tools like tcpdump. eBPF extended the instruction set, registers, and capabilities far beyond packet filtering into a general-purpose in-kernel programmability platform. The central design constraint is that eBPF programs must be provably safe: they cannot crash the kernel, loop infinitely, or access memory out of bounds. The verifier statically analyses every program at load time, checking that all memory accesses are bounds-checked, all loops are bounded or unrolled, and all pointer dereferences are preceded by null checks. Only programs that pass verification are accepted; once accepted, the kernel JIT-compiles the eBPF bytecode to native machine code for the host architecture — x86-64, ARM64, RISC-V — so eBPF programs run at the same speed as compiled kernel code, not as an interpreter.\n","title":"eBPF (Extended Berkeley Packet Filter)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/ecc/","section":"Tags","summary":"","title":"Ecc","type":"tags"},{"content":"Elliptic Curve Cryptography (ECC) is a family of public-key cryptographic algorithms built on the mathematics of elliptic curves over finite fields. Its security rests on the Elliptic Curve Discrete Logarithm Problem (ECDLP): given a public point Q = k × G on a curve (where G is a fixed base point and k is the private key scalar), recovering k from Q and G is computationally infeasible on classical computers. The practical advantage over RSA is dramatic key size efficiency: a 256-bit ECC key provides roughly the same classical security as a 3072-bit RSA key, because the best known classical algorithms for ECDLP (Pollard\u0026rsquo;s rho) are exponential whereas the best RSA algorithms (GNFS) are sub-exponential. This size difference has compounding benefits — smaller keys mean faster operations, smaller certificates, smaller TLS handshake messages, and lower power consumption on constrained devices. ECC is now the dominant choice for all new asymmetric cryptography deployments: TLS 1.3 mandates ECDHE for key exchange, and ECDSA or EdDSA for authentication; SSH defaults to Ed25519; code signing infrastructure increasingly uses ECDSA P-256 or Ed25519.\nThe specific security and behaviour of an ECC scheme depends entirely on the curve chosen. The most widely deployed curves are: P-256 (also called secp256r1 or prime256v1, an NIST/FIPS-standardised curve, the default in most TLS deployments and X.509 certificates), P-384 (NIST curve, required by NSA CNSA 1.0 for top-secret data, slower than P-256 with more conservative security margin), P-521 (NIST curve, highest classical security, rarely deployed), X25519 (Bernstein\u0026rsquo;s Curve25519 used for Diffie-Hellman key exchange, designed for safety and performance with a simple constant-time implementation, default in TLS 1.3 key exchange and WireGuard), and Ed25519 (Edwards-form Curve25519 used for EdDSA signatures, the default SSH host key and user key algorithm since OpenSSH 6.5, notably faster and simpler to implement safely than ECDSA). The NIST P-curves carry a lingering concern among cryptographers about the verifiability of their parameter generation (\u0026ldquo;nothing up my sleeve\u0026rdquo; questions about seed values), whereas Curve25519/Ed25519 have fully transparent, verifiable parameter generation — an important consideration for high-assurance deployments.\nLike RSA, all ECC algorithms — ECDH, ECDSA, EdDSA — are broken by Shor\u0026rsquo;s algorithm on a CRQC. The ECDLP is no harder than integer factorisation against a quantum adversary; Shor\u0026rsquo;s algorithm solves both in polynomial time. NIST IR 8547 designates all ECC-based algorithms for deprecation in new systems after 2030 and disallowance after 2035. The HNDL threat is particularly relevant for ECDH key exchange in TLS sessions recorded today: although TLS 1.3 provides forward secrecy (ephemeral ECDHE), the session key is only as quantum-safe as the key exchange algorithm, and ECDHE is not. The migration path replaces X25519/ECDHE with ML-KEM for key encapsulation (currently deployed in hybrid X25519MLKEM768 form in TLS 1.3) and ECDSA/EdDSA with ML-DSA for signatures. The hybrid transition period, where both an ECC share and an ML-KEM share are combined in the key exchange so the session is secure against both classical and quantum attackers simultaneously, is the standard recommended by NIST and already deployed by default in Chrome 131+ and available in OpenSSL 3.4+.\n","externalUrl":null,"permalink":"/en/security/ecc/","section":"Index","summary":"Elliptic Curve Cryptography (ECC) is a family of public-key cryptographic algorithms built on the mathematics of elliptic curves over finite fields. Its security rests on the Elliptic Curve Discrete Logarithm Problem (ECDLP): given a public point Q = k × G on a curve (where G is a fixed base point and k is the private key scalar), recovering k from Q and G is computationally infeasible on classical computers. The practical advantage over RSA is dramatic key size efficiency: a 256-bit ECC key provides roughly the same classical security as a 3072-bit RSA key, because the best known classical algorithms for ECDLP (Pollard’s rho) are exponential whereas the best RSA algorithms (GNFS) are sub-exponential. This size difference has compounding benefits — smaller keys mean faster operations, smaller certificates, smaller TLS handshake messages, and lower power consumption on constrained devices. ECC is now the dominant choice for all new asymmetric cryptography deployments: TLS 1.3 mandates ECDHE for key exchange, and ECDSA or EdDSA for authentication; SSH defaults to Ed25519; code signing infrastructure increasingly uses ECDSA P-256 or Ed25519.\n","title":"ECC (Elliptic Curve Cryptography)","type":"security"},{"content":"ECDSA (Elliptic Curve Digital Signature Algorithm) is the elliptic curve analogue of DSA, standardised in FIPS 186 and the IETF, that produces digital signatures using a private key and verifies them with the corresponding public key. It is the most widely deployed signature algorithm in X.509 certificates (P-256 with SHA-256 is the default for certificate authorities issuing TLS certificates), in code signing (Authenticode, macOS, Linux package signing), in TLS 1.3 certificate authentication, in SSH host keys and user keys (though Ed25519 is increasingly preferred), and in blockchain and cryptocurrency systems. An ECDSA signature over a message m with private key d on curve with base point G produces a pair (r, s), where r is the x-coordinate of an ephemeral public key k × G and s encodes the relationship between the message hash, r, the private key d, and the nonce k. Verification requires only the public key Q = d × G and is fast; signing requires the private key and a nonce.\nECDSA\u0026rsquo;s most important operational characteristic — and its most dangerous — is its per-signature nonce requirement. Each signature requires a freshly generated, cryptographically random, secret, and unique scalar k. If k is ever reused across two signatures with the same private key (even accidentally, due to a broken random number generator), the private key can be algebraically recovered from the two signatures alone — no other information is needed. This vulnerability has been exploited in practice: the PlayStation 3 used a constant k in ECDSA, allowing its signing key to be extracted; similar attacks have recovered Bitcoin private keys from wallets using weak entropy. The safe solution is RFC 6979 deterministic ECDSA, which derives k deterministically from the message hash and private key using HMAC-DRBG, eliminating the random number dependency and making signatures reproducible without sacrificing security. Alternatively, EdDSA (Ed25519, Ed448) solves this problem architecturally by using a hash-based nonce derived from the private key and message — making it impossible to accidentally reuse a nonce — which is why EdDSA is generally preferred over ECDSA for new deployments where the curve choices overlap. ECDSA signatures are compact: a P-256 ECDSA signature is 64 bytes (two 32-byte integers encoded as DER adds overhead to 70–72 bytes), compared to 256 bytes for a 2048-bit RSA signature.\nECDSA\u0026rsquo;s quantum vulnerability is identical to ECC\u0026rsquo;s generally: Shor\u0026rsquo;s algorithm recovers the private key from the public key, making every ECDSA key — at any curve size — breakable by a CRQC. NIST IR 8547 designates ECDSA for deprecation in new systems after 2030. The HNDL threat applies specifically to ECDSA signatures on long-lived artifacts: code signing certificates with multi-year validity, CA certificates with decade-long lifetimes, and firmware update signatures that must remain verifiable on deployed hardware years from now. A signed firmware image whose signature was produced with a P-256 ECDSA key today will be forgeable — and therefore unsafely upgradeable — once a CRQC can recover that signing key. The replacement is ML-DSA for new signatures, with ECDSA retained only during the hybrid transition period where both an ECDSA and an ML-DSA signature are produced and both verified. cert-manager and Vault\u0026rsquo;s PKI engine are the primary automation paths for migrating X.509 certificate issuance from ECDSA P-256 to ML-DSA across a Kubernetes or enterprise infrastructure.\n","externalUrl":null,"permalink":"/en/security/ecdsa/","section":"Index","summary":"ECDSA (Elliptic Curve Digital Signature Algorithm) is the elliptic curve analogue of DSA, standardised in FIPS 186 and the IETF, that produces digital signatures using a private key and verifies them with the corresponding public key. It is the most widely deployed signature algorithm in X.509 certificates (P-256 with SHA-256 is the default for certificate authorities issuing TLS certificates), in code signing (Authenticode, macOS, Linux package signing), in TLS 1.3 certificate authentication, in SSH host keys and user keys (though Ed25519 is increasingly preferred), and in blockchain and cryptocurrency systems. An ECDSA signature over a message m with private key d on curve with base point G produces a pair (r, s), where r is the x-coordinate of an ephemeral public key k × G and s encodes the relationship between the message hash, r, the private key d, and the nonce k. Verification requires only the public key Q = d × G and is fast; signing requires the private key and a nonce.\n","title":"ECDSA (Elliptic Curve Digital Signature Algorithm)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/edge/","section":"Tags","summary":"","title":"Edge","type":"tags"},{"content":"Edge computing in telecommunications places compute, storage, and application execution close to users and devices — at cell sites, regional points of presence, or on-prem enterprise locations — rather than only in distant hyperscale data centres. The goal is to reduce end-to-end latency, limit backhaul load, satisfy data residency, and enable real-time applications (AR/VR, industrial control, V2X, video analytics) that are impractical with 50–100 ms round trips to central clouds. In 5G, edge is tightly coupled to the user plane: a local UPF on N6 breakout forwards traffic to an edge data network (DN) hosting MEC applications without hairpinning through the operator’s core hub.\nETSI Multi-access Edge Computing (MEC) defines a reference architecture: MEC platform (virtualisation, app lifecycle), MEC orchestrator, MEC app APIs (MxP), and exposure of RAN information (radio conditions, location) to applications via standardised services. 3GPP complements this with NEF exposure, LADN (Local Area Data Network), and ULCL / multi-homed PDU sessions for selective traffic steering. Hyperscalers (AWS Wavelength, Azure Edge Zones, Google Distributed Cloud Edge) and telco edge (Ericsson Edge, Nokia MX Industrial Edge, Vapor IO, etc.) offer Kubernetes or VM footprints at the edge, often co-located with vRAN or UPF on M-CORD / O-RAN-style infrastructure.\nLayer Role Device / UE Generates traffic; may run light edge (e.g. AI on device) RAN + local UPF Anchors session; steers flows to local DN MEC platform Hosts apps, provides RAN exposure APIs Central cloud Training, orchestration, non-latency-sensitive workloads Private 5G, Open RAN, and cloud-native 5GC accelerate edge adoption by making UPF and CU/DU cloud-packaged and geographically distributable. Operational challenges include fragmented footprints (many small sites), application portability, security zoning between tenant workloads, and consistent observability across edge and core. Edge is not universally required — many 5G services still use centralised UPF — but it is essential for advertised ultra-low latency and on-site industrial scenarios.\nAdditional Information # ETSI MEC 3GPP TS 23.548 – Edge computing enhancements GSMA Edge Computing ","externalUrl":null,"permalink":"/en/telco/edge-computing/","section":"Index","summary":"Edge computing in telecommunications places compute, storage, and application execution close to users and devices — at cell sites, regional points of presence, or on-prem enterprise locations — rather than only in distant hyperscale data centres. The goal is to reduce end-to-end latency, limit backhaul load, satisfy data residency, and enable real-time applications (AR/VR, industrial control, V2X, video analytics) that are impractical with 50–100 ms round trips to central clouds. In 5G, edge is tightly coupled to the user plane: a local UPF on N6 breakout forwards traffic to an edge data network (DN) hosting MEC applications without hairpinning through the operator’s core hub.\n","title":"Edge Computing","type":"telco"},{"content":"","externalUrl":null,"permalink":"/en/tags/edge-computing/","section":"Tags","summary":"","title":"Edge-Computing","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/email/","section":"Tags","summary":"","title":"Email","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/embedding/","section":"Tags","summary":"","title":"Embedding","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/encryption/","section":"Tags","summary":"","title":"Encryption","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/enisa/","section":"Tags","summary":"","title":"Enisa","type":"tags"},{"content":"The Esquema Nacional de Seguridad (ENS) is Spain\u0026rsquo;s national security framework, currently governed by Royal Decree 311/2022 (effective May 2022, with a transition period that ended April 2024). It is a mandatory regulatory requirement — not a voluntary standard — enforced by Spain\u0026rsquo;s CCN (Centro Criptológico Nacional, part of the CNI intelligence service) and applies to all Spanish public administrations (central, regional, local), as well as private-sector organizations that provide technology services or process data on behalf of the public sector. The ENS defines basic security principles, 16 minimum requirements (covering risk management, access control, incident handling, continuity, personnel security, etc.), and 73 security measures organized in three groups: organizational framework (4 measures), operational framework (31 measures), and protection measures (38 measures). Systems are classified into three categories — Basic, Medium, and High — based on the potential impact of a security incident on each security dimension (confidentiality, integrity, availability, authenticity, traceability). Each category level triggers progressively stricter \u0026ldquo;reinforcement\u0026rdquo; requirements for the applicable measures. Organizations with Medium or High systems must obtain formal certification every two years through an ENAC-accredited auditor, while Basic systems require a self-assessment declaration. The ENS is aligned with ISO/IEC 27001 and is being updated to incorporate NIS2 Directive requirements as Spain transposes the directive through its draft Cybersecurity Coordination and Governance Law (approved by the Council of Ministers in January 2025).\nRed Hat software is deployed across Spanish public administration and the private-sector technology providers serving it — all of whom must comply with the ENS. Red Hat\u0026rsquo;s platform maps to ENS requirements across its three measurement groups. For the operational framework (access control, system exploitation, external services, continuity): RHEL provides PAM-based authentication with SSSD integration, SELinux mandatory access control, system-wide cryptographic policies aligned with CCN-STIC guidelines, and OpenSCAP profiles that can scan systems against ENS-derived baselines. For protection measures (encryption, communications security, audit logging, backup): RHEL\u0026rsquo;s FIPS-capable cryptographic modules, LUKS encryption, auditd subsystem, and Ansible-driven backup automation address ENS requirements at the Base and Reinforced levels. At the platform layer, OpenShift\u0026rsquo;s Compliance Operator can enforce and continuously validate security profiles, namespace isolation provides the compartmentalization ENS demands for Medium and High systems, and RHACS delivers the intrusion detection and incident response capabilities required by the operational framework. For organizations undergoing ENS certification audits, Red Hat\u0026rsquo;s compliance tooling generates the documented evidence trail auditors expect — showing that security measures are not just designed but operationally effective over the audit period. Red Hat\u0026rsquo;s alignment with ISO 27001 (which ENS explicitly references) means customers with dual ISO 27001/ENS requirements can leverage a single Red Hat-based technical implementation to satisfy both frameworks.\nAdditional Information # ENS - Administración Electrónica Real Decreto 311/2022 - BOE CCN-STIC 808 - Verification Guide Strengthening Spain\u0026rsquo;s digital sovereignty: Red Hat Enterprise Linux achieves top-tier ENS security certification (Mar 30, 2026) ","externalUrl":null,"permalink":"/en/compliance/ens/","section":"Index","summary":"The Esquema Nacional de Seguridad (ENS) is Spain’s national security framework, currently governed by Royal Decree 311/2022 (effective May 2022, with a transition period that ended April 2024). It is a mandatory regulatory requirement — not a voluntary standard — enforced by Spain’s CCN (Centro Criptológico Nacional, part of the CNI intelligence service) and applies to all Spanish public administrations (central, regional, local), as well as private-sector organizations that provide technology services or process data on behalf of the public sector. The ENS defines basic security principles, 16 minimum requirements (covering risk management, access control, incident handling, continuity, personnel security, etc.), and 73 security measures organized in three groups: organizational framework (4 measures), operational framework (31 measures), and protection measures (38 measures). Systems are classified into three categories — Basic, Medium, and High — based on the potential impact of a security incident on each security dimension (confidentiality, integrity, availability, authenticity, traceability). Each category level triggers progressively stricter “reinforcement” requirements for the applicable measures. Organizations with Medium or High systems must obtain formal certification every two years through an ENAC-accredited auditor, while Basic systems require a self-assessment declaration. The ENS is aligned with ISO/IEC 27001 and is being updated to incorporate NIS2 Directive requirements as Spain transposes the directive through its draft Cybersecurity Coordination and Governance Law (approved by the Council of Ministers in January 2025).\n","title":"ENS (Esquema Nacional de Seguridad)","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/enterprise/","section":"Tags","summary":"","title":"Enterprise","type":"tags"},{"content":"External Secrets Operator (ESO) is a CNCF incubating project that bridges the gap between Kubernetes-native secrets and enterprise secret management backends. Its premise is that native Kubernetes Secrets — base64-encoded values stored in etcd — are not adequate as a primary secret store: they offer no encryption at rest by default, no access audit trail, no versioning or rotation lifecycle, and no single source of truth across multiple clusters. Rather than replacing Kubernetes Secrets as a consumption mechanism (applications still mount them as environment variables or files in the familiar way), ESO replaces etcd as their source of authority, pulling the real values from a backend that does provide those properties and keeping the Kubernetes Secret as a synchronised, ephemeral projection.\nESO introduces three Custom Resource Definitions that together express the full synchronisation contract. A SecretStore (namespace-scoped) or ClusterSecretStore (cluster-wide) defines how to authenticate with and connect to a specific backend: the provider type, endpoint, and credentials ESO should use. An ExternalSecret declares which keys to fetch from which store, how to map them into a Kubernetes Secret, and a refreshInterval — the polling cadence at which ESO re-fetches the value from the backend and updates the Secret if it has changed. When ESO reconciles an ExternalSecret, it authenticates to the backend using the referenced SecretStore, fetches the specified secret values, and creates or patches a native Secret object in the same namespace. A PushSecret resource (the inverse direction) allows Kubernetes Secrets to be pushed into a backend, enabling bidirectional synchronisation. The provider abstraction is wide: ESO ships support for over 20 backends out of the box — Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, Doppler, Infisical, and many others — with a provider plugin model for the rest. Switching backends requires updating the SecretStore, not application code or ExternalSecret definitions.\nESO is the most commonly used approach for Kubernetes secrets management in GitOps workflows because it cleanly separates the two concerns that Sealed Secrets conflates: the reference (the ExternalSecret manifest, which is safe to commit to Git and contains no secret material) and the value (held in the backend, never in the repository). Its trade-off compared to the Secrets Store CSI Driver is architectural: ESO materialises secrets into native Kubernetes Secret objects, which means they exist in etcd and are accessible via the Kubernetes API to anyone with the appropriate RBAC; the CSI driver avoids etcd entirely by mounting secrets directly into pod filesystems. For most workloads ESO\u0026rsquo;s etcd presence is acceptable — particularly when etcd encryption at rest is configured — and its simpler consumption model (standard env vars and volume mounts, no pod spec changes beyond annotation) makes it the lower-friction choice. For workloads that require secrets to never touch the Kubernetes control plane, the CSI driver is the appropriate alternative.\n","externalUrl":null,"permalink":"/en/security/eso/","section":"Index","summary":"External Secrets Operator (ESO) is a CNCF incubating project that bridges the gap between Kubernetes-native secrets and enterprise secret management backends. Its premise is that native Kubernetes Secrets — base64-encoded values stored in etcd — are not adequate as a primary secret store: they offer no encryption at rest by default, no access audit trail, no versioning or rotation lifecycle, and no single source of truth across multiple clusters. Rather than replacing Kubernetes Secrets as a consumption mechanism (applications still mount them as environment variables or files in the familiar way), ESO replaces etcd as their source of authority, pulling the real values from a backend that does provide those properties and keeping the Kubernetes Secret as a synchronised, ephemeral projection.\n","title":"ESO (External Secrets Operator)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/estonia/","section":"Tags","summary":"","title":"Estonia","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/etcd/","section":"Tags","summary":"","title":"Etcd","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ethernet/","section":"Tags","summary":"","title":"Ethernet","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/eu/","section":"Tags","summary":"","title":"Eu","type":"tags"},{"content":"The European Cybersecurity Certification Scheme for Cloud Services (EUCS) is a certification framework being developed under the 2019 EU Cybersecurity Act (CSA), led by ENISA. It is not yet adopted — the scheme has been in drafting since 2020 and remains stalled as of mid-2026 due to unresolved political disagreements over digital sovereignty requirements. EUCS is designed as an EU-wide, voluntary certification that would harmonize the fragmented national cloud certifications (such as France\u0026rsquo;s SecNumCloud or Germany\u0026rsquo;s C5) into three assurance levels: basic, substantial, and high. It applies to cloud service providers offering IaaS, PaaS, or SaaS on the European market. While EUCS is technically voluntary, its practical impact will be significant because the NIS2 Directive allows Member States to require entities in essential and important sectors to use only EUCS-certified cloud services. The core political controversy centers on whether the \u0026ldquo;high\u0026rdquo; assurance level should include sovereignty requirements — mandating EU headquarters, EU-only data processing, and immunity from non-EU extraterritorial laws (e.g. the US CLOUD Act). A March 2024 draft removed these requirements to achieve technical consensus, but the proposed recast of the Cybersecurity Act (CSA2), tabled in January 2026, would reinstate a formal sovereignty tier, with France leading advocacy for its inclusion.\nRed Hat is impacted by EUCS both as a cloud technology provider and as a platform underlying cloud deployments. Red Hat does not operate hyperscale public cloud infrastructure directly, but Red Hat OpenShift is the application platform running atop — and certified on — all three major EU and US cloud providers, and is also deployed on-premises and at sovereign cloud operators. If EUCS mandates sovereignty criteria at the \u0026ldquo;high\u0026rdquo; level, the immediate impact falls on the CSPs themselves (AWS, Azure, GCP, OVHcloud, etc.), but Red Hat\u0026rsquo;s positioning enables customers to meet sovereignty objectives by running OpenShift on EU-headquartered infrastructure without changing their application stack. Red Hat\u0026rsquo;s open source model and absence of proprietary lock-in align well with the sovereignty principle of immunity from non-EU legal interference — no single vendor\u0026rsquo;s jurisdiction decision forces a platform migration. For the technical cybersecurity requirements at all EUCS assurance levels (encryption, key management, access control, auditability), Red Hat provides foundational capabilities: FIPS 140-3 validated cryptographic modules in RHEL, SELinux mandatory access control, the Compliance Operator for automated CIS/STIG profile enforcement on OpenShift, and full audit-log infrastructure. Organizations preparing for eventual EUCS certification can leverage Red Hat\u0026rsquo;s portfolio to demonstrate technical compliance at the platform layer regardless of which cloud hosts the workload.\nAdditional Information # EUCS candidate scheme status - ENISA EU CSA: Cybersecurity Act - OpenKRITIS EU Cloud Certification at an Impasse - cep ","externalUrl":null,"permalink":"/en/compliance/eucs/","section":"Index","summary":"The European Cybersecurity Certification Scheme for Cloud Services (EUCS) is a certification framework being developed under the 2019 EU Cybersecurity Act (CSA), led by ENISA. It is not yet adopted — the scheme has been in drafting since 2020 and remains stalled as of mid-2026 due to unresolved political disagreements over digital sovereignty requirements. EUCS is designed as an EU-wide, voluntary certification that would harmonize the fragmented national cloud certifications (such as France’s SecNumCloud or Germany’s C5) into three assurance levels: basic, substantial, and high. It applies to cloud service providers offering IaaS, PaaS, or SaaS on the European market. While EUCS is technically voluntary, its practical impact will be significant because the NIS2 Directive allows Member States to require entities in essential and important sectors to use only EUCS-certified cloud services. The core political controversy centers on whether the “high” assurance level should include sovereignty requirements — mandating EU headquarters, EU-only data processing, and immunity from non-EU extraterritorial laws (e.g. the US CLOUD Act). A March 2024 draft removed these requirements to achieve technical consensus, but the proposed recast of the Cybersecurity Act (CSA2), tabled in January 2026, would reinstate a formal sovereignty tier, with France leading advocacy for its inclusion.\n","title":"EU Cloud Services Scheme (EUCS)","type":"compliance"},{"content":"The Cyber Resilience Act (CRA) is a European Union regulation — not a voluntary standard — that entered into force on 10 December 2024 and will be fully applicable on 11 December 2027. It is issued by the European Commission and co-legislated by the European Parliament and Council; it is not a certification scheme but a horizontal product-safety law, comparable in structure to the CE-marking directives for physical goods. The CRA applies to all manufacturers, importers, and distributors of \u0026ldquo;products with digital elements\u0026rdquo; — any software or hardware product containing a data connection — that is made available on the EU single market, regardless of where the manufacturer is headquartered. Compliance is mandatory: non-compliant products cannot legally be placed on the EU market after the deadline, and penalties can reach €15 million or 2.5 % of global annual turnover. Key intermediate deadlines include 11 September 2026 (manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA within 24 hours) and 11 June 2026 (conformity assessment body framework becomes operational). Products already on the market before 11 December 2027 are exempt from the full requirements unless they undergo a \u0026ldquo;substantial modification,\u0026rdquo; but they are subject to the vulnerability reporting obligation from September 2026 onward.\nRed Hat is directly in scope of the CRA as a manufacturer of products with digital elements (RHEL, OpenShift, Ansible Automation Platform, and the broader portfolio). Red Hat publicly states it is aligning its mature secure-by-design lifecycle with CRA mandates and has published a dedicated compliance page on its Customer Portal. Concretely, Red Hat already provides machine-readable security advisories (CSAF/VEX), SBOMs for container images, Sigstore-based artifact signing, and SLSA-compliant build pipelines via the Trusted Software Supply Chain portfolio — all of which map to CRA essential requirements around vulnerability handling, transparency, and supply-chain integrity. Red Hat also acts as an open source software steward for upstream projects like Fedora and Ansible, a role explicitly recognized by the CRA with lighter (but non-zero) obligations. Through leadership in the Eclipse Open Regulatory Compliance (ORC) Working Group and the OpenSSF, Red Hat has helped shape CRA implementing standards so they reflect how open source software is actually developed — ensuring that compliance obligations fall on commercial manufacturers rather than volunteer maintainers. For Red Hat customers, the practical implication is that Red Hat\u0026rsquo;s products are being engineered to ship with the technical documentation, conformity evidence, and vulnerability-handling processes the CRA demands, reducing the customers\u0026rsquo; own burden when integrating Red Hat software into their CE-marked products or fulfilling their downstream obligations.\nAdditional Information # Red Hat and the EU Cyber Resilience Act (CRA) EU CRA - Red Hat Customer Portal The EU Cyber Resilience Act\u0026rsquo;s impact on open source security CRA summary - European Commission ","externalUrl":null,"permalink":"/en/compliance/eu-cra/","section":"Index","summary":"The Cyber Resilience Act (CRA) is a European Union regulation — not a voluntary standard — that entered into force on 10 December 2024 and will be fully applicable on 11 December 2027. It is issued by the European Commission and co-legislated by the European Parliament and Council; it is not a certification scheme but a horizontal product-safety law, comparable in structure to the CE-marking directives for physical goods. The CRA applies to all manufacturers, importers, and distributors of “products with digital elements” — any software or hardware product containing a data connection — that is made available on the EU single market, regardless of where the manufacturer is headquartered. Compliance is mandatory: non-compliant products cannot legally be placed on the EU market after the deadline, and penalties can reach €15 million or 2.5 % of global annual turnover. Key intermediate deadlines include 11 September 2026 (manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA within 24 hours) and 11 June 2026 (conformity assessment body framework becomes operational). Products already on the market before 11 December 2027 are exempt from the full requirements unless they undergo a “substantial modification,” but they are subject to the vulnerability reporting obligation from September 2026 onward.\n","title":"EU Cyber Resilience Act (CRA)","type":"compliance"},{"content":"The EU Cybersecurity Act (CSA) — Regulation (EU) 2019/881 — was adopted by the European Council in April 2019 and fully entered into force on 28 June 2021. It is a European regulation (directly applicable in all Member States without transposition) that serves two primary functions: it strengthened and made permanent the mandate of ENISA (the EU Agency for Cybersecurity), and it established a voluntary EU-wide cybersecurity certification framework for ICT products, services, and processes. The CSA is not itself a certification scheme but rather the legal foundation upon which specific schemes are built — currently EUCC (adopted January 2024), EUCS (cloud, under development), EU5G (5G networks, under development), EUDI Wallets, and EUMSS (managed security services). Each scheme defines assurance levels (basic, substantial, high), evaluation methodologies, and mutual recognition rules so that a certificate issued in one Member State is valid across the entire EU. The CSA applies to any entity — manufacturer, service provider, or operator — that voluntarily seeks EU cybersecurity certification for its offerings, though sector-specific regulations (NIS2, CRA, DORA) may make certification effectively mandatory for certain use cases. A recast of the CSA (CSA2) was proposed by the European Commission on 20 January 2026, aiming to strengthen certification mandates, reinstate sovereignty requirements in cloud certification, and reinforce ENISA\u0026rsquo;s supervisory role.\nRed Hat is both a direct and indirect stakeholder of the CSA framework. As a manufacturer of ICT products (RHEL, OpenShift, Ansible) that could seek EUCC certification, and as a platform underlying cloud services that may require EUCS certification, Red Hat\u0026rsquo;s product security practices are designed to align with the evaluation requirements that CSA schemes define. More broadly, Red Hat actively participates in the standardization process that underpins CSA schemes: through the Eclipse Open Regulatory Compliance Working Group, OpenSSF, and direct engagement with ENISA working groups, Red Hat helps ensure that certification standards reflect the open source development model — where security is achieved through transparent, community-auditable processes rather than proprietary black-box evaluations. Red Hat\u0026rsquo;s secure development lifecycle, SBOM generation, Sigstore-based signing, and CSAF/VEX advisory infrastructure provide the machine-readable evidence artifacts that CSA certification schemes are increasingly designed to consume. For customers, this means that deploying Red Hat software provides a foundation aligned with the CSA\u0026rsquo;s vision of provable, certified security — whether or not a formal scheme certificate is pursued.\nAdditional Information # EU Cybersecurity Act - European Commission EU CSA overview - OpenKRITIS ENISA Cybersecurity Certification Framework ","externalUrl":null,"permalink":"/en/compliance/eu-csa/","section":"Index","summary":"The EU Cybersecurity Act (CSA) — Regulation (EU) 2019/881 — was adopted by the European Council in April 2019 and fully entered into force on 28 June 2021. It is a European regulation (directly applicable in all Member States without transposition) that serves two primary functions: it strengthened and made permanent the mandate of ENISA (the EU Agency for Cybersecurity), and it established a voluntary EU-wide cybersecurity certification framework for ICT products, services, and processes. The CSA is not itself a certification scheme but rather the legal foundation upon which specific schemes are built — currently EUCC (adopted January 2024), EUCS (cloud, under development), EU5G (5G networks, under development), EUDI Wallets, and EUMSS (managed security services). Each scheme defines assurance levels (basic, substantial, high), evaluation methodologies, and mutual recognition rules so that a certificate issued in one Member State is valid across the entire EU. The CSA applies to any entity — manufacturer, service provider, or operator — that voluntarily seeks EU cybersecurity certification for its offerings, though sector-specific regulations (NIS2, CRA, DORA) may make certification effectively mandatory for certain use cases. A recast of the CSA (CSA2) was proposed by the European Commission on 20 January 2026, aiming to strengthen certification mandates, reinstate sovereignty requirements in cloud certification, and reinforce ENISA’s supervisory role.\n","title":"EU Cybersecurity Act (CSA)","type":"compliance"},{"content":"The EU5G cybersecurity certification scheme is a certification framework being developed under the EU Cybersecurity Act (Regulation 2019/881), intended to provide harmonized security assurance for 5G network products and components across the European Union. ENISA established an Ad Hoc Working Group (AHWG) on EU5G in Q4 2021 following a European Commission request. As of mid-2026, the scheme has not been formally adopted and no complete public draft is available — making it the least mature of the three schemes requested under the CSA (after EUCC, adopted in January 2024, and EUCS, still stalled). Current work has focused on specific components: in June 2024, ENISA launched a public consultation on technical specifications for eUICC (embedded Universal Integrated Circuit Card) certification, which will be handled under the existing EUCC framework rather than a new standalone scheme. A broader EU NESAS scheme for 5G network products is under development, leveraging the existing GSMA NESAS/3GPP SCAS methodology. The scheme is expected to be voluntary once adopted, with assurance levels aligned to the CSA\u0026rsquo;s basic/substantial/high structure. Its practical significance will be shaped by the revised Cybersecurity Act (CSA2), proposed in January 2026, which strengthens ENISA\u0026rsquo;s mandate and may provide additional impetus for adoption.\nRed Hat\u0026rsquo;s relevance to EU5G lies in its role as the platform provider underpinning 5G network infrastructure for major telecom operators and vendors. Red Hat OpenShift is the Kubernetes platform running containerized 5G Core network functions (AMF, SMF, UPF, etc.) for vendors such as Ericsson, Nokia, and Samsung, while RHEL serves as the base operating system for both the platform and the RAN Distributed Unit. If EU5G certification ultimately applies to the software platform hosting network functions — not just the network functions themselves — Red Hat\u0026rsquo;s security posture becomes directly relevant. Red Hat already supports telco-specific security requirements: real-time kernel hardening, FIPS 140-3 validated cryptography, SELinux confinement of workloads, and the Compliance Operator for automated CIS/STIG enforcement on telco clusters. Additionally, Red Hat\u0026rsquo;s existing GSMA NESAS alignment through its participation in the telco ecosystem (supporting vendors through their SCAS evaluations by providing a hardened, attestable platform) positions it well for whatever form the EU5G scheme takes. The relationship between EU5G, GSMA NESAS, and 3GPP SCAS is collaborative: EU5G is expected to build upon — not replace — the NESAS framework, meaning Red Hat\u0026rsquo;s current investments in telco security translate directly into future EU5G readiness.\nAdditional Information # ENISA Cybersecurity Certification Framework EU5G eUICC public consultation - ENISA EU CSA: Cybersecurity Act - OpenKRITIS ","externalUrl":null,"permalink":"/en/compliance/eu5g/","section":"Index","summary":"The EU5G cybersecurity certification scheme is a certification framework being developed under the EU Cybersecurity Act (Regulation 2019/881), intended to provide harmonized security assurance for 5G network products and components across the European Union. ENISA established an Ad Hoc Working Group (AHWG) on EU5G in Q4 2021 following a European Commission request. As of mid-2026, the scheme has not been formally adopted and no complete public draft is available — making it the least mature of the three schemes requested under the CSA (after EUCC, adopted in January 2024, and EUCS, still stalled). Current work has focused on specific components: in June 2024, ENISA launched a public consultation on technical specifications for eUICC (embedded Universal Integrated Circuit Card) certification, which will be handled under the existing EUCC framework rather than a new standalone scheme. A broader EU NESAS scheme for 5G network products is under development, leveraging the existing GSMA NESAS/3GPP SCAS methodology. The scheme is expected to be voluntary once adopted, with assurance levels aligned to the CSA’s basic/substantial/high structure. Its practical significance will be shaped by the revised Cybersecurity Act (CSA2), proposed in January 2026, which strengthens ENISA’s mandate and may provide additional impetus for adoption.\n","title":"EU5G Certification Scheme","type":"compliance"},{"content":"The European Common Criteria-based cybersecurity certification scheme (EUCC) is the first certification scheme formally adopted under the EU Cybersecurity Act (Regulation 2019/881). The European Commission published the implementing regulation on 31 January 2024, and an amendment (Regulation 2024/3144) followed in December 2024 to clarify applicable ISO/IEC 15408 standard versions and transition rules. EUCC is managed by ENISA and builds on the existing SOG-IS Mutual Recognition Agreement that was already used by 17 EU Member States, effectively replacing those national Common Criteria schemes with a single EU-wide framework. It applies to ICT products — hardware, software, and embedded components — and evaluates their cybersecurity properties through accredited Conformity Assessment Bodies (CABs). The scheme offers two assurance levels: \u0026ldquo;substantial\u0026rdquo; (based on AVA_VAN levels 1–2) and \u0026ldquo;high\u0026rdquo; (AVA_VAN levels 3–5). Certification is voluntary — there is no legal obligation to certify ICT products under EUCC — but it provides market-recognized evidence of security properties and is expected to be referenced by procurement requirements and sector-specific legislation (e.g. medical devices, smart metering). EUCC certificates are recognized uniformly across the entire EU, eliminating the need for country-by-country certification.\nRed Hat\u0026rsquo;s software portfolio is eligible for EUCC certification where customers or market requirements demand formal Common Criteria evaluation. Historically, Red Hat Enterprise Linux has maintained Common Criteria certifications under national schemes — RHEL has been evaluated against protection profiles such as the NIAP Operating System Protection Profile (OSPP) — and these evaluations can transition into the EUCC framework as the new scheme supersedes SOG-IS certificates. The practical relevance for Red Hat is twofold: first, RHEL and OpenShift provide the evaluated operating system and platform layer upon which customers build their own EUCC-certifiable products (the certification of a higher-level product often depends on the evaluated security properties of its OS); second, Red Hat\u0026rsquo;s security architecture — SELinux mandatory access control, FIPS 140-3 validated cryptographic modules, measured boot, and secure supply chain — maps directly to the security functional requirements (SFRs) that Common Criteria evaluations test. As EUCC matures and CABs issue certificates at scale (first certificates issued since early 2025), organizations requiring formal product assurance evidence can leverage Red Hat\u0026rsquo;s existing evaluation artifacts and align them with the EU-wide scheme.\nAdditional Information # EUCC Certification Scheme - ENISA EU adopts first Cybersecurity Certification Scheme - ENISA EUCC overview - ENISA ","externalUrl":null,"permalink":"/en/compliance/eucc/","section":"Index","summary":"The European Common Criteria-based cybersecurity certification scheme (EUCC) is the first certification scheme formally adopted under the EU Cybersecurity Act (Regulation 2019/881). The European Commission published the implementing regulation on 31 January 2024, and an amendment (Regulation 2024/3144) followed in December 2024 to clarify applicable ISO/IEC 15408 standard versions and transition rules. EUCC is managed by ENISA and builds on the existing SOG-IS Mutual Recognition Agreement that was already used by 17 EU Member States, effectively replacing those national Common Criteria schemes with a single EU-wide framework. It applies to ICT products — hardware, software, and embedded components — and evaluates their cybersecurity properties through accredited Conformity Assessment Bodies (CABs). The scheme offers two assurance levels: “substantial” (based on AVA_VAN levels 1–2) and “high” (AVA_VAN levels 3–5). Certification is voluntary — there is no legal obligation to certify ICT products under EUCC — but it provides market-recognized evidence of security properties and is expected to be referenced by procurement requirements and sector-specific legislation (e.g. medical devices, smart metering). EUCC certificates are recognized uniformly across the entire EU, eliminating the need for country-by-country certification.\n","title":"EUCC (EU Common Criteria)","type":"compliance"},{"content":"fapolicyd (File Access Policy Daemon) is an application allowlisting framework for Linux, developed by Red Hat and shipped as a supported component of RHEL 8+. Its security premise is supply-chain integrity at the execution layer: only software that was installed through a trusted package manager (DNF/RPM) or explicitly declared as trusted by an administrator may execute on the system. An attacker who achieves a foothold and drops a new binary — a reverse shell, a lateral movement tool, a cryptominer — will find that binary blocked at execution time, because it is absent from the trust database, regardless of its Unix permissions or SELinux label. fapolicyd addresses a different dimension of access control than SELinux: SELinux models how applications behave (what resources they may access); fapolicyd models whether applications are trusted at all (whether they may execute in the first place). The two are complementary: SELinux confines a trusted application\u0026rsquo;s behaviour; fapolicyd prevents untrusted applications from running.\nThe kernel mechanism underlying fapolicyd is fanotify with the FAN_OPEN_EXEC_PERM event type. When any process calls execve(), execveat(), or uselib(), the kernel generates a FAN_OPEN_EXEC_PERM event and blocks the executing thread until fapolicyd returns a verdict. fapolicyd looks up the file in its trust database — an lmdb key-value store at /var/lib/fapolicyd/ — and evaluates the matching rule in its policy. The trust database is populated automatically via a DNF plugin that notifies fapolicyd whenever packages are installed or removed, keeping the database in sync with the RPM state without manual intervention; rpm-based installations outside DNF require a manual fapolicyd-cli --update to refresh the database. Files can also be added to the trust database explicitly via /etc/fapolicyd/fapolicyd.trust or the trust.d/ directory, for files delivered outside the package manager (custom scripts, vendored binaries, container runtimes). The policy rule language (/etc/fapolicyd/rules.d/) allows rules combining trust status, file path patterns, process path, UID/GID, and file type — for example, permitting any trusted executable to run from /usr, blocking execution from /tmp, /var/tmp, and /dev/shm unconditionally (a common dropper target), and denying untrusted scripts regardless of interpreter. Like SELinux and AppArmor, fapolicyd supports a permissive mode (permissive = 1 in fapolicyd.conf) that logs violations without enforcing them, enabling policy refinement before enforcement.\nThe three integrity checking modes are fapolicyd\u0026rsquo;s most security-relevant configuration axis. In the default mode (integrity checking off), fapolicyd trusts any file at a known path that is in the trust database by name — it does not verify the file\u0026rsquo;s contents, so a file replaced in-place with a malicious binary of the same name and size would pass. Size-based integrity adds a comparison of the file\u0026rsquo;s current size against the size recorded in the trust database, catching coarse tampering. SHA-256 hash integrity (integrity = sha256 in fapolicyd.conf) computes the SHA-256 hash of the file at execution time and compares it against the hash in the trust database — catching any content modification, at the cost of a hash computation on every execution of an uncached file. The third mode, IMA-based integrity (integrity = ima), reads the IMA-computed hash from the file\u0026rsquo;s security.ima extended attribute rather than computing it on the fly, combining the performance of a fast xattr lookup with the security of content-based verification — but requires IMA appraisal to be configured and the filesystem to support i_version. Red Hat does not recommend enabling hash integrity by default due to deadlock risk on systems where the hash computation itself triggers further fanotify events, but it is the correct mode for high-assurance deployments. fapolicyd integrates with the Linux audit subsystem for logging, composes naturally with USBGuard (USBGuard controls what hardware can connect; fapolicyd controls what software from that hardware can run), and pairs with IMA measurement for attestation: the combination of IMA\u0026rsquo;s runtime measurement log and fapolicyd\u0026rsquo;s execution gating gives a system where every executed file is both attested (IMA recorded its hash in TPM PCR 10) and authorised (fapolicyd confirmed it was trusted before allowing execution).\n","externalUrl":null,"permalink":"/en/security/fapolicyd/","section":"Index","summary":"fapolicyd (File Access Policy Daemon) is an application allowlisting framework for Linux, developed by Red Hat and shipped as a supported component of RHEL 8+. Its security premise is supply-chain integrity at the execution layer: only software that was installed through a trusted package manager (DNF/RPM) or explicitly declared as trusted by an administrator may execute on the system. An attacker who achieves a foothold and drops a new binary — a reverse shell, a lateral movement tool, a cryptominer — will find that binary blocked at execution time, because it is absent from the trust database, regardless of its Unix permissions or SELinux label. fapolicyd addresses a different dimension of access control than SELinux: SELinux models how applications behave (what resources they may access); fapolicyd models whether applications are trusted at all (whether they may execute in the first place). The two are complementary: SELinux confines a trusted application’s behaviour; fapolicyd prevents untrusted applications from running.\n","title":"fapolicyd (File Access Policy Daemon)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/federal/","section":"Tags","summary":"","title":"Federal","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/federation/","section":"Tags","summary":"","title":"Federation","type":"tags"},{"content":"The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program, codified into law by the FedRAMP Authorization Act of 2022, that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. FedRAMP is administered by the General Services Administration (GSA) and is mandatory — any cloud service (SaaS, PaaS, IaaS) that stores, processes, or transmits federal data or metadata must achieve FedRAMP authorization before it can be used by US government agencies or their contractors. The program defines three impact levels: Low (limited adverse effect), Moderate (serious adverse effect), and High (severe or catastrophic effect — applies to law enforcement, emergency, financial, and health systems). Each level maps to NIST SP 800-53 Rev 5 control baselines: FedRAMP High requires implementation of approximately 421 controls. Authorization is achieved through either an Agency ATO (a specific agency sponsors the assessment) or the newer FedRAMP 20-X experimental accelerated path. Once authorized, cloud service providers (CSPs) must maintain continuous monitoring — monthly vulnerability scans, annual penetration testing, and Plan of Action \u0026amp; Milestones (POA\u0026amp;M) reporting — or risk revocation. Authorized services are listed on the FedRAMP Marketplace.\nRed Hat holds FedRAMP High Authorization for Red Hat OpenShift Service on AWS (ROSA) — both the classic architecture and the hosted control planes variant — operating in AWS GovCloud (US-Gov-East/US-Gov-West). Red Hat Insights and Red Hat Lightspeed are also FedRAMP High authorized. This means US federal agencies can deploy their most sensitive unclassified workloads on a fully managed, Kubernetes-based application platform that has successfully undergone rigorous audits against the NIST 800-53 Rev 5 High baseline. The practical impact for customers is significant: by inheriting ROSA\u0026rsquo;s authorization boundary, software vendors and agencies building on ROSA can see their own FedRAMP assessment scope reduced by up to 70 % of the High baseline controls — because Red Hat manages and is responsible for the underlying infrastructure controls (physical security, network architecture, OS hardening, encryption, logging, incident response). For organizations running on-premises RHEL in federal environments, Red Hat provides DISA STIG and NIST 800-53 profiles, FIPS 140-3 validated cryptography, and OpenSCAP tooling to support their own Agency ATO process — even though on-premises software is not \u0026ldquo;FedRAMP authorized\u0026rdquo; (FedRAMP only applies to cloud services). Red Hat\u0026rsquo;s presence on the FedRAMP Marketplace has become a key enabler for government ISVs who can accelerate their own authorization timeline by building atop an already-authorized platform.\nAdditional Information # FedRAMP Official Website FedRAMP Marketplace Red Hat FedRAMP - Customer Portal Red Hat OpenShift Service on AWS GovCloud - FedRAMP High ","externalUrl":null,"permalink":"/en/compliance/fedramp/","section":"Index","summary":"The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program, codified into law by the FedRAMP Authorization Act of 2022, that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. FedRAMP is administered by the General Services Administration (GSA) and is mandatory — any cloud service (SaaS, PaaS, IaaS) that stores, processes, or transmits federal data or metadata must achieve FedRAMP authorization before it can be used by US government agencies or their contractors. The program defines three impact levels: Low (limited adverse effect), Moderate (serious adverse effect), and High (severe or catastrophic effect — applies to law enforcement, emergency, financial, and health systems). Each level maps to NIST SP 800-53 Rev 5 control baselines: FedRAMP High requires implementation of approximately 421 controls. Authorization is achieved through either an Agency ATO (a specific agency sponsors the assessment) or the newer FedRAMP 20-X experimental accelerated path. Once authorized, cloud service providers (CSPs) must maintain continuous monitoring — monthly vulnerability scans, annual penetration testing, and Plan of Action \u0026 Milestones (POA\u0026M) reporting — or risk revocation. Authorized services are listed on the FedRAMP Marketplace.\n","title":"FedRAMP","type":"compliance"},{"content":"FIDO2 is the current generation of authentication standards produced jointly by the FIDO Alliance and the W3C, combining two specifications: WebAuthn (Web Authentication API, W3C Level 3, 2025) and CTAP2 (Client to Authenticator Protocol 2, FIDO Alliance). Its defining security property is origin binding: every FIDO2 credential is generated and used with a cryptographic binding to the specific Relying Party ID (RP ID — typically the registering domain\u0026rsquo;s origin) encoded into every authentication assertion. An authenticator will refuse to produce an assertion for evil.com using a credential registered with bank.com, even if the phishing site presents an identical login page and intercepts the WebAuthn call — the origin check is enforced inside the authenticator, not in JavaScript, and cannot be bypassed by a man-in-the-middle who controls the network or the browser DOM. This property is what makes FIDO2 phishing-resistant by construction, whereas TOTP, SMS OTP, and push-notification MFA are all interceptable by a real-time phishing proxy. FIDO2 is the direct successor to FIDO U2F (Universal 2nd Factor), which provided phishing resistance as a second factor only; FIDO2 extends the model to full passwordless primary authentication.\nThe protocol architecture has three participants. The Relying Party (RP) is the application or service requesting authentication — a web server, an identity provider, or a native application. It calls the WebAuthn API to initiate two ceremonies: registration (navigator.credentials.create() — the RP sends a challenge, allowed algorithms, RP ID, and attestation preference; the authenticator generates a new key pair, stores the private key in its secure element, and returns the public key, credential ID, and optional attestation statement; the RP stores the public key and credential ID) and authentication (navigator.credentials.get() — the RP sends a fresh challenge and the credential ID; the authenticator performs user verification, signs the challenge and authenticator data with the stored private key, and returns the signed assertion; the RP verifies the signature with the stored public key). The client is the browser or OS layer that calls CTAP2 to communicate with the authenticator. The authenticator is the hardware or platform component that holds private key material — either a platform authenticator (Touch ID, Face ID, Windows Hello, Android biometric — built into the device and not accessible over USB/NFC/BLE) or a roaming authenticator (YubiKey, Google Titan, SoloKey — a portable hardware token connected over USB, NFC, or BLE, implementing the CTAP2 protocol; on Linux, accessed via libfido2). Private keys generated inside an authenticator\u0026rsquo;s secure element never leave it in plaintext; authentication requires both the key and local user interaction — a PIN, biometric, or touch confirmation that proves user presence or user verification.\nThree operational concepts define how FIDO2 is deployed in practice. Discoverable credentials (passkeys) store the credential on the authenticator indexed by RP ID and user ID so that no username need be typed — the authenticator can surface which accounts it holds for a given origin and begin authentication without a username prompt. Discoverable credentials on hardware security keys consume on-device storage (typically 25–100 slots depending on the model); synced passkeys replicate the credential via a platform cloud (iCloud Keychain, Google Password Manager, Windows Hello with Microsoft account), solving account recovery for consumer flows at the cost of the key leaving the hardware boundary — NIST considers synced passkeys single-factor since the cloud account becomes a recovery path. Attestation is the authenticator\u0026rsquo;s signed statement about its own model and manufacturer, rooted in the FIDO Metadata Service (MDS) — a FIDO Alliance registry of authenticator models, their public keys, and any known vulnerabilities. A RP that enforces attestation can verify not just that a valid credential was used, but that it was generated on a specific, certified hardware model (e.g., YubiKey 5 Series), enabling hardware-bound credential policies for high-assurance deployments; the attestation certificate\u0026rsquo;s AAGUID (Authenticator Attestation GUID) uniquely identifies the authenticator model. SSH integration is covered in the SSH entry: the ed25519-sk and ecdsa-sk key types bind an SSH key pair to a FIDO2 hardware token so that SSH authentication requires physical presence of the token, with the private key resident on the hardware and never extractable. In the PAM context, FIDO2 hardware tokens replace or complement TOTP and push MFA as the phishing-resistant factor for privileged access; in a break-glass scenario, hardware token loss is the primary recovery concern, making spare token pre-registration and recovery code procedures an essential operational requirement alongside the tokens themselves.\n","externalUrl":null,"permalink":"/en/security/fido/","section":"Index","summary":"FIDO2 is the current generation of authentication standards produced jointly by the FIDO Alliance and the W3C, combining two specifications: WebAuthn (Web Authentication API, W3C Level 3, 2025) and CTAP2 (Client to Authenticator Protocol 2, FIDO Alliance). Its defining security property is origin binding: every FIDO2 credential is generated and used with a cryptographic binding to the specific Relying Party ID (RP ID — typically the registering domain’s origin) encoded into every authentication assertion. An authenticator will refuse to produce an assertion for evil.com using a credential registered with bank.com, even if the phishing site presents an identical login page and intercepts the WebAuthn call — the origin check is enforced inside the authenticator, not in JavaScript, and cannot be bypassed by a man-in-the-middle who controls the network or the browser DOM. This property is what makes FIDO2 phishing-resistant by construction, whereas TOTP, SMS OTP, and push-notification MFA are all interceptable by a real-time phishing proxy. FIDO2 is the direct successor to FIDO U2F (Universal 2nd Factor), which provided phishing resistance as a second factor only; FIDO2 extends the model to full passwordless primary authentication.\n","title":"FIDO (Fast IDentity Online) / FIDO2","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/filesystem/","section":"Tags","summary":"","title":"Filesystem","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/financial/","section":"Tags","summary":"","title":"Financial","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/fine-tuning/","section":"Tags","summary":"","title":"Fine-Tuning","type":"tags"},{"content":"Fine-tuning is training continued from a pretrained LLM (or other model) on a smaller, task-specific dataset so behavior matches a domain—support tone, internal jargon, classification format, or tool-use style—without pretraining from scratch. LoRA (Low-Rank Adaptation) is a parameter-efficient fine-tuning method: instead of updating all billions of weights, small low-rank matrices are inserted into attention (and sometimes MLP) layers and only those adapters are trained, drastically cutting VRAM and checkpoint size. The objective is better task accuracy or alignment at lower cost than full fine-tuning; adapters can be swapped per tenant while a frozen base model stays shared. Fine-tuning differs from RAG, which injects external facts at inference time without changing weights.\nArchitecturally, fine-tuning is GPU-bound like pretraining but uses smaller learning rates, shorter schedules, and often BF16/FP8 mixed precision. The CPU runs dataloaders, tokenization, and checkpoint I/O. Full fine-tuning updates every parameter—feasible only for smaller models or large multi-GPU jobs. LoRA keeps the base weights fixed (or merged later), so one 70B base can serve many adapter files loaded by vLLM at inference. Compared with inference decode, fine-tuning runs forward and backward passes over many epochs; NCCL scales multi-GPU jobs. Poor data hygiene (PII, poisoned samples) embeds into weights—unlike RAG, mistakes are baked in until retrained.\nRed Hat offers RHEL AI with InstructLab for alignment-style fine-tuning and lab workflows on supported GPU RHEL nodes, and OpenShift AI for team-scale training jobs (notebooks, pipelines, distributed PyTorch on OpenShift). Documentation covers when to choose LoRA vs full fine-tuning vs RAG-only, storage for datasets and adapters, and promoting artifacts to inference (vLLM LoRA slots, custom serving images). Red Hat does not replace Hugging Face PEFT or PyTorch; it provides the supported Linux/Kubernetes substrate and curated paths for enterprise customers.\n","externalUrl":null,"permalink":"/en/ai/fine-tuning-lora/","section":"Index","summary":"Fine-tuning is training continued from a pretrained LLM (or other model) on a smaller, task-specific dataset so behavior matches a domain—support tone, internal jargon, classification format, or tool-use style—without pretraining from scratch. LoRA (Low-Rank Adaptation) is a parameter-efficient fine-tuning method: instead of updating all billions of weights, small low-rank matrices are inserted into attention (and sometimes MLP) layers and only those adapters are trained, drastically cutting VRAM and checkpoint size. The objective is better task accuracy or alignment at lower cost than full fine-tuning; adapters can be swapped per tenant while a frozen base model stays shared. Fine-tuning differs from RAG, which injects external facts at inference time without changing weights.\n","title":"Fine-tuning / LoRA","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/fips/","section":"Tags","summary":"","title":"Fips","type":"tags"},{"content":"FIPS 140 (Federal Information Processing Standard, Publication 140) is the US and Canadian government standard that defines security requirements for cryptographic modules — the hardware, software, or firmware components that perform cryptographic operations (encryption, decryption, hashing, signing, key management). It is published by NIST (National Institute of Standards and Technology) and jointly administered with CCCS (Canadian Centre for Cyber Security) through the Cryptographic Module Validation Program (CMVP). The standard has two active versions: FIPS 140-2 (published 2001, no longer accepting new submissions since April 2022) and FIPS 140-3 (effective September 2020, the current standard for all new validations). FIPS 140-2 certificates remain valid until 21 September 2026, after which they move to the Historical list — meaning only FIPS 140-3 validated modules will be accepted for new federal procurements. FIPS 140 defines four security levels (Level 1 through Level 4), with Level 1 being the baseline for software modules and Level 4 requiring physical tamper-active hardware. Compliance is mandatory for all US federal agencies and their contractors under FISMA, for Canadian federal systems, and is widely adopted by regulated industries (finance, healthcare, critical infrastructure) globally. Non-validated cryptography is treated as providing no protection — effectively plaintext — regardless of the algorithm strength. Validation is a formal, lab-based process: vendors submit modules to accredited Cryptographic and Security Testing (CST) laboratories, which test against the standard and submit results to CMVP for certificate issuance.\nRed Hat maintains one of the most comprehensive FIPS validation portfolios of any Linux vendor. As of 2025–2026, Red Hat holds active FIPS 140-3 certificates for multiple cryptographic modules across RHEL 8 and RHEL 9: OpenSSL FIPS Provider, NSS Cryptographic Module, libgcrypt, GnuTLS, and the Kernel Cryptographic API — validated on Intel, IBM Z (s390x), and IBM Power architectures. RHEL 9 and RHEL 10 are FIPS 140-3 only releases, while RHEL 8 maintains a mix of FIPS 140-2 and 140-3 certificates. Red Hat enables FIPS mode at the operating system level: when enabled (at install time or via fips-mode-setup), RHEL enforces that only validated cryptographic implementations are used system-wide — disabling non-approved algorithms, configuring TLS to use only FIPS-approved cipher suites, and ensuring the kernel self-tests its crypto on boot. This system-wide FIPS enforcement propagates upward through the stack: OpenShift inherits RHEL\u0026rsquo;s FIPS boundary, meaning all platform cryptography (etcd encryption, API server TLS, service mesh mTLS, image signing) uses validated modules without per-application configuration. Red Hat\u0026rsquo;s FIPS strategy follows a \u0026ldquo;validate once, inherit everywhere\u0026rdquo; model — because all higher-level Red Hat products (OpenShift, Ansible, RHACS, Quay) rely on RHEL\u0026rsquo;s cryptographic libraries, a single set of CMVP certificates covers the entire product portfolio. For federal customers, this eliminates the need to independently validate each software component and ensures continuous compliance as FIPS 140-2 certificates expire in September 2026.\nAdditional Information # NIST CMVP - Cryptographic Module Validation Program Red Hat FIPS validated modules - CMVP search Red Hat Enterprise Linux FIPS certificates blog Red Hat FIPS compliance - Customer Portal ","externalUrl":null,"permalink":"/en/compliance/fips-140/","section":"Index","summary":"FIPS 140 (Federal Information Processing Standard, Publication 140) is the US and Canadian government standard that defines security requirements for cryptographic modules — the hardware, software, or firmware components that perform cryptographic operations (encryption, decryption, hashing, signing, key management). It is published by NIST (National Institute of Standards and Technology) and jointly administered with CCCS (Canadian Centre for Cyber Security) through the Cryptographic Module Validation Program (CMVP). The standard has two active versions: FIPS 140-2 (published 2001, no longer accepting new submissions since April 2022) and FIPS 140-3 (effective September 2020, the current standard for all new validations). FIPS 140-2 certificates remain valid until 21 September 2026, after which they move to the Historical list — meaning only FIPS 140-3 validated modules will be accepted for new federal procurements. FIPS 140 defines four security levels (Level 1 through Level 4), with Level 1 being the baseline for software modules and Level 4 requiring physical tamper-active hardware. Compliance is mandatory for all US federal agencies and their contractors under FISMA, for Canadian federal systems, and is widely adopted by regulated industries (finance, healthcare, critical infrastructure) globally. Non-validated cryptography is treated as providing no protection — effectively plaintext — regardless of the algorithm strength. Validation is a formal, lab-based process: vendors submit modules to accredited Cryptographic and Security Testing (CST) laboratories, which test against the standard and submit results to CMVP for certificate issuance.\n","title":"FIPS 140-2 / FIPS 140-3","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/firewall/","section":"Tags","summary":"","title":"Firewall","type":"tags"},{"content":"firewalld is the firewall management daemon on RHEL, CentOS Stream, Fedora, SUSE, and their derivatives, providing a higher-level policy model and a runtime-safe management API on top of nftables (RHEL 8+ / Fedora 32+) or iptables (older systems). Its defining feature is runtime versus permanent configuration: firewall rule changes can be applied immediately to the running system without restarting the service or dropping existing connections (--runtime, the default), and separately persisted to disk so they survive reboots (--permanent). This two-phase model solves the operational problem that raw nftables or iptables rule changes traditionally required either accepting a momentary policy gap during reload or building custom transaction logic. The daemon exposes its API over D-Bus, allowing NetworkManager, libvirt, Podman, and other system components to request firewall policy changes programmatically — when a VM is started in libvirt or a container port is published in Podman, the respective tool calls firewalld over D-Bus to open the required port rather than directly manipulating nftables rules.\nThe policy model is built around zones: named security profiles that define the trust level of network traffic based on which network interface or source address range a packet arrives from. Each zone has a set of permitted services (named groups of ports and protocols — http, https, ssh, kubernetes-api, or custom-defined), permitted ports, masquerade settings, and forwarding rules. An interface or source is assigned to exactly one zone; traffic arriving on an unassigned interface falls to the default zone. RHEL ships nine predefined zones: drop (silently discard all inbound), block (reject inbound with ICMP messages), public (the conservative default for untrusted interfaces — allows only ssh and dhcpv6-client), external (for NAT masquerade on outbound-facing interfaces), dmz, work, home, internal (progressively more permissive), and trusted (accept all). A server in a datacenter would typically assign its primary NIC to public and then open specific services: firewall-cmd --add-service=https --permanent adds HTTPS to the current zone permanently. Rich rules extend the zone model with full match-and-action expressions covering source addresses, destination addresses, ports, protocols, connection state, and logging — allowing per-source-IP policy within a zone without requiring a new zone. Policies (introduced in firewalld 0.9) add inter-zone traffic control, allowing firewalld to express policy for traffic flowing between zones (for example, between a public interface and a trusted bridge interface in a VM host).\nOn RHEL-based Kubernetes nodes and OpenShift, firewalld coexists with the container networking stack in a carefully managed way. OpenShift\u0026rsquo;s installer configures firewalld zones for cluster nodes, opening the ports required by the Kubernetes API server, etcd, kubelet, and CNI communication, and adding the pod network CIDR to a trusted zone so that Kubernetes NetworkPolicy and iptables or nftables rules written by kube-proxy and the CNI plugin operate inside firewalld\u0026rsquo;s framework rather than conflicting with it. A common misconfiguration on RHEL Kubernetes nodes is disabling firewalld entirely to avoid conflicts, which removes host-level protection; the correct approach is to understand firewalld\u0026rsquo;s zone assignments and ensure the Kubernetes components and firewalld are configured to coexist. The firewall-cmd --list-all command shows the current zone\u0026rsquo;s effective configuration, and firewall-cmd --list-all-zones shows every zone\u0026rsquo;s policy — the standard starting point for diagnosing connectivity issues on RHEL-based nodes where firewalld is active. In SELinux-hardened environments, firewalld runs in its own SELinux domain (firewalld_t) with a narrow policy, complementing the kernel-level packet filtering it manages with process-level MAC confinement.\n","externalUrl":null,"permalink":"/en/security/firewalld/","section":"Index","summary":"firewalld is the firewall management daemon on RHEL, CentOS Stream, Fedora, SUSE, and their derivatives, providing a higher-level policy model and a runtime-safe management API on top of nftables (RHEL 8+ / Fedora 32+) or iptables (older systems). Its defining feature is runtime versus permanent configuration: firewall rule changes can be applied immediately to the running system without restarting the service or dropping existing connections (--runtime, the default), and separately persisted to disk so they survive reboots (--permanent). This two-phase model solves the operational problem that raw nftables or iptables rule changes traditionally required either accepting a momentary policy gap during reload or building custom transaction logic. The daemon exposes its API over D-Bus, allowing NetworkManager, libvirt, Podman, and other system components to request firewall policy changes programmatically — when a VM is started in libvirt or a container port is published in Podman, the respective tool calls firewalld over D-Bus to open the required port rather than directly manipulating nftables rules.\n","title":"firewalld","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/firmware/","section":"Tags","summary":"","title":"Firmware","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/fp8/","section":"Tags","summary":"","title":"Fp8","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/framework/","section":"Tags","summary":"","title":"Framework","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/fronthaul/","section":"Tags","summary":"","title":"Fronthaul","type":"tags"},{"content":"fs-verity is a Linux kernel filesystem feature, merged in kernel 5.4, that provides read-only, content-addressable integrity verification at the individual file level. When fs-verity is enabled on a file (via the FS_IOC_ENABLE_VERITY ioctl), the kernel builds a Merkle tree of the file\u0026rsquo;s content blocks and stores it in a filesystem-specific location (in an ext4 or f2fs Merkle tree block range, or in a separate xattr-adjacent structure on btrfs). From that point, the file becomes immutable — writes are rejected — and every page read from the file is verified against the Merkle tree before being returned to userspace. The file\u0026rsquo;s fs-verity digest is the SHA-256 (or SHA-512) root hash of the Merkle tree, computable without reading the file at all once the tree is built: fsverity digest file returns this digest. A file\u0026rsquo;s fs-verity digest is a stable, content-derived identity: two files with the same content have the same digest, and any byte-level modification produces a different digest that verification will detect and reject with EIO. The kernel caches verified Merkle tree nodes in the page cache alongside file data, so the amortised verification overhead is low for sequentially-read files.\nThe operational model differs from dm-verity in scope and granularity. dm-verity protects an entire block device as a unit, with a single root hash committing the whole device; it cannot share blocks between two separately-verified volumes containing the same file. fs-verity protects individual files within a normally-writable filesystem, enabling a mixed-trust model where some files are verified (OS binaries, package contents) and others are not (logs, configuration, state), without partitioning the storage. The file\u0026rsquo;s Merkle tree is stored alongside the file in the same filesystem, so verified files survive copies and backups that preserve extended attributes and inode metadata. Critically, fs-verity enables content-addressable deduplication at the file level: a storage layout that uses hardlinks or composefs-style object stores can have multiple directory entries pointing to the same verified inode — the Merkle tree is computed once and shared, so the same file content verified in ten different container images costs one Merkle tree\u0026rsquo;s worth of storage and one verification path. This is the property that composefs depends on: its object store contains each unique file content exactly once, addressed by its fs-verity digest, and multiple composefs mounts (different OS images, different container layers) reference the same object store inodes, each getting fs-verity\u0026rsquo;s per-read integrity checks for free.\nfs-verity integrates with three other systems in this glossary. IMA (Integrity Measurement Architecture) can read a file\u0026rsquo;s fs-verity digest from the kernel rather than computing a fresh SHA-256 hash on every access — the security.ima extended attribute can store the fs-verity digest as the reference value, and IMA appraisal compares the runtime digest against this stored value without re-reading the entire file, combining the correctness of content-based verification with the performance of an xattr lookup. This is the integrity = ima mode in fapolicyd. Android uses fs-verity for APK verification since Android 10: the Play Store\u0026rsquo;s application delivery mechanism (adb incremental) uses fs-verity to enable streaming installation — the kernel verifies each page of the APK on first access rather than requiring the entire file to be downloaded and verified before any part of it executes, enabling instant app launch from partial downloads while maintaining the same integrity guarantee as full pre-verification. composefs uses fs-verity as the content integrity layer for the object store backing its EROFS metadata images: when composefs mounts a tree, the verity overlayfs option (kernel 6.6+) instructs the kernel to enforce that each file\u0026rsquo;s content matches its fs-verity digest as recorded in the EROFS metadata — a single EROFS digest commits the metadata, the metadata commits every file\u0026rsquo;s fs-verity digest, and the kernel enforces both on every read. The composefs mount therefore achieves the same tamper-evidence property as a dm-verity image while maintaining the object-store sharing and incremental update properties of a file tree.\n","externalUrl":null,"permalink":"/en/security/fs-verity/","section":"Index","summary":"fs-verity is a Linux kernel filesystem feature, merged in kernel 5.4, that provides read-only, content-addressable integrity verification at the individual file level. When fs-verity is enabled on a file (via the FS_IOC_ENABLE_VERITY ioctl), the kernel builds a Merkle tree of the file’s content blocks and stores it in a filesystem-specific location (in an ext4 or f2fs Merkle tree block range, or in a separate xattr-adjacent structure on btrfs). From that point, the file becomes immutable — writes are rejected — and every page read from the file is verified against the Merkle tree before being returned to userspace. The file’s fs-verity digest is the SHA-256 (or SHA-512) root hash of the Merkle tree, computable without reading the file at all once the tree is built: fsverity digest file returns this digest. A file’s fs-verity digest is a stable, content-derived identity: two files with the same content have the same digest, and any byte-level modification produces a different digest that verification will detect and reject with EIO. The kernel caches verified Merkle tree nodes in the page cache alongside file data, so the amortised verification overhead is low for sequentially-read files.\n","title":"fs-verity","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/gateway/","section":"Tags","summary":"","title":"Gateway","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/generative-ai/","section":"Tags","summary":"","title":"Generative-Ai","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/germany/","section":"Tags","summary":"","title":"Germany","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/gitops/","section":"Tags","summary":"","title":"Gitops","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/government/","section":"Tags","summary":"","title":"Government","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/gpu/","section":"Tags","summary":"","title":"Gpu","type":"tags"},{"content":"A GPU (Graphics Processing Unit) is a specialized processor designed to execute a very large number of arithmetic operations in parallel. Its original objective was real-time rendering; in modern AI and HPC infrastructure the same silicon is used to accelerate matrix multiplications, convolutions, and other kernels that dominate neural network training and inference. Unlike a general-purpose host, a GPU optimizes for throughput: many warps or wavefronts hide memory latency while the device keeps SIMD units busy. In a data-center stack, GPUs typically sit in PCIe or NVLink-attached servers (or on integrated AI appliances) and are scheduled by frameworks such as PyTorch, TensorFlow, or vLLM through a runtime such as CUDA or ROCm.\nArchitecturally, a GPU organizes compute into many lightweight cores grouped into streaming multiprocessors (NVIDIA) or compute units (AMD), with high-bandwidth memory (HBM or GDDR) local to the device and a much wider memory bus than a CPU socket. Control flow is SIMT/SIMD: threads in a warp execute the same instruction on different data; branches diverge and reduce effective parallelism. A CPU favors low latency on a few complex threads: large caches, branch prediction, out-of-order execution, and operating-system services on every core. A GPU accepts higher per-thread latency in exchange for massive parallelism and TFLOPS on regular, data-parallel workloads. Host CPUs remain responsible for orchestration (I/O, networking, Kubernetes control plane, data loading), while the GPU owns the hot numerical path; PCIe/NVLink bandwidth and Unified Memory policies often bound end-to-end performance as much as raw FLOPS.\nRed Hat supports GPU-accelerated workloads primarily through Red Hat Enterprise Linux and Red Hat OpenShift AI (formerly OpenShift Data Science). RHEL provides a supported path for NVIDIA and AMD drivers, container toolkits, and validated hardware on certified systems; OpenShift AI adds MLOps-oriented components (model serving, notebooks, pipelines, observability integrations) on OpenShift. Red Hat documents partner GPU configurations, publishes AI reference architectures with NVIDIA, and integrates GPU scheduling (including MIG, time-slicing, and device plugins) into OpenShift so teams can run training and inference as first-class platform workloads rather than ad hoc bare-metal scripts.\n","externalUrl":null,"permalink":"/en/ai/gpu/","section":"Index","summary":"A GPU (Graphics Processing Unit) is a specialized processor designed to execute a very large number of arithmetic operations in parallel. Its original objective was real-time rendering; in modern AI and HPC infrastructure the same silicon is used to accelerate matrix multiplications, convolutions, and other kernels that dominate neural network training and inference. Unlike a general-purpose host, a GPU optimizes for throughput: many warps or wavefronts hide memory latency while the device keeps SIMD units busy. In a data-center stack, GPUs typically sit in PCIe or NVLink-attached servers (or on integrated AI appliances) and are scheduled by frameworks such as PyTorch, TensorFlow, or vLLM through a runtime such as CUDA or ROCm.\n","title":"GPU (Graphics Processing Unit)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/grandmaster/","section":"Tags","summary":"","title":"Grandmaster","type":"tags"},{"content":"GRUB (GNU GRand Unified Bootloader) is the bootloader used by the majority of Linux distributions on x86 and x86-64 systems. Its role is to bridge the gap between what firmware hands control to and what the Linux kernel needs: firmware (BIOS or UEFI) loads GRUB, and GRUB locates the kernel image and initrd on disk, assembles a kernel command line, and transfers control to the kernel. Because GRUB understands a wide range of filesystem formats — ext4, XFS, Btrfs, FAT, and more — it can read its own configuration and the kernel directly from the root or boot partition without any intermediate step, which is what distinguishes it from simpler bootloaders that can only read from FAT.\nOn UEFI systems, GRUB is installed as a PE-signed EFI binary on the EFI System Partition and is loaded directly by firmware (or, on distributions that use Secure Boot with Microsoft\u0026rsquo;s signing infrastructure, via shim). Its runtime configuration lives in grub.cfg, which GRUB reads from disk and executes as a small scripting language; the config specifies which kernel and initrd to load, any kernel command line arguments, and optional menus for selecting between entries. This dynamic, script-driven model is powerful and flexible — GRUB can discover kernels automatically via grub-mkconfig and os-prober, handle encrypted boot partitions, and support chainloading other bootloaders — but it also means the boot configuration is assembled at runtime from files on disk, making it harder to sign and attest as a unit compared to a static UKI.\nWhen GRUB\u0026rsquo;s tpm module is loaded, it participates in measured boot: every command it executes and every file it reads — the config file, kernel image, initrd — is hashed and extended into TPM PCR registers, contributing to the platform\u0026rsquo;s boot measurement log. GRUB measures kernel command line arguments into PCR 8 and all files it loads (including the kernel and initrd) into PCR 9. This gives TPM-based attestation and LUKS PCR-sealing visibility into what GRUB actually loaded, not just that GRUB ran. However, because GRUB\u0026rsquo;s configuration is mutable and assembled at runtime, pre-calculating the expected PCR values after a config or kernel update is significantly more complex than with UKIs, where the entire payload is a single signed blob with a stable, predictable measurement. This operational friction is one of the primary reasons the Linux ecosystem is gradually shifting toward systemd-boot and UKI-based boot on systems where measured boot and attestation are requirements.\n","externalUrl":null,"permalink":"/en/security/grub/","section":"Index","summary":"GRUB (GNU GRand Unified Bootloader) is the bootloader used by the majority of Linux distributions on x86 and x86-64 systems. Its role is to bridge the gap between what firmware hands control to and what the Linux kernel needs: firmware (BIOS or UEFI) loads GRUB, and GRUB locates the kernel image and initrd on disk, assembles a kernel command line, and transfers control to the kernel. Because GRUB understands a wide range of filesystem formats — ext4, XFS, Btrfs, FAT, and more — it can read its own configuration and the kernel directly from the root or boot partition without any intermediate step, which is what distinguishes it from simpler bootloaders that can only read from FAT.\n","title":"GRUB (GNU GRand Unified Bootloader)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/gsma/","section":"Tags","summary":"","title":"Gsma","type":"tags"},{"content":"The GSMA Network Equipment Security Assurance Scheme (NESAS) is a voluntary, global security assurance framework jointly led by the GSMA and 3GPP. It was established to provide a universal, industry-driven security evaluation for mobile network equipment — primarily targeting 4G/LTE and 5G infrastructure — that avoids the fragmentation of country-specific security requirements. NESAS operates through two complementary components: first, an audit of the vendor\u0026rsquo;s development and product lifecycle processes (covering secure design, implementation, testing, and vulnerability handling), conducted by GSMA-appointed auditing organizations; second, a product evaluation against 3GPP-defined Security Assurance Specifications (SCAS), performed by ISO/IEC 17025 accredited security test laboratories. The GSMA manages scheme governance (accreditation, dispute resolution, publication of results), while 3GPP\u0026rsquo;s SA3 working group defines the technical security requirements and test cases in SCAS documents. The scheme is currently at NESAS v3.0 (specifications published early 2025), which introduces revised security requirements and expands coverage to include virtualized network functions. NESAS is voluntary — no government mandates it — but it is increasingly referenced by national 5G security reviews and procurement requirements (including the EU 5G Toolbox), and major operators use NESAS assessment results as a procurement criterion. Evaluated vendors and their results are publicly listed on the GSMA website.\nRed Hat\u0026rsquo;s role in the NESAS ecosystem is as the platform provider underneath the network equipment vendors being evaluated. Vendors like Ericsson, Nokia, Samsung, and others run their 5G Core network functions (AMF, SMF, UPF, NSSF, etc.) on Red Hat OpenShift, and their RAN software on RHEL. When these vendors undergo NESAS SCAS evaluation for a specific network product, the security properties of the underlying platform directly affect the test results — if the OS or container runtime has vulnerabilities or misconfigurations, the network function inherits those weaknesses. Red Hat supports vendors\u0026rsquo; NESAS compliance by providing a hardened, attestable platform: FIPS 140-3 validated cryptography satisfies SCAS requirements around secure communication; SELinux and seccomp profiles provide the workload isolation that SCAS test cases verify; the real-time kernel (for RAN DU) meets timing security requirements while maintaining hardening; and Red Hat\u0026rsquo;s secure supply chain (signed images, SLSA attestations, SBOMs) supports the vendor\u0026rsquo;s demonstration of secure development practices during the NESAS process audit. As NESAS v3.0 explicitly incorporates requirements for virtualized/containerized network functions, the security assurance of the CaaS platform becomes an increasingly integral part of the overall NESAS evaluation — making Red Hat\u0026rsquo;s security posture a direct contributor to its telco customers\u0026rsquo; NESAS outcomes.\nAdditional Information # GSMA NESAS Documents GSMA NESAS Overview - Security NESAS Assessment Results - GSMA ","externalUrl":null,"permalink":"/en/compliance/gsma-nesas/","section":"Index","summary":"The GSMA Network Equipment Security Assurance Scheme (NESAS) is a voluntary, global security assurance framework jointly led by the GSMA and 3GPP. It was established to provide a universal, industry-driven security evaluation for mobile network equipment — primarily targeting 4G/LTE and 5G infrastructure — that avoids the fragmentation of country-specific security requirements. NESAS operates through two complementary components: first, an audit of the vendor’s development and product lifecycle processes (covering secure design, implementation, testing, and vulnerability handling), conducted by GSMA-appointed auditing organizations; second, a product evaluation against 3GPP-defined Security Assurance Specifications (SCAS), performed by ISO/IEC 17025 accredited security test laboratories. The GSMA manages scheme governance (accreditation, dispute resolution, publication of results), while 3GPP’s SA3 working group defines the technical security requirements and test cases in SCAS documents. The scheme is currently at NESAS v3.0 (specifications published early 2025), which introduces revised security requirements and expands coverage to include virtualized network functions. NESAS is voluntary — no government mandates it — but it is increasingly referenced by national 5G security reviews and procurement requirements (including the EU 5G Toolbox), and major operators use NESAS assessment results as a procurement criterion. Evaluated vendors and their results are publicly listed on the GSMA website.\n","title":"GSMA NESAS","type":"compliance"},{"content":"Guardrails are controls wrapped around LLM inference to reduce harmful, non-compliant, or off-policy behavior without replacing the base model. Their objective is AI safety and governance in production: block or rewrite prompts that attempt prompt injection or jailbreaks, filter toxic or leaked PII in outputs, enforce topic allowlists, validate structured tool calls, and log decisions for audit. Guardrails sit on the request path (before tokens reach the model or after the model proposes a draft response), combining rule engines, classifiers, regex, and sometimes smaller models. They complement—not replace—application auth, network policy, and human review; enterprises treat them as mandatory for customer-facing and internal copilots.\nArchitecturally, guardrails are CPU- and latency-sensitive orchestration around GPU inference. The heavy LLM still runs in vLLM or NIM; guardrail services may call lightweight detectors (e.g. prompt-injection classifiers) or policy APIs in parallel or in series, adding milliseconds to seconds depending on depth. Unlike training, guardrails do not update weights; unlike RAG, they do not retrieve facts—they constrain how the model may respond. False positives frustrate users; false negatives create security incidents, so teams tune thresholds per use case. MCP and agent toolchains extend the attack surface, so guardrails increasingly cover tool arguments and retrieved content, not only chat text.\nRed Hat documents Guardrails Orchestrator for Red Hat OpenShift AI: integrating detectors (regex, Hugging Face models, vLLM-based judges) into serving pipelines on OpenShift, with configuration aligned to enterprise security practices (routes, secrets, SCCs). Blog and security content tie guardrails to defense-in-depth for AI agents (sandboxing, NetworkPolicy, memory-poisoning awareness). RHEL AI focuses on model quality via InstructLab; OpenShift AI adds runtime safety for served models. Red Hat positions guardrails as platform plumbing customers deploy beside open or NVIDIA runtimes, not as a single proprietary model.\n","externalUrl":null,"permalink":"/en/ai/guardrails/","section":"Index","summary":"Guardrails are controls wrapped around LLM inference to reduce harmful, non-compliant, or off-policy behavior without replacing the base model. Their objective is AI safety and governance in production: block or rewrite prompts that attempt prompt injection or jailbreaks, filter toxic or leaked PII in outputs, enforce topic allowlists, validate structured tool calls, and log decisions for audit. Guardrails sit on the request path (before tokens reach the model or after the model proposes a draft response), combining rule engines, classifiers, regex, and sometimes smaller models. They complement—not replace—application auth, network policy, and human review; enterprises treat them as mandatory for customer-facing and internal copilots.\n","title":"Guardrails","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/guardrails/","section":"Tags","summary":"","title":"Guardrails","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/hardening/","section":"Tags","summary":"","title":"Hardening","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/hardware/","section":"Tags","summary":"","title":"Hardware","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/hash/","section":"Tags","summary":"","title":"Hash","type":"tags"},{"content":"A cryptographic hash function maps an input of arbitrary length (a file, a certificate, a password, a block of network data) to a fixed-length digest (also called a hash or fingerprint) with three security properties that distinguish it from non-cryptographic checksums. Preimage resistance: given a digest h, it is computationally infeasible to find any input m such that H(m) = h. Second preimage resistance: given an input m1, it is computationally infeasible to find a different input m2 such that H(m1) = H(m2). Collision resistance: it is computationally infeasible to find any pair (m1, m2) with m1 ≠ m2 such that H(m1) = H(m2). Collision resistance is the strongest property and implies second preimage resistance but not preimage resistance. These properties together make a hash function a one-way, tamper-evident fingerprint: two inputs that produce the same digest cannot be found by an adversary, and knowing the digest reveals nothing about the input beyond its length.\nThe dominant hash functions in current deployment are the SHA-2 and SHA-3 families, both NIST standards. SHA-256 (256-bit digest, part of SHA-2) is the universal default: it is the hash algorithm in TLS certificate fingerprints, the hash chained in Bitcoin blocks, the digest algorithm in sha256sum, the hash in HMAC-SHA-256 for message authentication, and the default in virtually every modern cryptographic protocol. SHA-384 and SHA-512 are SHA-2 variants with longer digests and slightly different internal state, used where a larger security margin is required (CNSA-suite requirements, ECDSA P-384 signatures). SHA-3 (also called Keccak) is structurally different from SHA-2 — a sponge construction rather than Merkle-Damgård — providing design diversity in case a weakness specific to SHA-2\u0026rsquo;s structure is found; SHA3-256 and SHA3-512 are the fixed-output variants, while SHAKE128 and SHAKE256 are XOFs (extendable output functions) that produce arbitrarily long output and are used internally in ML-KEM, ML-DSA, and SLH-DSA as the underlying primitive. SHA-1 (160-bit digest) is fully broken for collision resistance — the SHAttered attack (2017) produced a chosen-prefix collision in practical time — and is deprecated everywhere; it persists only in legacy Git object identifiers (SHA-1 is being phased out in Git\u0026rsquo;s object store in favour of SHA-256) and old TLS/SSH configurations that should be upgraded immediately. MD5 is similarly broken and should never be used for security purposes.\nHash functions appear in every layer of the infrastructure described in this glossary, usually invisibly. In PKI and X.509, the signature algorithm ecdsa-with-SHA256 means ECDSA applied to the SHA-256 digest of the certificate\u0026rsquo;s ToBeSigned structure. In TLS, the transcript hash accumulated during the handshake is the SHA-256 or SHA-384 digest of all handshake messages, used to bind the session keys to the exact exchange that produced them. In LUKS, key derivation from a passphrase uses Argon2 or PBKDF2, both of which use SHA-2 internally to produce a key of the right length from a slow, iterated hashing process. In composefs and OCI, content-addressed storage is entirely hash-based: every blob is identified by its SHA-256 digest, making the digest the canonical, immutable address of the content. In IMA, every file measurement is a SHA-256 (or SHA-512) digest extended into TPM PCR 10. In SBOM and VEX, component identity via PURL is often combined with a SHA-256 hash of the artifact as a secondary identifier. In SLH-DSA, the entire signature scheme\u0026rsquo;s security reduces to the collision and preimage resistance of the underlying hash — the algorithm\u0026rsquo;s conservative appeal is precisely that trusting SLH-DSA requires trusting only the hash function, not any new algebraic assumption. Against quantum computers, Grover\u0026rsquo;s algorithm halves the effective security of a hash function in terms of preimage resistance — SHA-256\u0026rsquo;s effective quantum security is 128 bits, sufficient but not generous — while collision resistance is more complex but generally considered to require output sizes of 384 bits or more for full quantum resistance, which is why SLH-DSA uses SHA-512 or SHAKE256 variants at its higher security levels.\n","externalUrl":null,"permalink":"/en/security/hash/","section":"Index","summary":"A cryptographic hash function maps an input of arbitrary length (a file, a certificate, a password, a block of network data) to a fixed-length digest (also called a hash or fingerprint) with three security properties that distinguish it from non-cryptographic checksums. Preimage resistance: given a digest h, it is computationally infeasible to find any input m such that H(m) = h. Second preimage resistance: given an input m1, it is computationally infeasible to find a different input m2 such that H(m1) = H(m2). Collision resistance: it is computationally infeasible to find any pair (m1, m2) with m1 ≠ m2 such that H(m1) = H(m2). Collision resistance is the strongest property and implies second preimage resistance but not preimage resistance. These properties together make a hash function a one-way, tamper-evident fingerprint: two inputs that produce the same digest cannot be found by an adversary, and knowing the digest reveals nothing about the input beyond its length.\n","title":"Hash Function (Cryptographic Hash Function)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/hash-based/","section":"Tags","summary":"","title":"Hash-Based","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/healthcare/","section":"Tags","summary":"","title":"Healthcare","type":"tags"},{"content":"The Health Insurance Portability and Accountability Act (HIPAA) is a United States federal law enacted in 1996 and enforced by the Department of Health and Human Services (HHS) Office for Civil Rights (OCR). HIPAA is not a voluntary standard or certification — it is mandatory US law with civil and criminal penalties for non-compliance (fines up to $1.5M per violation category per year, and criminal penalties including imprisonment). HIPAA applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically) and their business associates (any entity that creates, receives, maintains, or transmits Protected Health Information — PHI — on behalf of a covered entity). The law\u0026rsquo;s security requirements are defined primarily in two rules: the Privacy Rule (what PHI can be used and disclosed) and the Security Rule (administrative, physical, and technical safeguards required to protect electronic PHI — ePHI). Key technical requirements include access controls, audit controls, integrity controls, transmission security (encryption), and contingency planning. Unlike prescriptive standards (like CIS or DISA STIG), HIPAA\u0026rsquo;s Security Rule is flexible and scalable — it defines required outcomes but allows organizations to determine the specific technologies used. The Breach Notification Rule requires reporting unauthorized disclosures to HHS and affected individuals within 60 days. HIPAA has no \u0026ldquo;certification\u0026rdquo; — compliance is demonstrated through documented risk assessments, policies, and technical controls.\nRed Hat software is extensively deployed in US healthcare environments that must comply with HIPAA, including hospital systems, health insurance companies, pharmaceutical manufacturers, and health IT vendors. Red Hat addresses HIPAA\u0026rsquo;s Security Rule technical safeguards through several mechanisms. For access controls (§164.312(a)): RHEL provides PAM-based authentication, SSSD integration with identity providers, and role-based access control; OpenShift extends this with RBAC, network policies, and namespace isolation that enforce least-privilege access to ePHI workloads. For audit controls (§164.312(b)): RHEL\u0026rsquo;s auditd subsystem, OpenShift\u0026rsquo;s comprehensive API audit logging, and Red Hat Insights provide the tamper-evident records HIPAA demands. For integrity (§164.312(c)): IMA (Integrity Measurement Architecture), dm-verity for immutable file systems, and the Trusted Software Supply Chain ensure that systems processing ePHI have not been tampered with. For transmission security (§164.312(e)): system-wide TLS crypto policies, FIPS 140-3 validated modules, and service mesh mTLS encryption protect ePHI in transit. Red Hat does not itself \u0026ldquo;certify\u0026rdquo; HIPAA compliance (no one does — it is a self-attested regime), but it publishes HIPAA mapping documentation showing how its products\u0026rsquo; security features address each Security Rule requirement, and the Compliance Operator can continuously validate that the technical controls remain in place.\nAdditional Information # HIPAA - HHS Official HIPAA Security Rule - HHS Red Hat HIPAA compliance information ","externalUrl":null,"permalink":"/en/compliance/hipaa/","section":"Index","summary":"The Health Insurance Portability and Accountability Act (HIPAA) is a United States federal law enacted in 1996 and enforced by the Department of Health and Human Services (HHS) Office for Civil Rights (OCR). HIPAA is not a voluntary standard or certification — it is mandatory US law with civil and criminal penalties for non-compliance (fines up to $1.5M per violation category per year, and criminal penalties including imprisonment). HIPAA applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically) and their business associates (any entity that creates, receives, maintains, or transmits Protected Health Information — PHI — on behalf of a covered entity). The law’s security requirements are defined primarily in two rules: the Privacy Rule (what PHI can be used and disclosed) and the Security Rule (administrative, physical, and technical safeguards required to protect electronic PHI — ePHI). Key technical requirements include access controls, audit controls, integrity controls, transmission security (encryption), and contingency planning. Unlike prescriptive standards (like CIS or DISA STIG), HIPAA’s Security Rule is flexible and scalable — it defines required outcomes but allows organizations to determine the specific technologies used. The Breach Notification Rule requires reporting unauthorized disclosures to HHS and affected individuals within 60 days. HIPAA has no “certification” — compliance is demonstrated through documented risk assessments, policies, and technical controls.\n","title":"HIPAA","type":"compliance"},{"content":"HMAC (Hash-based Message Authentication Code), standardised in RFC 2104 (1997) and FIPS 198-1, is a construction that produces a Message Authentication Code (MAC) by combining a cryptographic hash function with a shared secret key. A plain hash function provides integrity — any modification to a message changes its digest — but anyone can recompute the digest of a modified message, so a hash alone cannot prove that a message came from a specific party who holds a secret. HMAC adds authenticity: only a party who knows the key K can produce a valid HMAC(K, message), and only a party who knows K can verify it. The construction is HMAC(K, m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m)) — two rounds of hashing with the key XOR\u0026rsquo;d against inner and outer padding constants — a design chosen to be provably secure against length-extension attacks that affect naive H(K ∥ m) constructions with Merkle-Damgård hash functions like SHA-256. HMAC is proven secure as long as the underlying hash function is a pseudorandom function, a weaker requirement than collision resistance, meaning HMAC-SHA-256 remains secure even in scenarios where SHA-256 collision resistance might be weakened.\nHMAC appears throughout the infrastructure stack in roles that require both integrity and authenticity from a shared secret. In TLS, the Finished message in the TLS 1.2 handshake is an HMAC over the handshake transcript, binding the negotiated session keys to the exact exchange that produced them and preventing transcript manipulation. In JWT (JSON Web Tokens), the HS256, HS384, and HS512 algorithm identifiers use HMAC-SHA-256/384/512 to sign the token header and payload with a shared secret — a symmetric alternative to the asymmetric RS256/ES256 used in OIDC ID tokens; HMAC-signed JWTs are appropriate for single-issuer/single-verifier scenarios (both parties share the secret) but cannot be used where multiple relying parties need to verify a token without also being able to forge one. TOTP (Time-based One-Time Password, RFC 6238) is built on HOTP (HMAC-based OTP, RFC 4226): the OTP is derived as HOTP(K, T) = truncate(HMAC-SHA-1(K, T)) where T is the current 30-second time window, and the shared secret K is the value encoded in an authenticator app\u0026rsquo;s QR code — meaning TOTP security depends entirely on the secrecy of that shared key and the integrity of its provisioning. API request signing (AWS Signature Version 4, GitHub webhook signatures) uses HMAC-SHA-256 over the canonical request string with a derived key, allowing the server to verify that a request was produced by a party knowing the API secret without transmitting the secret itself.\nHMAC is also the construction inside HKDF (HMAC-based Key Derivation Function, RFC 5869), the standard key derivation function used throughout modern cryptographic protocols. HKDF takes an input key material (a shared secret from a Diffie-Hellman exchange, a pre-shared key, or a password hash), an optional salt, and optional context information, and uses two HMAC operations to produce a pseudorandom output of any desired length: HKDF-Extract(salt, IKM) = HMAC(salt, IKM) produces a uniformly distributed pseudorandom key, and HKDF-Expand(PRK, info, length) = HMAC(PRK, ...) stretches it to the required length. TLS 1.3 uses HKDF-SHA-256 or HKDF-SHA-384 to derive all session keys from the handshake transcript and the DH shared secret; ML-KEM decapsulation outputs a 32-byte shared secret that is typically passed through HKDF before use; WireGuard uses HKDF-BLAKE2s for key derivation. Against quantum computers, HMAC and HKDF are not directly threatened: Grover\u0026rsquo;s algorithm does not apply to MAC forgery (which requires knowing the key, not inverting the hash), and their security depends on the hash function\u0026rsquo;s pseudorandomness properties rather than its collision resistance. HMAC-SHA-256 and HMAC-SHA-384 are considered quantum-safe at their current key lengths, requiring no algorithm migration as part of the PQC transition.\n","externalUrl":null,"permalink":"/en/security/hmac/","section":"Index","summary":"HMAC (Hash-based Message Authentication Code), standardised in RFC 2104 (1997) and FIPS 198-1, is a construction that produces a Message Authentication Code (MAC) by combining a cryptographic hash function with a shared secret key. A plain hash function provides integrity — any modification to a message changes its digest — but anyone can recompute the digest of a modified message, so a hash alone cannot prove that a message came from a specific party who holds a secret. HMAC adds authenticity: only a party who knows the key K can produce a valid HMAC(K, message), and only a party who knows K can verify it. The construction is HMAC(K, m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m)) — two rounds of hashing with the key XOR’d against inner and outer padding constants — a design chosen to be provably secure against length-extension attacks that affect naive H(K ∥ m) constructions with Merkle-Damgård hash functions like SHA-256. HMAC is proven secure as long as the underlying hash function is a pseudorandom function, a weaker requirement than collision resistance, meaning HMAC-SHA-256 remains secure even in scenarios where SHA-256 collision resistance might be weakened.\n","title":"HMAC (Hash-based Message Authentication Code)","type":"security"},{"content":"Passionate about family travel, great restaurants and live music.\nThis site is a journal where I share our discoveries, itineraries and favourites.\n","externalUrl":null,"permalink":"/en/accueil/","section":"Home","summary":"Passionate about family travel, great restaurants and live music.\nThis site is a journal where I share our discoveries, itineraries and favourites.\n","title":"Home","type":"accueil"},{"content":"","externalUrl":null,"permalink":"/en/tags/hpc/","section":"Tags","summary":"","title":"Hpc","type":"tags"},{"content":"A Hardware Security Module (HSM) is a purpose-built, tamper-resistant hardware device that holds cryptographic keys and performs cryptographic operations — signing, encryption, decryption, random number generation — entirely within its own protected boundary. The defining property is that private keys generated inside an HSM never exist in plaintext outside it: operations that need the key are sent into the HSM and the result is returned, but the key material itself cannot be extracted. This property is enforced both logically (the firmware refuses export in plaintext) and physically (the device detects and responds to tampering by erasing key material before an attacker can read it). HSMs come in several physical forms: network-attached appliances (rack-mounted devices accessed over the network by many clients), PCIe cards (embedded in a server), and compact USB devices for lower-throughput use cases like protecting CA root keys offline.\nThe primary trust assurance for an HSM is its FIPS 140 certification, a NIST standard defining four security levels for cryptographic modules. Level 1 requires only that approved algorithms are used. Level 2 adds tamper-evidence — physical seals that show whether the enclosure has been opened. Level 3 — the most common level for commercial HSMs — adds tamper-resistance (the device actively erases keys when intrusion is detected) and identity-based authentication to prevent unauthorized use of the key store. Level 4 adds environmental attack resistance (voltage, temperature, radiation) and is typically reserved for the most sensitive applications such as national-security or payment-network root keys. An HSM\u0026rsquo;s FIPS certification is what allows it to serve as the trust anchor in regulated environments: PCI DSS requires HSMs for payment key management, most certificate authority root keys are stored in FIPS 140-2 Level 3 or higher devices, and many national PKI programmes mandate them by regulation. Clients interact with HSMs through standardised interfaces: PKCS#11 (the most widely-supported API, used by OpenSSL, NSS, and most Linux tooling), KMIP (key management protocol), JCE, and CNG.\nIn the broader infrastructure stack, HSMs appear in two roles. As a root-of-trust for signing, an HSM holds the CA private key, code-signing key, or Secure Boot signing key and performs all signing operations on behalf of a pipeline — the key never touches the CI/CD system, so a compromised build host cannot steal it. As a seal backend for secret management, tools like Vault use an HSM (via PKCS#11) as their auto-unseal mechanism: Vault\u0026rsquo;s master key is wrapped by a key held in the HSM, so Vault can unseal automatically on restart without a human holding unseal shares, while the master key remains protected by hardware. The relationship to the TPM is one of complementary scope: a TPM is a fixed-function, low-cost chip soldered to a motherboard, intended to measure boot state and seal small secrets to platform identity; an HSM is a high-performance, reprogrammable, physically hardened appliance intended for large volumes of cryptographic operations and multi-user key management, deployable wherever in the network the workload demands.\n","externalUrl":null,"permalink":"/en/security/hsm/","section":"Index","summary":"A Hardware Security Module (HSM) is a purpose-built, tamper-resistant hardware device that holds cryptographic keys and performs cryptographic operations — signing, encryption, decryption, random number generation — entirely within its own protected boundary. The defining property is that private keys generated inside an HSM never exist in plaintext outside it: operations that need the key are sent into the HSM and the result is returned, but the key material itself cannot be extracted. This property is enforced both logically (the firmware refuses export in plaintext) and physically (the device detects and responds to tampering by erasing key material before an attacker can read it). HSMs come in several physical forms: network-attached appliances (rack-mounted devices accessed over the network by many clients), PCIe cards (embedded in a server), and compact USB devices for lower-throughput use cases like protecting CA root keys offline.\n","title":"HSM (Hardware Security Module)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/ict-products/","section":"Tags","summary":"","title":"Ict-Products","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/identity/","section":"Tags","summary":"","title":"Identity","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ieee/","section":"Tags","summary":"","title":"Ieee","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ieee-1588/","section":"Tags","summary":"","title":"Ieee-1588","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ima/","section":"Tags","summary":"","title":"Ima","type":"tags"},{"content":"IMA (Integrity Measurement Architecture) is a Linux kernel subsystem, merged in kernel 2.6.30, that hooks into the kernel\u0026rsquo;s file access paths — execve(), mmap(), open() — and computes a cryptographic hash of each file\u0026rsquo;s contents before it is accessed, according to a configurable policy. It is the runtime half of the Linux integrity story: where TPM PCR measurements and Secure Boot cover what was loaded during the boot sequence, IMA covers what happens after the OS is running, hashing executables, libraries, kernel modules, firmware, and configuration files as they are opened, creating a continuously updated record of everything the system has actually used.\nIMA operates across four distinct modes, selectable per-rule in its policy. Measurement is the foundational mode: each hash is appended to a kernel-resident measurement log and, if a TPM is present, extended into PCR 10 — the register reserved exclusively for IMA across the Linux TPM PCR allocation. Because PCR registers can only be extended (never reset without a reboot), the aggregate value in PCR 10 accumulates a tamper-evident record of every measured file access across the system\u0026rsquo;s uptime; any software tampering with the log without also tampering with the TPM would produce a mismatch. Appraisal adds local enforcement: the kernel compares the computed hash against a reference value stored in the file\u0026rsquo;s security.ima extended attribute, and denies access if they do not match — this is how IMA can prevent execution of files that have been modified since they were last signed. Audit logs measurements to the kernel audit subsystem without enforcing. The fourth mode, protect, is implemented by the companion EVM (Extended Verification Module): EVM computes an HMAC over a file\u0026rsquo;s security extended attributes (including security.ima, security.selinux, and others) and detects offline tampering with those attributes — closing the attack where an adversary modifies a file and updates its security.ima hash to match while the system is powered off.\nThe primary operational use case for IMA measurement is remote runtime attestation via Keylime: a lightweight agent running on the attested system periodically produces a TPM quote over PCR 10 and the full measurement log; a remote verifier receives the quote, validates it against the TPM\u0026rsquo;s endorsement key, replays the log to confirm it matches the PCR value, and checks every entry against a policy-defined allowlist of approved file hashes. Any unexpected binary — a dropped rootkit, a modified library, an unapproved kernel module — appears as an unknown hash and immediately triggers a failed attestation state. This makes IMA the mechanism that extends the TPM\u0026rsquo;s boot-time attestation guarantee into a continuous, file-level runtime guarantee: the TPM and measured boot stack can prove what was loaded at boot; IMA and Keylime can prove what has been executed since.\nAdditional Information # Integrity Measurement Architecture (IMA) Wiki ","externalUrl":null,"permalink":"/en/security/ima/","section":"Index","summary":"IMA (Integrity Measurement Architecture) is a Linux kernel subsystem, merged in kernel 2.6.30, that hooks into the kernel’s file access paths — execve(), mmap(), open() — and computes a cryptographic hash of each file’s contents before it is accessed, according to a configurable policy. It is the runtime half of the Linux integrity story: where TPM PCR measurements and Secure Boot cover what was loaded during the boot sequence, IMA covers what happens after the OS is running, hashing executables, libraries, kernel modules, firmware, and configuration files as they are opened, creating a continuously updated record of everything the system has actually used.\n","title":"IMA (Integrity Measurement Architecture)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/immutable/","section":"Tags","summary":"","title":"Immutable","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/imt-2030/","section":"Tags","summary":"","title":"Imt-2030","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/incident-response/","section":"Tags","summary":"","title":"Incident-Response","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/ai/","section":"Index","summary":"","title":"Index","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/compliance/","section":"Index","summary":"","title":"Index","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/security/","section":"Index","summary":"","title":"Index","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/telco/","section":"Index","summary":"","title":"Index","type":"telco"},{"content":"","externalUrl":null,"permalink":"/en/tags/industry-4.0/","section":"Tags","summary":"","title":"Industry-4.0","type":"tags"},{"content":"Inference is the operational phase of machine learning where a trained model is applied to new inputs to produce outputs: next tokens in an LLM, bounding boxes in vision, embeddings for search, or scores in tabular models. Its objective is reliable serving at scale—honoring latency targets (time to first token, p99 completion time), throughput (requests or tokens per second), availability, and cost per query—rather than improving weights. In generative AI, inference splits into prefill (processing the prompt in one or few forward passes) and decode (autoregressive generation of each output token), each with different bottlenecks. Production inference adds API gateways, auth, rate limiting, observability, model versioning, A/B tests, and guardrails; the model file is read-mostly while KV cache and batch state are ephemeral per session.\nArchitecturally, inference favors low latency per request and efficient memory reuse on accelerators; training favors sustained FLOPs over huge datasets with frequent all-to-all communication and checkpoint writes. A CPU can serve small models or orchestrate I/O, but LLM inference at useful scale runs on GPUs (or TPUs/ASICs) with frameworks such as vLLM, NIM, or Triton, often in containers on Kubernetes. The host CPU schedules batches, handles networking, and runs the control plane; the device holds weights and the KV cache. Scaling is horizontal (more replicas) and vertical (tensor parallelism, disaggregation); schedulers like llm-d route traffic so replicas with warm prefix cache do more work. Training clusters optimize for gradient sync and large memory per job; inference clusters optimize for concurrent sessions, tail latency, and cost per token—different failure modes and different autoscaling signals.\nRed Hat addresses inference through Red Hat OpenShift AI, RHEL AI, and OpenShift as the deployment substrate. Supported patterns include vLLM and partner NIM microservices on GPU nodes, routes and service mesh for north-south traffic, llm-d for distributed routing on OpenShift, and enterprise Linux for drivers and security. Red Hat documents reference architectures for private AI inference (GPU sizing, MIG, networking, storage for model artifacts), integrates observability and CI/CD for model promotions, and aligns with the NVIDIA AI stack on certified hardware. Training may happen elsewhere (cloud burst, dedicated cluster); inference is often what runs continuously on the customer’s Red Hat platform close to applications and data.\n","externalUrl":null,"permalink":"/en/ai/inference/","section":"Index","summary":"Inference is the operational phase of machine learning where a trained model is applied to new inputs to produce outputs: next tokens in an LLM, bounding boxes in vision, embeddings for search, or scores in tabular models. Its objective is reliable serving at scale—honoring latency targets (time to first token, p99 completion time), throughput (requests or tokens per second), availability, and cost per query—rather than improving weights. In generative AI, inference splits into prefill (processing the prompt in one or few forward passes) and decode (autoregressive generation of each output token), each with different bottlenecks. Production inference adds API gateways, auth, rate limiting, observability, model versioning, A/B tests, and guardrails; the model file is read-mostly while KV cache and batch state are ephemeral per session.\n","title":"Inference","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/inference/","section":"Tags","summary":"","title":"Inference","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/infiniband/","section":"Tags","summary":"","title":"Infiniband","type":"tags"},{"content":"InfiniBand is a high-performance network fabric designed for datacenter and HPC clusters, natively supporting RDMA (Remote Direct Memory Access) with low latency, high bandwidth, and features such as adaptive routing and congestion control at the link layer. Its objective in AI is to connect many GPU servers so distributed training (gradient all-reduce via NCCL) and multi-node inference (tensor parallel, llm-d prefill/decode KV transfer) are not limited by TCP overhead on a CPU. InfiniBand NICs (e.g. NVIDIA ConnectX) present verbs APIs; subnets are managed with an Subnet Manager and partitioned for multi-tenant isolation.\nArchitecturally, InfiniBand differs from Ethernet in purpose-built RDMA semantics and historically simpler lossless delivery within a well-designed fabric—though RoCE brings RDMA to Ethernet for customers who want converged networks. A CPU is not in the hot path for large transfers once queues are posted; GPUs or their NIC peers move data directly. Compared with NVLink inside a server, InfiniBand is the east-west cluster plane. Bandwidth planning (HDR, NDR, XDR generations), cable/plan topology, and PKey or tenant isolation are core ops skills. Kubernetes passes IB devices to training or inference pods via device plugins and tuned CNIs on OpenShift.\nRed Hat supports InfiniBand on RHEL (drivers, IPoIB where needed, RDMA core) and documents HPC/AI cluster networking for OpenShift and bare metal. Telco and AI reference architectures on Red Hat stacks assume IB or high-end RoCE for scale-out training and for llm-d-style disaggregation. Red Hat integrates the OS and orchestration layer; Mellanox/NVIDIA and switch vendors document certified leaf-spine designs. Customers run the same SELinux-hardened RHEL on GPU nodes whether the fabric is IB or RoCE.\n","externalUrl":null,"permalink":"/en/ai/infiniband/","section":"Index","summary":"InfiniBand is a high-performance network fabric designed for datacenter and HPC clusters, natively supporting RDMA (Remote Direct Memory Access) with low latency, high bandwidth, and features such as adaptive routing and congestion control at the link layer. Its objective in AI is to connect many GPU servers so distributed training (gradient all-reduce via NCCL) and multi-node inference (tensor parallel, llm-d prefill/decode KV transfer) are not limited by TCP overhead on a CPU. InfiniBand NICs (e.g. NVIDIA ConnectX) present verbs APIs; subnets are managed with an Subnet Manager and partitioned for multi-tenant isolation.\n","title":"InfiniBand","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/infrastructure/","section":"Tags","summary":"","title":"Infrastructure","type":"tags"},{"content":"initramfs (initial RAM filesystem) is the temporary root filesystem the Linux kernel mounts immediately after loading itself and before switching to the machine’s real root. The bootloader — GRUB, systemd-boot, or firmware loading a UKI — passes a compressed cpio image (historically called an initrd, though modern Linux always unpacks it as an initramfs into tmpfs, not a separate ramdisk block device). The kernel extracts this archive into an in-memory tree, executes /init as pid 1, and that early userspace environment is responsible for everything the bare kernel cannot yet do: loading storage and filesystem kernel modules, bringing up networking, discovering and unlocking LUKS volumes, activating LVM or multipath devices, mounting the true root partition, and finally calling switch_root (or pivot_root) to hand control to the installed system’s init — typically systemd on current distributions. If the initramfs fails, the boot stops before userspace on the real root ever starts; if it succeeds, it is discarded and its memory reclaimed once the pivot completes.\nThe initramfs is not a fixed image shipped with the kernel — it is built per machine profile from the installed OS’s userspace. On RHEL, Fedora, and most enterprise Linux, dracut is the generator: it assembles a modular archive from dracut modules (crypt, lvm, network, nfs, iscsi, clevis, and dozens more) matching what hostonly mode infers from the running system or what an installer configured. Debian and Ubuntu use initramfs-tools; Arch uses mkinitcpio. The build pulls in userspace binaries (cryptsetup, clevis, ip, lvm, mdadm, nm-initrd-generator, etc.), udev rules, kernel modules for the initrd’s own hardware, and systemd units for the initrd target. LUKS unlocking is the most security-relevant path: systemd-cryptsetup in the initramfs prompts for a passphrase, reads a TPM2-sealed keyslot enrolled via systemd-cryptenroll, or runs a Clevis pin policy (Tang NBDE, TPM2 PCR binding, or combined SSS AND/OR policies) before / can mount. Network-bound and TPM-bound unlock therefore depend entirely on the initramfs containing the correct Clevis client, TPM tools, and network stack — a mismatch between the initramfs built at install time and the storage layout at boot produces the familiar “enter passphrase for encrypted volume” fallback even when automatic unlock was configured.\nFrom a boot-security perspective, the initramfs is a first-class component of the trusted boot chain, not an afterthought. Measured boot records the initramfs hash into TPM PCRs before the kernel runs it — PCR 9 when GRUB loads separate kernel and initrd files, PCR 11 when a UKI bundles kernel and initramfs as one signed payload, and PCR 13 for UKI initrd extension images. Changing the initramfs — after a kernel update, a dracut rebuild, or a Clevis policy change — changes those PCR values and therefore breaks LUKS PCR sealing unless keyslots are re-enrolled. Secure Boot enforcement applies to the initramfs only when it is part of a signed UKI or otherwise covered by the bootloader’s signature policy; a separately loaded, unsigned initrd on a Secure Boot system may still boot depending on distribution shim/GRUB policy, which is why UKI-centric stacks treat the initramfs as statically bundled and signed with the kernel. bootc and image-based OS delivery ship the initramfs inside the OCI/bootable image alongside the kernel under /usr/lib/modules and rebuild it when the image changes, keeping the early-boot environment versioned with the same artifact as the root filesystem. Operational discipline for hardened systems is therefore: rebuild the initramfs whenever crypto, storage, or network boot dependencies change; treat initramfs updates as security-relevant events in the same class as kernel updates; and verify that measured-boot reference values and LUKS TPM policies are updated after each change.\n","externalUrl":null,"permalink":"/en/security/initramfs/","section":"Index","summary":"initramfs (initial RAM filesystem) is the temporary root filesystem the Linux kernel mounts immediately after loading itself and before switching to the machine’s real root. The bootloader — GRUB, systemd-boot, or firmware loading a UKI — passes a compressed cpio image (historically called an initrd, though modern Linux always unpacks it as an initramfs into tmpfs, not a separate ramdisk block device). The kernel extracts this archive into an in-memory tree, executes /init as pid 1, and that early userspace environment is responsible for everything the bare kernel cannot yet do: loading storage and filesystem kernel modules, bringing up networking, discovering and unlocking LUKS volumes, activating LVM or multipath devices, mounting the true root partition, and finally calling switch_root (or pivot_root) to hand control to the installed system’s init — typically systemd on current distributions. If the initramfs fails, the boot stops before userspace on the real root ever starts; if it succeeds, it is discarded and its memory reclaimed once the pivot completes.\n","title":"initramfs (initial RAM filesystem)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/int8/","section":"Tags","summary":"","title":"Int8","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/integration/","section":"Tags","summary":"","title":"Integration","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/integrity/","section":"Tags","summary":"","title":"Integrity","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/intent-based/","section":"Tags","summary":"","title":"Intent-Based","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/interconnect/","section":"Tags","summary":"","title":"Interconnect","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/international/","section":"Tags","summary":"","title":"International","type":"tags"},{"content":"IPsec (Internet Protocol Security) is a suite of IETF standards (core specification RFC 4301) that adds cryptographic security to IP packets at the network layer, transparently to applications running above it. Where TLS secures a specific connection between two application endpoints, IPsec secures all IP traffic between two hosts or networks — including traffic from applications that have no TLS support, protocols that predate encryption (routing protocols, SNMP, ICMP), and layer-3 metadata that TLS cannot protect. IPsec provides two protocol headers: AH (Authentication Header, IP protocol 51) signs the IP packet including immutable header fields, providing integrity and source authentication without confidentiality — rarely used in modern deployments because NAT rewrites fields that AH covers. ESP (Encapsulating Security Payload, IP protocol 50) encrypts the payload and provides authenticated encryption with AES-GCM or ChaCha20-Poly1305, optionally protecting the inner IP header as well; ESP is the universally deployed choice. Both operate in two modes: transport mode protects only the payload of an existing IP packet (used for host-to-host encryption between endpoints that share routing), and tunnel mode encapsulates the entire original IP packet inside a new one with new source and destination addresses — the basis of VPN gateways where traffic from one network is tunnelled to another through the public internet.\nThe session management layer is IKEv2 (Internet Key Exchange version 2, RFC 7296), which runs over UDP port 500 (and 4500 for NAT traversal with UDP encapsulation of ESP). IKEv2 negotiates the cipher suite, performs mutual authentication (via X.509 certificates, raw public keys, or pre-shared keys), and establishes Security Associations (SAs): unidirectional agreements that specify the cryptographic parameters — algorithm, key, lifetime, and SPI (Security Parameter Index) — for a single direction of traffic. The two parties maintain a Security Association Database (SAD), which maps incoming SPI values to their decryption parameters, and a Security Policy Database (SPD), which maps traffic selectors (source/destination IP prefixes, port ranges, protocols) to the action to take — encrypt (and which SA to use), bypass (send cleartext), or discard. On Linux, both databases live in the kernel\u0026rsquo;s XFRM subsystem (inspectable and configurable via ip xfrm state and ip xfrm policy), and IKEv2 is managed by a user-space daemon — strongSwan and libreswan are the two most common — which communicates with the kernel via the NETLINK_XFRM socket. Hardware offload of IPsec crypto is available on NICs that support xfrm offload, enabling line-rate encryption without CPU overhead.\nIPsec occupies a distinct position relative to the other security layers in this glossary. It operates below the transport layer, so it protects all traffic including mTLS handshakes and the application layer on top — the two can be layered. MACsec operates one layer below IPsec, at layer 2, and can protect the Ethernet frames that carry IPsec packets; the two are complementary. In Kubernetes, IPsec is the transparency-preserving pod-to-pod encryption choice: Cilium supports an IPsec mode where it installs XFRM policies on every node so that all pod traffic crossing node boundaries is ESP-encrypted without any application or container change, using PSK or certificate-based keys rotated automatically. This makes IPsec-based pod encryption a practical alternative to mTLS service mesh overlay encryption for environments where mTLS sidecar injection is undesirable or where the workload is not able to participate in a SPIFFE identity scheme. The PQC transition affects IPsec at the IKEv2 layer: RFC 9370 specifies ML-KEM for use in IKEv2 key exchange, and RFC 9242 defines the ML-DSA signature algorithms for IKEv2 authentication, with strongSwan and libreswan adding support as the standards finalise.\n","externalUrl":null,"permalink":"/en/security/ipsec/","section":"Index","summary":"IPsec (Internet Protocol Security) is a suite of IETF standards (core specification RFC 4301) that adds cryptographic security to IP packets at the network layer, transparently to applications running above it. Where TLS secures a specific connection between two application endpoints, IPsec secures all IP traffic between two hosts or networks — including traffic from applications that have no TLS support, protocols that predate encryption (routing protocols, SNMP, ICMP), and layer-3 metadata that TLS cannot protect. IPsec provides two protocol headers: AH (Authentication Header, IP protocol 51) signs the IP packet including immutable header fields, providing integrity and source authentication without confidentiality — rarely used in modern deployments because NAT rewrites fields that AH covers. ESP (Encapsulating Security Payload, IP protocol 50) encrypts the payload and provides authenticated encryption with AES-GCM or ChaCha20-Poly1305, optionally protecting the inner IP header as well; ESP is the universally deployed choice. Both operate in two modes: transport mode protects only the payload of an existing IP packet (used for host-to-host encryption between endpoints that share routing), and tunnel mode encapsulates the entire original IP packet inside a new one with new source and destination addresses — the basis of VPN gateways where traffic from one network is tunnelled to another through the public internet.\n","title":"IPsec (Internet Protocol Security)","type":"security"},{"content":"iptables is the user-space command-line interface to the Linux kernel\u0026rsquo;s Netfilter packet filtering framework, the dominant firewall tool on Linux from its introduction in 2001 until nftables began replacing it in the mid-2010s. Netfilter inserts hook points at five positions in the kernel\u0026rsquo;s IPv4 (and separately IPv6, via ip6tables) packet processing path: PREROUTING (immediately after a packet arrives, before routing), INPUT (packets destined for the local host), FORWARD (packets being routed through the host), OUTPUT (packets generated by local processes), and POSTROUTING (after routing, before transmission). At each hook point, Netfilter calls into the active tables, each of which contains ordered chains of rules. A rule is a match condition (source IP, destination port, protocol, connection state, interface, packet mark, and many more via match extensions) paired with a target — the action to take if the rule matches: ACCEPT, DROP, REJECT, LOG, MASQUERADE, DNAT, SNAT, or a jump to a user-defined chain. Rules are evaluated in order; the first matching rule\u0026rsquo;s target is applied and evaluation stops (unless the target is LOG or another non-terminating target). If no rule matches, the chain\u0026rsquo;s policy (the default target) applies.\nThe four built-in tables serve distinct purposes. The filter table is the primary firewall: its INPUT, FORWARD, and OUTPUT chains are where ACCEPT and DROP rules live. The nat table handles Network Address Translation in PREROUTING (DNAT — rewriting destination addresses, as in port forwarding), OUTPUT (locally generated NAT), and POSTROUTING (SNAT/MASQUERADE — rewriting source addresses for outbound traffic from a private network). The mangle table modifies packet headers — TTL, TOS/DSCP bits, packet marks via --set-mark — and is present at all five hooks. The raw table, evaluated before connection tracking, is used to exempt specific traffic from Netfilter\u0026rsquo;s connection tracking with NOTRACK, reducing overhead for high-volume trusted flows. Connection tracking (conntrack) is the stateful inspection layer shared across all tables: it classifies each packet as NEW, ESTABLISHED, RELATED, or INVALID, allowing a single rule like -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT to permit all return traffic for established connections without enumerating every possible source. The iptables-save and iptables-restore commands serialise the complete ruleset to text for persistence and atomic bulk loading, since individual iptables rule commands are slow when applied one at a time to large rulesets.\niptables has two well-known operational limitations that drove the development of nftables. First, performance at scale: each rule is evaluated linearly; a ruleset with thousands of source IP ranges (common in Kubernetes, where kube-proxy historically wrote one rule per Service endpoint) causes measurable packet processing overhead because the kernel walks the list for every packet. In Kubernetes clusters with hundreds of Services and thousands of endpoints, this linear walk was a significant contributor to connection latency, driving the adoption of eBPF-based replacements like Cilium that bypass iptables entirely. Second, atomicity and API fragmentation: rules are added one at a time via individual kernel calls with no transactional semantics; ip6tables, arptables, and ebtables are separate tools with separate rulesets despite all sitting on Netfilter; and the user-space API is unwieldy for programmatic management. Despite these limitations, iptables remains universally present on Linux systems as the iptables-legacy backend or — on modern distributions — as a compatibility shim (iptables-nft) that translates iptables commands into nftables rules under the hood, allowing legacy tooling and Kubernetes components that emit iptables commands to function on systems that have fully transitioned to nftables.\n","externalUrl":null,"permalink":"/en/security/iptables/","section":"Index","summary":"iptables is the user-space command-line interface to the Linux kernel’s Netfilter packet filtering framework, the dominant firewall tool on Linux from its introduction in 2001 until nftables began replacing it in the mid-2010s. Netfilter inserts hook points at five positions in the kernel’s IPv4 (and separately IPv6, via ip6tables) packet processing path: PREROUTING (immediately after a packet arrives, before routing), INPUT (packets destined for the local host), FORWARD (packets being routed through the host), OUTPUT (packets generated by local processes), and POSTROUTING (after routing, before transmission). At each hook point, Netfilter calls into the active tables, each of which contains ordered chains of rules. A rule is a match condition (source IP, destination port, protocol, connection state, interface, packet mark, and many more via match extensions) paired with a target — the action to take if the rule matches: ACCEPT, DROP, REJECT, LOG, MASQUERADE, DNAT, SNAT, or a jump to a user-defined chain. Rules are evaluated in order; the first matching rule’s target is applied and evaluation stops (unless the target is LOG or another non-terminating target). If no rule matches, the chain’s policy (the default target) applies.\n","title":"iptables","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/isms/","section":"Tags","summary":"","title":"Isms","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/iso/","section":"Tags","summary":"","title":"Iso","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/iso-27001/","section":"Tags","summary":"","title":"Iso-27001","type":"tags"},{"content":"ISO/IEC 27001 is the world\u0026rsquo;s most widely recognized standard for Information Security Management Systems (ISMS). It is published jointly by ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) — making it a truly international standard, not tied to any single country or jurisdiction. The current version is ISO/IEC 27001:2022, which replaced the 2013 edition and restructured its Annex A controls to align with the updated ISO/IEC 27002:2022 guidance (93 controls organized in 4 themes: Organizational, People, Physical, Technological). The standard specifies requirements (clauses 4–10) for establishing, implementing, maintaining, and continually improving an ISMS — covering context analysis, leadership commitment, risk assessment, treatment planning, operational controls, performance evaluation, and continuous improvement. Certification is voluntary but has become a global market expectation: ISO 27001 certification is required by countless procurement policies, regulatory frameworks (NIS2 references it, ENS aligns with it, E-ITS accepts it as equivalent, BSI IT-Grundschutz enables ISO 27001 certification), and customer contracts. Certification is issued by accredited certification bodies (accredited under ISO/IEC 17021) following a two-stage audit process, valid for 3 years with annual surveillance audits. Over 70,000 organizations worldwide hold ISO 27001 certification. Unlike prescriptive frameworks (DISA STIG, CIS Benchmarks), ISO 27001 is risk-based and outcome-oriented — it specifies what must be achieved but not how, allowing organizations to tailor implementations to their context.\nRed Hat holds ISO/IEC 27001 certification for its global operations, covering the development, delivery, and support of its product portfolio — a certification renewed through regular surveillance audits. This means Red Hat\u0026rsquo;s internal security practices (secure development lifecycle, vulnerability management, access control, incident response, business continuity) are independently verified against the standard\u0026rsquo;s requirements. For customers pursuing their own ISO 27001 certification, Red Hat provides the technical controls that map to Annex A requirements across all four themes. For Organizational controls: Red Hat\u0026rsquo;s CSAF/VEX vulnerability feeds, Insights-driven risk analytics, and documented shared-responsibility models support the information security policies, threat intelligence, and supplier management controls (A.5.x). For Technological controls: RHEL and OpenShift deliver access control (A.8.3), cryptography (A.8.24), secure configuration (A.8.9), logging and monitoring (A.8.15–8.16), network security (A.8.20–8.22), and data protection controls (A.8.10–8.12). The OpenShift Compliance Operator can continuously validate configurations against ISO 27001-derived profiles, providing the ongoing conformity evidence that surveillance auditors examine. Ansible Automation Platform enables the \u0026ldquo;continual improvement\u0026rdquo; cycle (clause 10) by codifying security controls as repeatable, version-controlled playbooks that evolve as the ISMS matures. Red Hat\u0026rsquo;s alignment with ISO 27001 also creates a foundation for meeting other frameworks that reference or build upon it — including BSI IT-Grundschutz (which offers ISO 27001 certification based on IT-Grundschutz), ENS (which aligns its 73 measures with ISO 27001 Annex A), and E-ITS (which accepts ISO 27001 as equivalent compliance evidence).\nAdditional Information # ISO/IEC 27001 - ISO ISO/IEC 27001:2022 overview Red Hat ISO 27001 certification ","externalUrl":null,"permalink":"/en/compliance/iso-27001/","section":"Index","summary":"ISO/IEC 27001 is the world’s most widely recognized standard for Information Security Management Systems (ISMS). It is published jointly by ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) — making it a truly international standard, not tied to any single country or jurisdiction. The current version is ISO/IEC 27001:2022, which replaced the 2013 edition and restructured its Annex A controls to align with the updated ISO/IEC 27002:2022 guidance (93 controls organized in 4 themes: Organizational, People, Physical, Technological). The standard specifies requirements (clauses 4–10) for establishing, implementing, maintaining, and continually improving an ISMS — covering context analysis, leadership commitment, risk assessment, treatment planning, operational controls, performance evaluation, and continuous improvement. Certification is voluntary but has become a global market expectation: ISO 27001 certification is required by countless procurement policies, regulatory frameworks (NIS2 references it, ENS aligns with it, E-ITS accepts it as equivalent, BSI IT-Grundschutz enables ISO 27001 certification), and customer contracts. Certification is issued by accredited certification bodies (accredited under ISO/IEC 17021) following a two-stage audit process, valid for 3 years with annual surveillance audits. Over 70,000 organizations worldwide hold ISO 27001 certification. Unlike prescriptive frameworks (DISA STIG, CIS Benchmarks), ISO 27001 is risk-based and outcome-oriented — it specifies what must be achieved but not how, allowing organizations to tailor implementations to their context.\n","title":"ISO/IEC 27001","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/itu-r/","section":"Tags","summary":"","title":"Itu-R","type":"tags"},{"content":"JWT (JSON Web Token), standardised in RFC 7519, is a compact, self-contained token format that encodes a set of claims — assertions about a subject, an issuer, an audience, and arbitrary application-defined attributes — as a JSON object, signs or encrypts it, and serialises the result as three base64url-encoded segments separated by dots: header.payload.signature. The header is a JSON object specifying the algorithm (alg) and optionally a key ID (kid) used to produce the signature. The payload is a JSON object containing the claims. The signature is computed over base64url(header) + \u0026quot;.\u0026quot; + base64url(payload) using the algorithm declared in the header. The entire token is URL-safe, fits in an HTTP header or query parameter, and is self-describing — a verifier can locate the signing key, check the algorithm, verify the signature, and read the claims without any external lookup beyond fetching the issuer\u0026rsquo;s public key. This self-contained nature is what makes JWTs efficient at scale: unlike opaque tokens, which require a network call to the issuer\u0026rsquo;s introspection endpoint per verification, a JWT can be verified locally with a cached public key, making it suitable for high-throughput API gateways and distributed systems.\nA JWT carries a defined set of registered claims with standardised semantics, alongside application-defined private claims. The registered claims are: iss (issuer — the URL of the party that signed the token, e.g. https://accounts.google.com), sub (subject — a stable identifier for the entity the token represents, e.g. a user ID or a Kubernetes service account), aud (audience — the intended recipient(s) of the token; a verifier must reject tokens where its own identifier is not in aud), exp (expiry — a Unix timestamp after which the token must be rejected), nbf (not-before — the token must be rejected before this time), iat (issued-at — when the token was created), and jti (JWT ID — a unique identifier for the token, used to implement single-use tokens and revocation). Omitting aud verification is one of the most common JWT security vulnerabilities: a token issued for one service can be replayed against another service that accepts the same issuer but does not check the audience. The complete verification sequence is: fetch the JWKS from the issuer\u0026rsquo;s JWKS URI (cached; refresh on unknown kid), find the key matching the token\u0026rsquo;s kid, verify the signature, check iss matches the expected issuer, check aud contains the verifier\u0026rsquo;s identifier, check exp is in the future, check nbf is in the past if present — every step is mandatory. The alg: none attack (stripping the signature and setting algorithm to none) is prevented by rejecting any token whose algorithm is not in an explicit allowlist configured at the verifier; libraries that accept any algorithm declared in the token header are vulnerable.\nJWT is the serialisation format that unifies the token layer of this glossary\u0026rsquo;s identity stack. OAuth 2.0 access tokens are JWTs signed with the authorisation server\u0026rsquo;s private key (RS256, ES256, or EdDSA), carrying scope or scp claims that resource servers evaluate for authorisation. OIDC ID tokens are JWTs with the additional nonce claim binding them to a specific authentication session. Kubernetes service account tokens are JWTs issued by the API server\u0026rsquo;s built-in OIDC provider, carrying kubernetes.io namespace claims that AWS STS, GCP Workload Identity Federation, and Vault\u0026rsquo;s JWT auth method can verify to grant cloud or secret access without static credentials. SPIFFE JWT-SVIDs are JWTs carrying a spiffe:// URI as the sub claim, signed by the SPIRE server\u0026rsquo;s CA, used where mTLS is not available. TOTP authenticator app provisioning secrets are sometimes distributed as JWTs in provisioning flows. The JWS (JSON Web Signature, RFC 7515) and JWE (JSON Web Encryption, RFC 7516) specifications define the full signed and encrypted JWT formats respectively; the JOSE (JSON Object Signing and Encryption) umbrella covers all four: JWS, JWE, JWK (JSON Web Key, RFC 7517) for key representation, and JWA (JSON Web Algorithms, RFC 7518) for algorithm identifiers. The PQC transition requires migrating JWT signing keys from RS256/ES256/EdDSA to ML-DSA: the JWT alg header would carry an ML-DSA OID, and the issuer\u0026rsquo;s JWKS endpoint would publish the ML-DSA public key in JWK format. The IETF JOSE working group is actively standardising ML-DSA and ML-KEM algorithm identifiers for JWA; until those identifiers are finalised and library support lands, hybrid signing (producing both an ES256 and an ML-DSA signature in parallel) is the recommended transition approach for high-assurance token issuers.\n","externalUrl":null,"permalink":"/en/security/jwt/","section":"Index","summary":"JWT (JSON Web Token), standardised in RFC 7519, is a compact, self-contained token format that encodes a set of claims — assertions about a subject, an issuer, an audience, and arbitrary application-defined attributes — as a JSON object, signs or encrypts it, and serialises the result as three base64url-encoded segments separated by dots: header.payload.signature. The header is a JSON object specifying the algorithm (alg) and optionally a key ID (kid) used to produce the signature. The payload is a JSON object containing the claims. The signature is computed over base64url(header) + \".\" + base64url(payload) using the algorithm declared in the header. The entire token is URL-safe, fits in an HTTP header or query parameter, and is self-describing — a verifier can locate the signing key, check the algorithm, verify the signature, and read the claims without any external lookup beyond fetching the issuer’s public key. This self-contained nature is what makes JWTs efficient at scale: unlike opaque tokens, which require a network call to the issuer’s introspection endpoint per verification, a JWT can be verified locally with a cached public key, making it suitable for high-throughput API gateways and distributed systems.\n","title":"JWT (JSON Web Token)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/kata/","section":"Tags","summary":"","title":"Kata","type":"tags"},{"content":"Kata Containers is an Open Infrastructure Foundation (OpenInfra Foundation) project that replaces the Linux namespace and cgroup isolation of a conventional container runtime with a full VM boundary, while remaining entirely compatible with the OCI runtime specification and the Kubernetes CRI. From the perspective of containerd, CRI-O, or the Kubernetes kubelet, a Kata pod is indistinguishable from a runc or crun pod — the same API calls, the same lifecycle verbs, the same pod spec — but instead of calling clone() to create a new namespace, Kata starts a lightweight virtual machine. The workload runs inside that VM with its own kernel, its own device model, and a hardware-enforced isolation boundary between itself and the host kernel. The premise is that Linux namespaces, while convenient, share the same kernel as the host: a kernel vulnerability exploitable from inside a container can affect the host and every other container running on the same node. A VM boundary means that even a full guest kernel compromise cannot directly affect the host.\nThe runtime component that sits between the CRI runtime (containerd or CRI-O) and the VM is the Kata shim (containerd-shim-kata-v2), which implements the containerd shimv2 API. When a pod is created, the shim instantiates a hypervisor — QEMU/KVM by default, with Cloud Hypervisor and Firecracker supported as lighter-weight alternatives — launches a minimal guest OS image, and starts the kata-agent inside the VM: a process that runs as pid 1 in the guest and implements a ttRPC API over a VSOCK socket. The Kata shim on the host side translates OCI container commands (create, start, exec, kill) into agent protocol messages sent over that socket, and elays stdio streams back to the CRI runtime. The guest filesystem is typically shared with the host via virtio-fs, a high-performance FUSE-over-virtio protocol that mounts the container\u0026rsquo;s rootfs and any volumes directly into the VM without copying. Network connectivity is provided by a TAP device on the host side connected to a virtio-net interface inside the guest; the pod\u0026rsquo;s network namespace is set up by the CNI plugin on the host before being passed into the VM. The result is a pod that has a private kernel, private devices, and an isolated network stack, while consuming typically 100–150 MB of memory overhead per pod and starting in under a second on modern hardware.\nKata Containers is the foundational runtime layer for CoCo (Confidential Containers). CoCo extends Kata by targeting TEE-capable hypervisors: instead of a conventional QEMU VM, the kata-agent runs inside a TDX Trust Domain or SEV-SNP confidential guest, giving the pod hardware-enforced memory encryption and attestability in addition to the VM isolation Kata already provides. The Attestation Agent and Confidential Data Hub that CoCo adds to the guest image run alongside the kata-agent, extending the standard Kata architecture with secret delivery and attestation capabilities. Peer Pods extends Kata in the other direction — replacing the local hypervisor call with a remote cloud API call via the Cloud API Adaptor, allowing Kata pods to run on cloud-provisioned CVMs even when the Kubernetes worker node is itself a VM. In both cases the core Kata architecture — shimv2 interface, kata-agent over VSOCK, virtio-fs rootfs — is preserved unchanged; CoCo and Peer Pods are specialisations of it, not replacements.\nAdditional Information # Deploying OpenShift sandboxed containers ","externalUrl":null,"permalink":"/en/security/kata-containers/","section":"Index","summary":"Kata Containers is an Open Infrastructure Foundation (OpenInfra Foundation) project that replaces the Linux namespace and cgroup isolation of a conventional container runtime with a full VM boundary, while remaining entirely compatible with the OCI runtime specification and the Kubernetes CRI. From the perspective of containerd, CRI-O, or the Kubernetes kubelet, a Kata pod is indistinguishable from a runc or crun pod — the same API calls, the same lifecycle verbs, the same pod spec — but instead of calling clone() to create a new namespace, Kata starts a lightweight virtual machine. The workload runs inside that VM with its own kernel, its own device model, and a hardware-enforced isolation boundary between itself and the host kernel. The premise is that Linux namespaces, while convenient, share the same kernel as the host: a kernel vulnerability exploitable from inside a container can affect the host and every other container running on the same node. A VM boundary means that even a full guest kernel compromise cannot directly affect the host.\n","title":"Kata Containers","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/kerberos/","section":"Tags","summary":"","title":"Kerberos","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/kernel/","section":"Tags","summary":"","title":"Kernel","type":"tags"},{"content":"The CISA Known Exploited Vulnerabilities (KEV) Catalog is a living database maintained by the US Cybersecurity and Infrastructure Security Agency that lists CVEs for which CISA has obtained reliable evidence of active exploitation in the wild. It was established under Binding Operational Directive 22-01 (BOD 22-01), issued in November 2021, which requires all US Federal Civilian Executive Branch (FCEB) agencies to remediate KEV-listed vulnerabilities within prescribed timeframes — typically 2 weeks for critical vulnerabilities and up to 6 months for older ones. A vulnerability must meet three criteria to be added: it must have a CVE ID, there must be reliable evidence of exploitation in the wild (not just a proof-of-concept or theoretical risk), and there must be clear remediation guidance available. CISA accepts nominations from the public and adds vulnerabilities continuously; the catalog is available in CSV and JSON formats at a stable URL, making it machine-consumable for integration into vulnerability management platforms and asset inventory tools.\nThe KEV\u0026rsquo;s operational significance is what distinguishes it from other vulnerability scoring and tracking mechanisms. The CVSS base score measures a vulnerability\u0026rsquo;s theoretical severity — how bad exploitation could be in the worst case — but says nothing about whether exploitation is actually occurring. The overwhelming majority of published CVEs are never exploited at scale in the wild; concentrating patching resources on high-CVSS scores that attackers ignore while KEV vulnerabilities with moderate scores go unpatched is a well-documented failure mode of traditional vulnerability management programmes. The KEV inverts this logic: it answers the question \u0026ldquo;what are attackers actually using right now?\u0026rdquo; rather than \u0026ldquo;what could theoretically be the most damaging?\u0026rdquo; Research by CISA and independent analysts consistently shows that KEV vulnerabilities have a dramatically higher probability of being used in a breach than a randomly selected high-CVSS vulnerability. A vulnerability with a CVSS score of 6.5 that is in the KEV catalog represents a higher operational risk than a CVSS 9.8 that is not, because the 6.5 is being actively weaponised. Ransomware groups and nation-state actors frequently exploit KEV-listed vulnerabilities — many KEV entries carry annotations identifying the specific threat actor groups or ransomware families known to use them.\nKEV should be the floor of any vulnerability management programme, not the ceiling. The intended use is: continuously monitor the KEV feed (via the JSON API or a SIEM integration), correlate it against your asset inventory and SBOM data to identify affected systems, and remediate within the BOD 22-01 timeframes regardless of the CVSS score. For organisations outside the US federal government, BOD 22-01 is not legally binding, but CISA explicitly recommends all organisations treat KEV as a mandatory remediation priority — and major compliance frameworks including PCI DSS, NIST SP 800-53, and ISO 27001 vulnerability management controls are increasingly interpreted to require KEV-aligned prioritisation. The KEV feeds naturally into VEX workflows: if a component in your SBOM has a KEV-listed CVE and your VEX document does not contain a not_affected assertion with a valid justification, that vulnerability must be treated as actively exploitable in your product. In the container and Kubernetes context, SBOM-aware scanners (Grype, Trivy, Snyk) and admission controllers (Kyverno with image scanning policies) can be configured to block deployment of images containing KEV-listed vulnerabilities without a corresponding VEX not_affected assertion, providing a continuous KEV-aware gate in the CI/CD pipeline.\n","externalUrl":null,"permalink":"/en/security/kev/","section":"Index","summary":"The CISA Known Exploited Vulnerabilities (KEV) Catalog is a living database maintained by the US Cybersecurity and Infrastructure Security Agency that lists CVEs for which CISA has obtained reliable evidence of active exploitation in the wild. It was established under Binding Operational Directive 22-01 (BOD 22-01), issued in November 2021, which requires all US Federal Civilian Executive Branch (FCEB) agencies to remediate KEV-listed vulnerabilities within prescribed timeframes — typically 2 weeks for critical vulnerabilities and up to 6 months for older ones. A vulnerability must meet three criteria to be added: it must have a CVE ID, there must be reliable evidence of exploitation in the wild (not just a proof-of-concept or theoretical risk), and there must be clear remediation guidance available. CISA accepts nominations from the public and adds vulnerabilities continuously; the catalog is available in CSV and JSON formats at a stable URL, making it machine-consumable for integration into vulnerability management platforms and asset inventory tools.\n","title":"KEV (CISA Known Exploited Vulnerabilities Catalog)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/key-exchange/","section":"Tags","summary":"","title":"Key-Exchange","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/key-management/","section":"Tags","summary":"","title":"Key-Management","type":"tags"},{"content":"Keylime is a CNCF project, originating at MIT Lincoln Laboratory, that turns the raw cryptographic primitives of the TPM into an operable remote attestation system for fleets of Linux machines. Its mission is narrow but important: given that a TPM can produce a signed quote over PCR values, and that IMA can accumulate a runtime measurement log into PCR 10, Keylime provides the infrastructure to continuously collect those quotes from many machines, verify them against policy, react to failures, and gate secret delivery on attestation success — without requiring operators to understand TPM protocols directly.\nKeylime\u0026rsquo;s architecture follows the IETF RATS model and consists of four components with distinct roles. The Agent runs on each machine to be attested: it communicates with the local TPM, generates attestation keys, collects UEFI event logs and IMA measurement logs, and serves quotes to the verifier. The Registrar is an enrollment database: agents register themselves at boot by submitting their TPM Endorsement Key (EK) and a freshly generated Attestation Key (AK); the registrar performs a credential activation challenge to cryptographically confirm the AK belongs to a genuine TPM before recording the agent\u0026rsquo;s identity. The Verifier is the continuous attestation engine: it polls registered agents, requests TPM quotes over a configurable set of PCRs, replays the UEFI event log and IMA measurement log against those PCR values to confirm their integrity, and checks every IMA entry against an operator-supplied allowlist of approved file hashes. If any check fails — an unexpected PCR value, an unrecognised file hash, a missing quote — the verifier raises a revocation event. The Tenant is a CLI and API for operators: it enrolls agents with the verifier, sets policies, and can deliver a secure payload (an encrypted ZIP containing secrets, certificates, or bootstrap scripts) to a node, with decryption gated on the node having passed its first attestation — providing a TPM-anchored secret injection mechanism analogous to what Trustee provides for confidential VMs.\nKeylime is the canonical attestation solution for TPM-equipped Linux hosts and is complementary rather than competing with Trustee: Keylime operates on conventional (non-TEE) hardware using the TPM as its trust anchor, whereas Trustee is designed for confidential computing guests where the TEE hardware itself is the root of trust. In both cases the underlying attestation flow is the same — collect hardware evidence, verify it against reference values, release secrets only to those who pass — but the evidence type, the trust anchor, and the threat model differ. Keylime integrates naturally with IMA-based runtime monitoring, GRUB-measured boot (PCR 8/9), and Secure Boot state (PCR 7), making it the operational glue that turns a measured boot stack into a continuously monitored one.\n","externalUrl":null,"permalink":"/en/security/keylime/","section":"Index","summary":"Keylime is a CNCF project, originating at MIT Lincoln Laboratory, that turns the raw cryptographic primitives of the TPM into an operable remote attestation system for fleets of Linux machines. Its mission is narrow but important: given that a TPM can produce a signed quote over PCR values, and that IMA can accumulate a runtime measurement log into PCR 10, Keylime provides the infrastructure to continuously collect those quotes from many machines, verify them against policy, react to failures, and gate secret delivery on attestation success — without requiring operators to understand TPM protocols directly.\n","title":"Keylime","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/kms/","section":"Tags","summary":"","title":"Kms","type":"tags"},{"content":"KMS v2 (Kubernetes KMS Provider version 2) is the stable (GA since Kubernetes 1.29, KMS v1 deprecated in 1.28 and disabled by default in 1.29) mechanism for encrypting the contents of the Kubernetes etcd datastore at rest using an external key management service. Without encryption, Kubernetes Secrets stored in etcd are base64-encoded — trivially decodable by anyone with read access to the etcd data files or a snapshot. With KMS v2 enabled, resources written to etcd — Secrets, ConfigMaps, and any other API objects selected by the EncryptionConfiguration — are encrypted before being persisted, using a unique per-object key derived locally. The envelope encryption scheme means those per-object keys are never stored in plaintext: only their encrypted form lives in etcd, and only the external KMS holds the wrapping key. The encryption configuration is declared in a file referenced by the API server\u0026rsquo;s --encryption-provider-config flag, with kms: apiVersion: v2 selecting the KMS v2 code path, and endpoint: unix:///path/to/plugin.sock pointing at the plugin\u0026rsquo;s Unix domain socket.\nThe key architectural improvement of KMS v2 over v1 is how Data Encryption Keys (DEKs) are managed. In KMS v1, a new DEK was generated for every single etcd write, requiring one external KMS API call per write to encrypt that DEK — meaning a write-heavy cluster made thousands of KMS calls per second, with associated latency, cost, and rate-limit risk. In KMS v2, the API server generates a single secret seed at startup, makes one KMS API call to encrypt that seed under the remote Key Encryption Key (KEK), caches the encrypted seed in memory, and then derives all per-object DEKs locally using a Key Derivation Function (KDF) — combining the cached seed with per-object random data. Each derived DEK encrypts exactly one etcd object and is then discarded; only the encrypted seed and the per-object ciphertext are persisted. The KMS is contacted again only at startup and at KEK rotation: the API server polls the plugin\u0026rsquo;s Status gRPC method approximately every minute to detect a new key version from the KMS, at which point it generates and encrypts a new seed automatically. Verifying encryption is active is straightforward: direct etcdctl get on a resource should return data prefixed with k8s:enc:kms:v2:\u0026lt;plugin-name\u0026gt;: — a k8s:enc:aescbc: prefix or plain JSON indicates the resource predates the current provider and must be force-rewritten via kubectl get \u0026lt;resource\u0026gt; --all-namespaces -o json | kubectl replace -f -.\nThe plugin deployment model is important and frequently misunderstood. Because the kube-apiserver itself runs as a static pod on control plane nodes (in kubeadm clusters) or as a standalone process, it cannot have a sidecar container — there is no pod to inject into. The KMS plugin must therefore be deployed as a separate static pod in /etc/kubernetes/manifests/ on each control plane node, configured with priorityClassName: system-node-critical so the kubelet starts it before kube-apiserver. The plugin listens on a Unix domain socket on the host filesystem; both the plugin and the kube-apiserver static pod must mount the same host directory to share that socket. If the plugin is not running when kube-apiserver starts, the API server will fail to start — making the plugin a hard dependency of the control plane. The gRPC interface the plugin implements has three methods: Encrypt(plaintext) → ciphertext, Decrypt(ciphertext) → plaintext, and Status() → {version, healthz, keyID}. The keyID returned by Status() is what the API server compares across polls to detect KEK rotation. Available plugin implementations in the upstream ecosystem include: kubernetes-sigs/aws-encryption-provider (maintained by kubernetes-sigs, backed by AWS KMS, the most production-mature option for AWS); azure-kubernetes-kms (Azure Key Vault, maintained in the openshift GitHub org as a fork); ThalesGroup/k8s-kms-plugin (PKCS#11 interface for HSMs including Thales Luna, supports both local and remote HSM via proxy mode); and FalcoSuessgott/vault-kubernetes-kms (HashiCorp Vault Transit engine via AppRole or Token auth — this is a community project, explicitly flagged as early-stage and not yet recommended for production as of this writing; note that since the plugin runs as a static pod before the Kubernetes API is available, Vault Kubernetes auth cannot be used, making AppRole or Token the only viable auth methods). For GCP, the k8s-cloudkms-plugin exists but maintenance status should be verified before production use.\nOpenShift\u0026rsquo;s relationship to KMS v2 must be stated precisely to avoid the errors that appear in many secondary sources. OpenShift\u0026rsquo;s existing etcd encryption mechanism — available since OCP 4.3 via spec.encryption.type: aesCBC or aescbc in the APIServer CR — uses locally-managed, automatically-rotated keys stored in a Secret on the control plane host filesystem under /etc/kubernetes/static-pod-resources/. This provides encryption at rest but with no external key control: the keys are managed entirely within the cluster. KMS v2 integration with an external KMS was introduced as a new capability in OpenShift 4.21, with AWS KMS as the only supported provider: the APIServer CR\u0026rsquo;s spec.encryption.kms.type field accepts only the value AWS in 4.21, and the spec.encryption.kms.aws stanza configures the key ARN and region. No other KMS backend — Vault, Azure Key Vault, GCP KMS, or PKCS#11 — is a supported, Red Hat-managed integration for OCP etcd KMS encryption as of this writing. The OCP API Server Operator manages the plugin lifecycle, encryption configuration, and key rotation automatically for the AWS KMS path; self-managed clusters requiring a different KMS backend on vanilla Kubernetes can deploy the appropriate plugin as a static pod manually, but this is outside the OCP supported envelope.\nAdditional information # Security model for Vault Kubernetes KMS ","externalUrl":null,"permalink":"/en/security/kmsv2/","section":"Index","summary":"KMS v2 (Kubernetes KMS Provider version 2) is the stable (GA since Kubernetes 1.29, KMS v1 deprecated in 1.28 and disabled by default in 1.29) mechanism for encrypting the contents of the Kubernetes etcd datastore at rest using an external key management service. Without encryption, Kubernetes Secrets stored in etcd are base64-encoded — trivially decodable by anyone with read access to the etcd data files or a snapshot. With KMS v2 enabled, resources written to etcd — Secrets, ConfigMaps, and any other API objects selected by the EncryptionConfiguration — are encrypted before being persisted, using a unique per-object key derived locally. The envelope encryption scheme means those per-object keys are never stored in plaintext: only their encrypted form lives in etcd, and only the external KMS holds the wrapping key. The encryption configuration is declared in a file referenced by the API server’s --encryption-provider-config flag, with kms: apiVersion: v2 selecting the KMS v2 code path, and endpoint: unix:///path/to/plugin.sock pointing at the plugin’s Unix domain socket.\n","title":"KMS v2 (Kubernetes KMS Provider v2)","type":"security"},{"content":"KRITIS (Kritische Infrastrukturen) is Germany\u0026rsquo;s national regulatory framework for the security and resilience of critical infrastructure. It is enforced by the BSI (Bundesamt für Sicherheit in der Informationstechnik — Federal Office for Information Security) and, for physical resilience, by the BBK (Bundesamt für Bevölkerungsschutz und Katastrophenhilfe — Federal Office of Civil Protection). The framework is now governed by two primary laws: the NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG), which rewrote the BSI-Gesetz and entered into force on 6 December 2025, and the KRITIS-Dachgesetz (KRITISDachG) for physical resilience, in force since 17 March 2026. Together they transpose the EU NIS2 Directive and CER Directive into German law. The scope expanded dramatically: from approximately 4,000 regulated entities under the previous IT-Sicherheitsgesetz 2.0 to around 30,000 entities now classified as either \u0026ldquo;besonders wichtige Einrichtungen\u0026rdquo; (particularly important, equivalent to NIS2 essential) or \u0026ldquo;wichtige Einrichtungen\u0026rdquo; (important). KRITIS applies to organizations in 18 sectors (energy, water, health, finance, transport, digital infrastructure, space, public administration, manufacturing, etc.) meeting defined size thresholds. Compliance is mandatory with no transitional period: entities must register with the BSI, implement risk management (§30 BSIG), report security incidents within 24 hours (§32), and management is personally liable (§38) for overseeing cybersecurity measures. Penalties reach up to €10M or 2 % of global turnover for particularly important entities.\nRed Hat is not a KRITIS-obligated entity itself, but German KRITIS operators — energy utilities, hospitals, banks, telecom providers, public administration — run their IT infrastructure on Red Hat software. Red Hat enables KRITIS compliance at the technology layer through several concrete capabilities. For the BSI-Gesetz §30 risk management requirements: RHEL provides system-wide cryptographic policies (including FIPS mode), SELinux mandatory access control, and integration with BSI IT-Grundschutz security modules via OpenSCAP profiles. For incident detection and reporting (§32): Red Hat Advanced Cluster Security (RHACS) delivers continuous runtime monitoring, network policy enforcement, and vulnerability management that compresses detection-to-report timelines. For supply chain security mandated across the entire NIS2 transposition: Red Hat Trusted Software Supply Chain provides signed, attested artifacts with SBOMs — evidence that KRITIS operators can present to auditors demonstrating they assessed their software suppliers\u0026rsquo; security practices. For continuity and resilience under the KRITIS-Dachgesetz: Red Hat\u0026rsquo;s GitOps-based deployment model, Ansible Automation Platform for disaster recovery orchestration, and OpenShift\u0026rsquo;s multi-cluster management enable the operational continuity measures the law demands. The BSI\u0026rsquo;s new Grundschutz++ methodology (OSCAL/JSON-based) also aligns with Red Hat\u0026rsquo;s investment in machine-readable compliance tooling (complyctl, Compliance Operator), potentially automating evidence collection for BSI audits.\nAdditional Information # BSI - KRITIS overview Germany\u0026rsquo;s NIS-2 Implementation and KRITIS Umbrella Law - Jones Day BSI-Gesetz (BSIG) - Full text ","externalUrl":null,"permalink":"/en/compliance/kritis/","section":"Index","summary":"KRITIS (Kritische Infrastrukturen) is Germany’s national regulatory framework for the security and resilience of critical infrastructure. It is enforced by the BSI (Bundesamt für Sicherheit in der Informationstechnik — Federal Office for Information Security) and, for physical resilience, by the BBK (Bundesamt für Bevölkerungsschutz und Katastrophenhilfe — Federal Office of Civil Protection). The framework is now governed by two primary laws: the NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG), which rewrote the BSI-Gesetz and entered into force on 6 December 2025, and the KRITIS-Dachgesetz (KRITISDachG) for physical resilience, in force since 17 March 2026. Together they transpose the EU NIS2 Directive and CER Directive into German law. The scope expanded dramatically: from approximately 4,000 regulated entities under the previous IT-Sicherheitsgesetz 2.0 to around 30,000 entities now classified as either “besonders wichtige Einrichtungen” (particularly important, equivalent to NIS2 essential) or “wichtige Einrichtungen” (important). KRITIS applies to organizations in 18 sectors (energy, water, health, finance, transport, digital infrastructure, space, public administration, manufacturing, etc.) meeting defined size thresholds. Compliance is mandatory with no transitional period: entities must register with the BSI, implement risk management (§30 BSIG), report security incidents within 24 hours (§32), and management is personally liable (§38) for overseeing cybersecurity measures. Penalties reach up to €10M or 2 % of global turnover for particularly important entities.\n","title":"KRITIS (German Critical Infrastructure)","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/kubernetes/","section":"Tags","summary":"","title":"Kubernetes","type":"tags"},{"content":"KubeVirt is a CNCF project that makes Kubernetes a native hypervisor management plane, allowing KVM virtual machines to be declared, scheduled, and operated through the Kubernetes API without a separate virtualisation management layer. The motivating use case is organisational convergence: teams running a mix of legacy VM workloads and modern containerised services no longer need two separate platforms (an OpenStack or vSphere cluster for VMs, a Kubernetes cluster for containers) with separate networking, storage, RBAC, and CI/CD integration. With KubeVirt, both workload types live in the same cluster, share the same kubectl and GitOps tooling, and are subject to the same scheduling, resource quota, and network policy primitives. KubeVirt reached 1.0 in 2023 and is the engine behind Red Hat OpenShift Virtualization, the downstream product used by organisations migrating away from VMware.\nKubeVirt introduces a hierarchy of Custom Resource Definitions and a set of controllers that map the VM lifecycle onto Kubernetes primitives. A VirtualMachine (VM) is the user-facing resource: it holds the VM template spec (CPU, memory, firmware, disks, NICs) and a desired running state, and acts like a Deployment for the VM — it owns a VirtualMachineInstance when running and can restart it if it terminates unexpectedly. A VirtualMachineInstance (VMI) represents a single running VM; it is the unit of scheduling, and once created it is expected to be running — deleting it is equivalent to powering it off. For each VMI, the virt-controller creates a dedicated virt-launcher pod on the scheduled node, inside which QEMU runs sandboxed in a cgroup. On every KVM-capable node, the virt-handler DaemonSet watches for VMIs scheduled to its node, manages their lifecycle by calling libvirt APIs, and keeps the cluster-side VMI object in sync with the actual domain state. Disk images and boot volumes are managed by the Containerised Data Importer (CDI) via DataVolume resources, which import, clone, or upload disk images from HTTP endpoints, container registries, or existing PVCs into PersistentVolumes that the virt-launcher pod mounts as VM disks. Live migration between nodes is supported for VMs whose disks are backed by shared storage with ReadWriteMany access mode, and is the mechanism Kubernetes uses to drain nodes without powering off VMs.\nKubeVirt\u0026rsquo;s confidential computing integration ties it directly into the rest of this glossary. The spec.domain.launchSecurity field in a VMI spec activates TEE-backed isolation: setting sev or snp requests an AMD SEV or SEV-SNP confidential guest; TDX support is in active upstream development. When launchSecurity is set, QEMU passes the appropriate flags to KVM to launch the VM as a confidential guest with hardware-encrypted memory, and the resulting VM has the same attestation capabilities as any other Confidential VM — it can produce a SEV-SNP attestation report or TDX Quote. The integration with Trustee for attestation-gated secret delivery to KubeVirt confidential VMs — attested TLS from inside the guest to the KBS, LUKS unlock keys released only after attestation — is demonstrated in OpenShift Virtualization and represents the convergence point between KubeVirt\u0026rsquo;s VM management plane and the CoCo attestation stack. One important constraint: live migration is disabled for confidential VMs, since the encrypted memory cannot be transferred between hosts without the destination host holding the same TEE key material, which the hardware prevents.\n","externalUrl":null,"permalink":"/en/security/kubevirt/","section":"Index","summary":"KubeVirt is a CNCF project that makes Kubernetes a native hypervisor management plane, allowing KVM virtual machines to be declared, scheduled, and operated through the Kubernetes API without a separate virtualisation management layer. The motivating use case is organisational convergence: teams running a mix of legacy VM workloads and modern containerised services no longer need two separate platforms (an OpenStack or vSphere cluster for VMs, a Kubernetes cluster for containers) with separate networking, storage, RBAC, and CI/CD integration. With KubeVirt, both workload types live in the same cluster, share the same kubectl and GitOps tooling, and are subject to the same scheduling, resource quota, and network policy primitives. KubeVirt reached 1.0 in 2023 and is the engine behind Red Hat OpenShift Virtualization, the downstream product used by organisations migrating away from VMware.\n","title":"KubeVirt","type":"security"},{"content":"The KV cache (key-value cache) is the stored result of the attention layers for tokens already processed in a sequence. During autoregressive decode, each new token only needs a forward pass that depends on prior context; recomputing keys and values for all earlier tokens every step would be wasteful. The cache therefore holds, per layer and per sequence, the K and V tensors produced when those tokens were first seen (during prefill for the prompt, then extended one token at a time during decode). The objective is lower time per output token and lower FLOPs; the cost is GPU memory: cache size grows with batch × layers × heads × sequence_length × head_dim, and is often the limit on concurrent sessions or context length before model weights fill VRAM.\nArchitecturally, the KV cache is why LLM inference is memory-bound on the decode path whereas prefill is often compute-bound. A CPU serving stack without a cache would repeat full-sequence attention for every token—unusable at scale. GPUs hold the cache in HBM next to compute units; layout matters: contiguous buffers fragment when sequences differ in length, which motivated PagedAttention in vLLM (page tables for KV blocks, analogous to OS virtual memory). Prefix caching and KV-aware routing (as in llm-d) reuse blocks across requests that share system prompts or RAG prefixes, so duplicate work is not duplicated on every replica. Disaggregated prefill/decode even transfers KV state between specialized workers over high-speed networks. None of this replaces the model weights; it is ephemeral per session (unless explicitly offloaded to CPU DRAM or disk tiers in advanced setups).\nRed Hat does not implement a proprietary KV cache format; support is through the inference stacks customers run on RHEL and OpenShift AI. vLLM on OpenShift uses PagedAttention and related features in supported serving images; llm-d adds cluster-level policies that route traffic to replicas with warm prefix cache. Red Hat documentation and reference architectures explain sizing GPU memory for context length, batching, and multi-tenant serving, and how platform choices (MIG, time-slicing, network for KV transfer) affect SLOs. Understanding KV cache behavior is prerequisite to capacity planning and to tuning Red Hat–backed inference deployments with NVIDIA or other accelerators.\n","externalUrl":null,"permalink":"/en/ai/kv-cache/","section":"Index","summary":"The KV cache (key-value cache) is the stored result of the attention layers for tokens already processed in a sequence. During autoregressive decode, each new token only needs a forward pass that depends on prior context; recomputing keys and values for all earlier tokens every step would be wasteful. The cache therefore holds, per layer and per sequence, the K and V tensors produced when those tokens were first seen (during prefill for the prompt, then extended one token at a time during decode). The objective is lower time per output token and lower FLOPs; the cost is GPU memory: cache size grows with batch × layers × heads × sequence_length × head_dim, and is often the limit on concurrent sessions or context length before model weights fill VRAM.\n","title":"KV cache (Key-Value Cache)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/kv-cache/","section":"Tags","summary":"","title":"Kv-Cache","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/kvm/","section":"Tags","summary":"","title":"Kvm","type":"tags"},{"content":"KVM (Kernel-based Virtual Machine) and QEMU (Quick Emulator) solve different halves of the same problem and are almost always used together. KVM is a Linux kernel module that turns the kernel into a hypervisor: with Intel VT-x or AMD-V, guest CPUs run on real hardware at near-native speed and guest memory is managed through extended page tables. KVM has no device model of its own — no disk, network, or firmware emulation. QEMU supplies that in userspace (virtio, USB, VGA, ACPI) and controls KVM by issuing ioctl calls on /dev/kvm — creating VMs, mapping memory, running vCPUs via KVM_RUN — while QMP exposes external management over a Unix socket. libvirt, originally from Red Hat, sits above both: it translates domain XML into QEMU command lines and lifecycle operations. The stack is the default on Linux: RHEL ships qemu-kvm, OpenShift Virtualization runs KubeVirt (virt-launcher → libvirt → QEMU), and OpenShift Sandboxed Containers uses Kata Containers with the same hypervisor to isolate pods in micro-VMs.\nThe main security concern is not KVM\u0026rsquo;s kernel module — relatively small — but QEMU\u0026rsquo;s device emulation: large C codebases parsing untrusted guest input, historically a source of VM escapes (e.g. VENOM, CVE-2015-3456). Defence in depth matters: run QEMU as the unprivileged qemu user, prefer virtio over legacy devices, and layer SELinux sVirt (per-VM MCS labels on QEMU and disk images via libvirt), seccomp (syscall and ioctl allowlists on /dev/kvm, vhost, VFIO), and cgroups. KubeVirt adds pod-level isolation; Kata adds a VM boundary so a container escape must cross a guest kernel first. Confidential VMs (SEV-SNP, TDX) go further: guest memory is encrypted so a compromised hypervisor cannot read pod or VM contents in plaintext — the path used by CoCo and Peer Pods on OpenShift.\nRed Hat\u0026rsquo;s supported path remains KVM/QEMU via libvirt, not minimal VMMs like Firecracker (AWS) or Cloud Hypervisor (Kata upstream options with smaller device models). That choice trades a larger emulation surface for the breadth KubeVirt needs (TPM, GPU passthrough, live migration) and what CoCo needs (virtio-fs, vTPM, TEE launch ioctls). Operational hygiene: keep qemu-kvm and libvirt current via RHEL errata, audit domain XML for unnecessary legacy devices, enforce SELinux on RHCOS nodes, and use Trustee attestation where the threat model includes a hostile infrastructure operator. See also TCB, libvirt, Kata Containers, and Confidential VM.\nAdditional Information # Virtualization in RHEL QEMU security documentation libvirt sVirt and SELinux Deploying OpenShift sandboxed containers ","externalUrl":null,"permalink":"/en/security/kvm-qemu/","section":"Index","summary":"KVM (Kernel-based Virtual Machine) and QEMU (Quick Emulator) solve different halves of the same problem and are almost always used together. KVM is a Linux kernel module that turns the kernel into a hypervisor: with Intel VT-x or AMD-V, guest CPUs run on real hardware at near-native speed and guest memory is managed through extended page tables. KVM has no device model of its own — no disk, network, or firmware emulation. QEMU supplies that in userspace (virtio, USB, VGA, ACPI) and controls KVM by issuing ioctl calls on /dev/kvm — creating VMs, mapping memory, running vCPUs via KVM_RUN — while QMP exposes external management over a Unix socket. libvirt, originally from Red Hat, sits above both: it translates domain XML into QEMU command lines and lifecycle operations. The stack is the default on Linux: RHEL ships qemu-kvm, OpenShift Virtualization runs KubeVirt (virt-launcher → libvirt → QEMU), and OpenShift Sandboxed Containers uses Kata Containers with the same hypervisor to isolate pods in micro-VMs.\n","title":"KVM/QEMU","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/latency/","section":"Tags","summary":"","title":"Latency","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/lattice/","section":"Tags","summary":"","title":"Lattice","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/layer2/","section":"Tags","summary":"","title":"Layer2","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/layer3/","section":"Tags","summary":"","title":"Layer3","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ldap/","section":"Tags","summary":"","title":"Ldap","type":"tags"},{"content":"LDAP (Lightweight Directory Access Protocol) is a client-server protocol for accessing and modifying a directory service: a specialised database optimised for read-heavy, hierarchically-organised identity data. It was derived from the X.500 directory standard in the early 1990s, stripping out OSI transport dependencies to run over TCP/IP, and standardised in its current form in RFC 4511 (LDAPv3, 2006). A directory in the LDAP sense is not a general-purpose database — it is a tree of entries (also called objects), each identified by a Distinguished Name (DN) that encodes its position in the hierarchy: cn=alice,ou=users,dc=example,dc=com. Each entry is an instance of one or more object classes (defined in a schema), and each object class defines a set of mandatory and optional attributes — typed, multi-valued fields such as uid, cn (common name), mail, userPassword, memberOf, sshPublicKey, objectClass, and userCertificate. The schema is extensible: LDAP servers ship with standard schema files (RFC 2307 for POSIX users and groups, RFC 4519 for person entries) and organisations add custom schema for application-specific attributes. The tree structure makes hierarchical policy delegation natural — all objects under ou=engineering,dc=example,dc=com can be administered by a different set of ACL rules than objects under ou=ops.\nThe LDAPv3 operation set covers the full directory lifecycle. Bind authenticates the client to the server using one of several mechanisms: simple bind (DN + password in cleartext — should only be used over TLS), SASL bind (pluggable authentication via GSSAPI/Kerberos, PLAIN, SCRAM, EXTERNAL for certificate-based auth), or anonymous bind (read-only access without authentication). Search is the dominant operation: the client specifies a base DN, a scope (base — only the base entry; one — direct children; sub — the entire subtree), a filter expression using a rich boolean syntax ((\u0026amp;(objectClass=posixAccount)(uid=alice)), (|(memberOf=cn=admins,...)(memberOf=cn=ops,...)))), and a list of attributes to return. Modify changes attributes on an existing entry; Add and Delete manage entries; ModifyDN renames or moves entries. All operations can be performed within a StartTLS or LDAPS (LDAP over TLS on port 636) session; LDAPv3 without TLS transmits bind credentials and search results in cleartext and must not be used on untrusted networks. LDAP referrals allow a directory to redirect a client to another server for entries outside its naming context, enabling multi-master and distributed directory deployments.\nIn the Linux infrastructure stack, LDAP is the data store that identity services query, but is rarely exposed directly to applications or users — SSSD provides the caching, reconnection, and NSS/PAM integration layer that translates LDAP directory data into the POSIX identity model (uid, gid, home directory, shell, group membership). Active Directory implements LDAPv3 as its directory protocol alongside Kerberos for authentication — AD\u0026rsquo;s LDAP schema is a superset of RFC 2307 with Microsoft-specific extensions (SIDs, msDS-* attributes, userAccountControl bitmask). FreeIPA (Red Hat Identity Management) provides an LDAP server (389 Directory Server) with a pre-configured schema combining RFC 2307, Kerberos integration, and HBAC/sudo rule storage. OpenLDAP is the dominant open-source standalone LDAP server on Linux, used as the backend for custom identity stores and for LDAP-enabled applications that require a directory without the full AD or FreeIPA stack. X.509 certificates can be stored in LDAP entries (the userCertificate attribute in the pkiUser object class), enabling certificate-based authentication flows where a client presents a certificate and the server validates it against the stored value. PBKDF2 and bcrypt password hashes stored in the userPassword attribute replace cleartext passwords in hardened LDAP deployments; the SSHA (salted SHA-1) scheme is legacy and should be migrated to stronger algorithms. Access Control Lists (ACLs) in OpenLDAP (olcAccess attributes in the cn=config DIT) govern which DNs may read, write, or authenticate which attributes — the most security-sensitive ACL being the restriction of userPassword reads to the entry\u0026rsquo;s own DN only (by self write by * none).\n","externalUrl":null,"permalink":"/en/security/ldap/","section":"Index","summary":"LDAP (Lightweight Directory Access Protocol) is a client-server protocol for accessing and modifying a directory service: a specialised database optimised for read-heavy, hierarchically-organised identity data. It was derived from the X.500 directory standard in the early 1990s, stripping out OSI transport dependencies to run over TCP/IP, and standardised in its current form in RFC 4511 (LDAPv3, 2006). A directory in the LDAP sense is not a general-purpose database — it is a tree of entries (also called objects), each identified by a Distinguished Name (DN) that encodes its position in the hierarchy: cn=alice,ou=users,dc=example,dc=com. Each entry is an instance of one or more object classes (defined in a schema), and each object class defines a set of mandatory and optional attributes — typed, multi-valued fields such as uid, cn (common name), mail, userPassword, memberOf, sshPublicKey, objectClass, and userCertificate. The schema is extensible: LDAP servers ship with standard schema files (RFC 2307 for POSIX users and groups, RFC 4519 for person entries) and organisations add custom schema for application-specific attributes. The tree structure makes hierarchical policy delegation natural — all objects under ou=engineering,dc=example,dc=com can be administered by a different set of ACL rules than objects under ou=ops.\n","title":"LDAP (Lightweight Directory Access Protocol)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/library/","section":"Tags","summary":"","title":"Library","type":"tags"},{"content":"libvirt is an open-source library, daemon, and toolset that provides a unified, stable API for managing virtualisation infrastructure — virtual machines, storage volumes, virtual networks, and host devices — across multiple hypervisor backends. It was originally written by Daniel Berrange at Red Hat and has since become the standard virtualisation management layer on Linux, underpinning KubeVirt, OpenStack Nova, oVirt/RHEV, Proxmox, and the virsh / virt-manager administrative tools. The core value proposition is hypervisor abstraction: the same libvirt API call creates a VM on KVM/QEMU, Xen, LXC, or (historically) VMware ESXi, without the management layer caring about the underlying implementation. In practice, the KVM/QEMU driver is the dominant use case on Linux; the others are progressively less-maintained but remain supported. libvirt communicates with hypervisors through driver-specific mechanisms — with QEMU, it generates the full QEMU command line from the domain XML definition and manages the QEMU process lifecycle, communicating with the running VM through the QEMU Monitor Protocol (QMP) over a Unix socket.\nAll libvirt-managed resources are described in domain XML: a declarative specification of every aspect of a VM — CPU topology (sockets, cores, threads, NUMA topology, CPU pinning), memory (size, hugepages, NUMA binding), boot order and firmware (UEFI or BIOS, Secure Boot, SMM), disk devices (virtio-blk, virtio-scsi, IDE with format qcow2/raw and source as file, block device, or network), network interfaces (virtio-net, bridge, SR-IOV VF, macvtap, VDPA), PCI and USB device passthrough, graphics (VNC, SPICE), video, serial/console, watchdog, RNG, and TPM devices (either passthrough of the host\u0026rsquo;s physical TPM, or an emulated software TPM via swtpm). The XML is the authoritative source of truth; virsh dumpxml \u0026lt;domain\u0026gt; outputs the running domain\u0026rsquo;s effective configuration, and virsh define domain.xml creates a persistent VM from a specification. Storage is managed through storage pools (directories, LVM VGs, NFS mounts, Ceph RBD clusters, iSCSI targets) and storage volumes allocated from them; network connectivity through virtual networks (virsh net-*) that libvirt manages as Linux bridges, VLAN-tagged bridges, macvtap, or OVS bridges, with iptables/nftables rules and dnsmasq instances for NAT networks managed automatically. The daemon architecture in libvirt 6.0+ uses a modular daemon model — separate daemons per driver (virtqemud, virtnetworkd, virtstoraged, virtnodedevd, etc.) instead of the monolithic libvirtd — improving isolation and privilege separation at the cost of a more complex service dependency graph.\nlibvirt\u0026rsquo;s security integration is its most relevant feature in the context of this glossary. The sVirt security model automatically assigns each QEMU process a unique SELinux MCS label pair (system_u:system_r:svirt_t:s0:c\u0026lt;X\u0026gt;,c\u0026lt;Y\u0026gt;) at VM start time, and dynamically relabels all disk images and devices the VM will access to match those categories (system_u:object_r:svirt_image_t:s0:c\u0026lt;X\u0026gt;,c\u0026lt;Y\u0026gt;). The SELinux policy is written so that a QEMU process in one category pair cannot access files labelled with a different category pair — meaning a compromised VM process cannot read another VM\u0026rsquo;s disk image even if it escapes its own namespace and gains access to the host filesystem as the qemu user. On Ubuntu and Debian, the equivalent mechanism uses AppArmor profiles via the virt-aa-helper tool, which generates a per-VM AppArmor profile at startup and loads it dynamically. libvirt also integrates with firewalld over D-Bus to open and close ports for VM network access, with the host TPM (both physical passthrough and swtpm-emulated software TPM for Secure Boot + measured boot in guests), and with UEFI firmware images (OVMF for standard UEFI, OVMF with SEV or TDX configuration for SEV-SNP and TDX confidential VMs). KubeVirt uses libvirt as its hypervisor management layer — the virt-launcher pod runs a libvirtd instance and communicates with it via the libvirt API, making libvirt the execution engine that both conventional KubeVirt VMs and KubeVirt confidential VMs ultimately run through.\n","externalUrl":null,"permalink":"/en/security/libvirt/","section":"Index","summary":"libvirt is an open-source library, daemon, and toolset that provides a unified, stable API for managing virtualisation infrastructure — virtual machines, storage volumes, virtual networks, and host devices — across multiple hypervisor backends. It was originally written by Daniel Berrange at Red Hat and has since become the standard virtualisation management layer on Linux, underpinning KubeVirt, OpenStack Nova, oVirt/RHEV, Proxmox, and the virsh / virt-manager administrative tools. The core value proposition is hypervisor abstraction: the same libvirt API call creates a VM on KVM/QEMU, Xen, LXC, or (historically) VMware ESXi, without the management layer caring about the underlying implementation. In practice, the KVM/QEMU driver is the dominant use case on Linux; the others are progressively less-maintained but remain supported. libvirt communicates with hypervisors through driver-specific mechanisms — with QEMU, it generates the full QEMU command line from the domain XML definition and manages the QEMU process lifecycle, communicating with the running VM through the QEMU Monitor Protocol (QMP) over a Unix socket.\n","title":"libvirt","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/libvirt/","section":"Tags","summary":"","title":"Libvirt","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/linux/","section":"Tags","summary":"","title":"Linux","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/linux-foundation/","section":"Tags","summary":"","title":"Linux-Foundation","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/llm/","section":"Tags","summary":"","title":"Llm","type":"tags"},{"content":"An LLM (large language model) is a deep neural network—almost always a Transformer—trained on large amounts of text (and sometimes multimodal data) to model the probability of the next token given prior context. Its objective at training time is to minimize prediction error over billions of tokens, producing weights that encode grammar, facts (with limitations), reasoning patterns, and task-following behavior after alignment or instruction tuning. At inference time the same model generates completions, answers questions, summarizes documents, or drives agents; production systems expose it through APIs (often OpenAI-compatible) backed by engines such as vLLM or NIM. LLMs power chatbots, code assistants, RAG pipelines, and enterprise copilots.\nArchitecturally, an LLM is not run like a typical CPU application: forward passes are dominated by matrix multiplication and attention, with memory footprint driven by model size (billions of parameters) and per-session KV cache during decode. A 7B–70B+ parameter model does not fit in host DRAM for fast serving; weights and cache live on GPU HBM, often sharded with tensor parallelism across devices linked by NVLink or NCCL over InfiniBand/RoCE. The CPU handles tokenization, request batching, networking, and orchestration. Context length (prompt + output tokens) directly affects latency and VRAM; techniques such as quantization, LoRA adapters, and prefix caching exist to reduce cost and improve throughput without retraining from scratch.\nRed Hat positions LLMs as workloads on RHEL AI (curated models, InstructLab, local experimentation) and Red Hat OpenShift AI (multi-tenant serving, MLOps, integration with NVIDIA NIM and open vLLM). Documentation covers GPU node sizing, security (routes, SCCs, secrets for API keys), and hybrid patterns where training or fine-tuning happens on-cluster and inference runs behind gateways or llm-d for cache-aware routing. The platform story is Linux + Kubernetes + supported accelerators, not a proprietary model family—customers bring Hugging Face or vendor weights and operate them like any other stateful service.\n","externalUrl":null,"permalink":"/en/ai/llm/","section":"Index","summary":"An LLM (large language model) is a deep neural network—almost always a Transformer—trained on large amounts of text (and sometimes multimodal data) to model the probability of the next token given prior context. Its objective at training time is to minimize prediction error over billions of tokens, producing weights that encode grammar, facts (with limitations), reasoning patterns, and task-following behavior after alignment or instruction tuning. At inference time the same model generates completions, answers questions, summarizes documents, or drives agents; production systems expose it through APIs (often OpenAI-compatible) backed by engines such as vLLM or NIM. LLMs power chatbots, code assistants, RAG pipelines, and enterprise copilots.\n","title":"LLM (Large Language Model)","type":"ai"},{"content":"llm-d is an open-source distributed inference serving stack for production LLM workloads on Kubernetes. Its objective is not to replace model servers such as vLLM or SGLang but to sit above them and fix cluster-scale problems: which replica should receive the next request, how to split prefill (compute-heavy) from decode (memory-bandwidth-heavy), how to share or tier KV cache state, and how to scale MoE models with wide expert parallelism. llm-d publishes “well-lit path” guides—benchmarked Helm recipes and architectures—so teams reach strong time-to-first-token and throughput without hand-rolling schedulers. The project is a CNCF sandbox effort with contributors including Red Hat, IBM, Google, and cloud partners.\nCompared with a single vLLM pod behind a naive round-robin load balancer, llm-d’s control plane is inference-aware. An Inference Scheduler (built on the Kubernetes Gateway API inference extension and compatible gateways) scores replicas using telemetry: prefix/KV overlap, load, optional latency prediction, and prefill/decode (P/D) topology. That is fundamentally different from generic L7 routing, which treats every pod as interchangeable. Disaggregated serving runs prefill workers and decode workers as separate pools, moving KV tensors between them (e.g. via NIXL over RDMA) so each phase uses the right GPU profile. A CPU-only cluster cannot run llm-d’s value proposition; the stack assumes accelerators under the model server and Kubernetes for placement, autoscaling, and networking.\nRed Hat is a core contributor and positions llm-d as the path to scale OpenShift AI inference beyond single-replica vLLM. Documentation and blog material describe deploying llm-d on OpenShift with RHEL on GPU nodes, Gateway API–based routing, and integration with Red Hat’s AI portfolio. Because llm-d standardizes on Kubernetes primitives (Helm, CRDs, gateway policies), it aligns with how Red Hat customers already operate platforms: the same RBAC, GitOps, and multi-tenancy models apply. Teams start from upstream quickstarts at llm-d.ai and harden on OpenShift using Red Hat-supported Kubernetes, networking (including SR-IOV/RDMA where needed), and joint reference designs with hardware partners.\nAdditional Information # What is llm-d ? From tokens to caches: How llm-d improves LLM observability in Red Hat OpenShift AI 3.0 (Oct 22, 2025) How llm-d brings critical resource optimization with SoftBank’s AI-RAN orchestrator ? (Feb 18, 2026) ","externalUrl":null,"permalink":"/en/ai/llm-d/","section":"Index","summary":"llm-d is an open-source distributed inference serving stack for production LLM workloads on Kubernetes. Its objective is not to replace model servers such as vLLM or SGLang but to sit above them and fix cluster-scale problems: which replica should receive the next request, how to split prefill (compute-heavy) from decode (memory-bandwidth-heavy), how to share or tier KV cache state, and how to scale MoE models with wide expert parallelism. llm-d publishes “well-lit path” guides—benchmarked Helm recipes and architectures—so teams reach strong time-to-first-token and throughput without hand-rolling schedulers. The project is a CNCF sandbox effort with contributors including Red Hat, IBM, Google, and cloud partners.\n","title":"llm-d","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/llm-d/","section":"Tags","summary":"","title":"Llm-D","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/local-spectrum/","section":"Tags","summary":"","title":"Local-Spectrum","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/logging/","section":"Tags","summary":"","title":"Logging","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/lora/","section":"Tags","summary":"","title":"Lora","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/lsm/","section":"Tags","summary":"","title":"Lsm","type":"tags"},{"content":"Linux Security Modules (LSM) is a hook-based framework integrated into the Linux kernel since 2.6 (2003) that provides a general mechanism for implementing Mandatory Access Control (MAC) without modifying the core kernel. Its origin is the NSA\u0026rsquo;s presentation of SELinux at the 2001 Linux Kernel Summit: Linus Torvalds accepted the need for flexible access control but refused to hardcode a single security model, directing instead the development of a framework into which any security model could be plugged. The result is LSM: a set of strategically placed hook functions throughout the kernel\u0026rsquo;s execution paths — over 240 hooks in recent kernels — at points where security-relevant decisions occur: file open, process creation, capability checks, socket operations, IPC access, memory mapping, and more. Each hook is a call into the currently active security module(s), which examine the operation\u0026rsquo;s context and return allow or deny. The core kernel enforces whatever the security module decides.\nLSM separates modules into two categories. Major LSMs implement a full MAC policy and have exclusive access to the kernel\u0026rsquo;s per-object security blobs — the opaque storage attached to inodes, tasks, credentials, and sockets where the security module stores its labels and policy state. Only one major LSM can be the primary module at boot (selected via the security= kernel parameter or compile-time default), though the stacking architecture introduced in kernel 4.x allows multiple major modules to coexist under specific conditions. The accepted major modules in the upstream kernel are SELinux, AppArmor, Smack, and TOMOYO. Minor LSMs implement narrower, non-policy security features and stack freely: Yama (restricts ptrace scope), Lockdown (controls kernel integrity under Secure Boot), LoadPin (restricts the origins from which the kernel loads modules and firmware), and SafeSetID (constrains setuid/setgid transitions). BPF LSM (kernel 5.7) is a stackable minor module that allows eBPF programs to attach to LSM hooks at runtime, implementing custom access control logic without loading a kernel module or configuring a major LSM — enabling programmatic, per-workload policy without the compile-time commitment to SELinux or AppArmor. LSM hooks are always evaluated after standard Linux Discretionary Access Control (DAC) — file permission bits and ACLs — so an LSM module can only further restrict what DAC has already permitted; it cannot grant access that DAC denies.\nFrom an operational perspective, LSM is the reason that SELinux and AppArmor are mutually exclusive on a given system without kernel recompilation — both are major LSMs competing for the same hook slot. Distribution defaults encode this choice: RHEL, Fedora, and CentOS use SELinux; Ubuntu and Debian use AppArmor. Container runtimes interact with LSM directly: containerd and CRI-O apply AppArmor profiles and SELinux labels to containers via the OCI runtime spec\u0026rsquo;s linux.appArmorProfile and linux.seccomp fields, and the PSA Restricted profile mandates that a seccomp profile is set, which in turn passes through the kernel\u0026rsquo;s seccomp(2) syscall — a separate mechanism from LSM hooks but complementary to them. In confidential computing environments, LSM policies on the host remain relevant for KubeVirt and Kata Containers workloads: the host\u0026rsquo;s LSM confines the QEMU/virt-launcher process itself, providing a containment layer outside the VM boundary that bounds the damage from a QEMU vulnerability.\n","externalUrl":null,"permalink":"/en/security/lsm/","section":"Index","summary":"Linux Security Modules (LSM) is a hook-based framework integrated into the Linux kernel since 2.6 (2003) that provides a general mechanism for implementing Mandatory Access Control (MAC) without modifying the core kernel. Its origin is the NSA’s presentation of SELinux at the 2001 Linux Kernel Summit: Linus Torvalds accepted the need for flexible access control but refused to hardcode a single security model, directing instead the development of a framework into which any security model could be plugged. The result is LSM: a set of strategically placed hook functions throughout the kernel’s execution paths — over 240 hooks in recent kernels — at points where security-relevant decisions occur: file open, process creation, capability checks, socket operations, IPC access, memory mapping, and more. Each hook is a call into the currently active security module(s), which examine the operation’s context and return allow or deny. The core kernel enforces whatever the security module decides.\n","title":"LSM (Linux Security Module)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/luks/","section":"Tags","summary":"","title":"Luks","type":"tags"},{"content":"LUKS (Linux Unified Key Setup) is the standard specification for block device encryption on Linux, created by Clemens Fruhwirth in 2004. It sits above the kernel\u0026rsquo;s dm-crypt subsystem — which performs the actual AES sector-by-sector encryption via the device mapper — and adds a structured, on-disk header that decouples key management from the encryption itself. Any block device can be a LUKS container: a partition, a logical volume, a loop device; anything that sits beneath it (filesystem, swap, LVM) is encrypted transparently, with no changes required to the software using it. The managed cryptsetup tool and the libcryptsetup library provide userspace access to LUKS volumes, and are the canonical interface for all operations on them.\nThe architectural centrepiece of LUKS is its volume key (also called the master key): a randomly generated key that directly encrypts the block device data and never changes for the lifetime of the volume. What LUKS stores in its header are not the volume key itself but the volume key encrypted by each active unlock credential, one per keyslot. LUKS1 supports 8 keyslots; LUKS2 (the current format, required by most modern tooling) supports 32. This design means multiple independent passphrases or tokens can unlock the same volume, and revoking one — by wiping its keyslot — does not require re-encrypting the device. Losing the header, however, makes the volume permanently unrecoverable, since no other path to the volume key exists.\nLUKS2 introduced a token mechanism that embeds metadata in the header to describe how a keyslot can be unlocked by means other than a passphrase. systemd-cryptenroll uses this to enroll TPM2 chips, FIDO2 hardware tokens, and recovery keys as first-class unlock methods alongside or instead of passphrases. TPM2 enrollment seals the volume key against a set of PCR values — by default PCR 7 (Secure Boot state) — so the disk unlocks automatically at boot only if the system\u0026rsquo;s measured boot state matches what was present at enrollment time; any change to the firmware, bootloader, or Secure Boot configuration breaks the seal and falls back to requiring a passphrase. This is the mechanism that ties LUKS disk encryption into the broader measured boot stack: TPM PCR binding, UKI-based boot, and Secure Boot enforcement together form a chain in which LUKS-encrypted root filesystems unlock automatically on a verified boot and require manual intervention on anything else. The alternative network-based approach — Clevis with a Tang server — releases the unlock key from a remote server only when the client can prove it is on a trusted network, providing a complementary model without requiring a local TPM.\n","externalUrl":null,"permalink":"/en/security/luks/","section":"Index","summary":"LUKS (Linux Unified Key Setup) is the standard specification for block device encryption on Linux, created by Clemens Fruhwirth in 2004. It sits above the kernel’s dm-crypt subsystem — which performs the actual AES sector-by-sector encryption via the device mapper — and adds a structured, on-disk header that decouples key management from the encryption itself. Any block device can be a LUKS container: a partition, a logical volume, a loop device; anything that sits beneath it (filesystem, swap, LVM) is encrypted transparently, with no changes required to the software using it. The managed cryptsetup tool and the libcryptsetup library provide userspace access to LUKS volumes, and are the canonical interface for all operations on them.\n","title":"LUKS (Linux Unified Key Setup)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/mac/","section":"Tags","summary":"","title":"Mac","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/machine-learning/","section":"Tags","summary":"","title":"Machine-Learning","type":"tags"},{"content":"MACsec (MAC Security, IEEE 802.1AE) is an IEEE standard, first published in 2006 and supported in the Linux kernel since 4.6 (2016), that encrypts and authenticates Ethernet frames at layer 2 — hop by hop between directly connected devices. Its operating layer is what distinguishes it from IPsec (layer 3) and TLS (layer 4): MACsec wraps Ethernet frames, not IP packets or TCP streams, so it can protect every byte that traverses a link segment regardless of what protocol it carries. ARP replies, DHCP offers, LLDP frames, routing protocol adjacencies, and layer-2 broadcast traffic are all encrypted and authenticated alongside application data — something neither IPsec nor TLS can accomplish because both require an IP header to already be present and unenforced. The topology implication of this is that MACsec is link-local and hop-by-hop: it encrypts between two directly adjacent Ethernet peers (a host and a switch, or two switches), decrypts at each hop for forwarding decisions, and re-encrypts toward the next hop. It cannot stretch across a routed boundary; for that, IPsec is the right tool.\nMACsec achieves encryption by inserting a SecTAG (Security Tag) header between the Ethernet source address and the EtherType field of a standard Ethernet frame, and appending an ICV (Integrity Check Value) trailer. The SecTAG carries the SCI (Secure Channel Identifier, derived from the sender\u0026rsquo;s MAC address and a port ID), the association number identifying the active Secure Association, and a packet number for replay protection. The payload between the SecTAG and ICV is encrypted with AES-GCM-128 (or AES-GCM-256 per the 802.1AEbn amendment), and the ICV cryptographically binds the cleartext Ethernet header, SecTAG, and encrypted payload together — ensuring that neither the addressing information nor the encrypted content can be tampered with without detection. There is no encrypt-only mode: integrity and origin authentication are fundamental to the design. The overhead is a fixed 32 bytes per frame (16-byte SecTAG + 16-byte ICV), so on a standard 1500-byte MTU link the effective payload is 1468 bytes; jumbo frames are strongly recommended for MACsec deployments carrying VXLAN or other encapsulated overlay traffic. Key management is out of scope for 802.1AE itself and is handled by MKA (MACsec Key Agreement, IEEE 802.1X-2010), which establishes Connectivity Associations, derives Secure Association Keys using a two-message exchange, and periodically rotates them. On Linux, MKA is implemented in wpa_supplicant; keys can also be provisioned statically via ip macsec for point-to-point links.\nMACsec fits into the network security stack as the encryption layer that closes the gap neither IPsec nor TLS addresses: unencrypted layer-2 control plane traffic and the physical link between a host and its first-hop switch. Its primary deployment contexts are: data centre switch-to-switch links, where it protects east-west traffic on bare-metal Ethernet segments between top-of-rack switches without the CPU overhead of IPsec; host-to-switch access ports, where it provides mutual authentication and encryption before the host is granted network access, typically combined with 802.1X port authentication (the 802.1X EAP session derives the Connectivity Association Key that seeds MKA, giving the two protocols a natural integration); and WAN handoff links, where carrier Ethernet circuits — MPLS hand-offs, metro Ethernet — are encrypted at the Ethernet layer without requiring IPsec concentrators. In Linux virtual network contexts, MACsec can be applied over VXLAN tunnels between hypervisors, encrypting the overlay traffic at the virtual Ethernet level inside the VM rather than relying on the hypervisor\u0026rsquo;s infrastructure-level encryption — giving tenants cryptographic control over their own traffic independent of the cloud operator. The PQC transition will affect MACsec at the MKA/EAP layer, since the Connectivity Association Key derivation depends on the EAP method\u0026rsquo;s key material; EAP-TLS with PQC certificates propagates quantum-safe keys into MKA automatically once the TLS and PKI stack is migrated.\n","externalUrl":null,"permalink":"/en/security/macsec/","section":"Index","summary":"MACsec (MAC Security, IEEE 802.1AE) is an IEEE standard, first published in 2006 and supported in the Linux kernel since 4.6 (2016), that encrypts and authenticates Ethernet frames at layer 2 — hop by hop between directly connected devices. Its operating layer is what distinguishes it from IPsec (layer 3) and TLS (layer 4): MACsec wraps Ethernet frames, not IP packets or TCP streams, so it can protect every byte that traverses a link segment regardless of what protocol it carries. ARP replies, DHCP offers, LLDP frames, routing protocol adjacencies, and layer-2 broadcast traffic are all encrypted and authenticated alongside application data — something neither IPsec nor TLS can accomplish because both require an IP header to already be present and unenforced. The topology implication of this is that MACsec is link-local and hop-by-hop: it encrypts between two directly adjacent Ethernet peers (a host and a switch, or two switches), decrypts at each hop for forwarding decisions, and re-encrypts toward the next hop. It cannot stretch across a routed boundary; for that, IPsec is the right tool.\n","title":"MACsec (IEEE 802.1AE)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/mcp/","section":"Tags","summary":"","title":"Mcp","type":"tags"},{"content":"MCP (Model Context Protocol) is an open standard for how LLM applications discover and invoke tools, read structured resources, and exchange prompts with external systems through MCP servers and clients. The objective is interchangeable integrations: instead of every chat product implementing bespoke plugins for Git, databases, or ticketing, a tool provider ships an MCP server and any compatible client (IDE, assistant, agent runtime) can use it with consistent auth and capability negotiation. MCP complements HTTP inference APIs—it sits at the orchestration layer where the model decides which tool to call, not inside vLLM’s token loop. It is widely associated with agentic workflows (multi-step plans, code execution, retrieval).\nArchitecturally, MCP is control-plane and I/O heavy relative to GPU matmuls. The CPU runs the host application, MCP client library, and often local or remote MCP servers (stdio, SSE, or streamable HTTP transports). The LLM still runs on GPU via vLLM, cloud API, or NIM; MCP messages carry tool definitions, arguments, and results back into the prompt context. That increases prefill size and token cost versus single-shot chat. Security matters: tools equate to arbitrary code or data access, so enterprises pair MCP with policy, sandboxing, and identity—similar concerns to RAG connectors. MCP does not replace Kubernetes scheduling; it standardizes application wiring above the platform.\nRed Hat discusses MCP in the context of AI agents on OpenShift and RHEL AI—connecting models to cluster APIs, observability, and developer workflows without locking to one vendor IDE. Blog and documentation themes include operationalizing agents with the same Linux, OpenShift security (SCCs, routes, secrets), and Guardrails-style safety layers used for raw LLM serving. Red Hat does not own the protocol (Anthropic-originated, community ecosystem); the platform value is running MCP servers and inference backends on a supported, auditable stack customers already operate.\n","externalUrl":null,"permalink":"/en/ai/mcp/","section":"Index","summary":"MCP (Model Context Protocol) is an open standard for how LLM applications discover and invoke tools, read structured resources, and exchange prompts with external systems through MCP servers and clients. The objective is interchangeable integrations: instead of every chat product implementing bespoke plugins for Git, databases, or ticketing, a tool provider ships an MCP server and any compatible client (IDE, assistant, agent runtime) can use it with consistent auth and capability negotiation. MCP complements HTTP inference APIs—it sits at the orchestration layer where the model decides which tool to call, not inside vLLM’s token loop. It is widely associated with agentic workflows (multi-step plans, code execution, retrieval).\n","title":"MCP (Model Context Protocol)","type":"ai"},{"content":"Measured Boot is a boot process architecture in which each component in the boot chain — firmware, bootloader, kernel, initrd, kernel command line — is cryptographically hashed and that hash is recorded into a TPM Platform Configuration Register (PCR) before the component executes. The critical distinction from Secure Boot is in what each mechanism provides: Secure Boot is an enforcement mechanism that prevents unauthorised components from running at all; Measured Boot is a recording mechanism that creates a tamper-evident log of exactly what did run, without necessarily preventing anything. The two are complementary and typically deployed together — Secure Boot enforces a policy at boot time, Measured Boot produces the evidence that the policy was enforced as claimed. A system can have Measured Boot without Secure Boot (it records everything that ran, even unsigned components), but Secure Boot without Measured Boot provides enforcement with no attestable evidence of what was enforced.\nThe measurement process follows a strict extend semantics: a PCR cannot be written to directly; it can only be updated by PCR_Extend(new_value) → PCR := SHA-256(PCR ∥ new_value). Because the PCR\u0026rsquo;s initial value is all-zeros at boot and each extend operation hashes the current PCR value together with the new measurement, the final PCR value is a hash chain over the entire sequence of measurements in order — it is impossible to produce the same final PCR value by measuring different components or in a different order, even if each individual measurement is valid. This chain property means a PCR value is a commitment to a specific, ordered boot history. The standard Linux measured boot PCR allocation (defined in the UAPI Linux TPM PCR Registry) distributes measurements across registers by category: PCR 0 records the UEFI Core firmware (the BIOS/UEFI code itself); PCR 1 records the UEFI firmware configuration (NVRAM variables); PCR 2 records third-party UEFI drivers and option ROMs; PCR 3 records UEFI firmware application configuration; PCR 4 records the bootloader (GRUB or the UKI\u0026rsquo;s EFI stub); PCR 5 records the GPT partition table; PCR 6 records platform manufacturer-specific events; PCR 7 records Secure Boot policy state (the PK, KEK, db, and dbx contents that were active); PCR 8 receives the GRUB command line and config file hashes (if GRUB\u0026rsquo;s TPM module is loaded); PCR 9 receives the kernel image and initrd hashes as loaded by GRUB; PCR 11 is measured by systemd-stub in UKI boots, covering all UKI components (kernel, initrd, kernel command line, splash, credentials); PCR 12 covers the kernel command line and system credentials; PCR 13 covers initrd extension images; and PCR 15 is used for runtime identity measurements including the machine ID and filesystem UUIDs.\nThe utility of measured boot is realised through attestation and secret sealing. Remote attestation (via Keylime, Trustee, or a cloud attestation service) uses the TPM\u0026rsquo;s TPM2_Quote command to produce a signed statement over the current PCR values, bound to a fresh nonce from the verifier to prevent replay. A relying party that holds the TPM\u0026rsquo;s endorsement key certificate (rooted in the TPM manufacturer\u0026rsquo;s CA) can verify the quote\u0026rsquo;s signature, confirm the nonce freshness, and compare the PCR values against a known-good reference set — if they match, the platform is running exactly the software stack that produces those measurements. PCR sealing (used by LUKS via systemd-cryptenroll) encrypts a secret (a disk encryption key, a credential, a token) against specific PCR values using the TPM\u0026rsquo;s TPM2_PolicyPCR mechanism; the TPM will only release the secret if the current PCR state matches the policy at seal time, automatically unlocking LUKS volumes on a verified boot and requiring manual passphrase entry on any other. UKI-based measured boot significantly simplifies this: because a UKI bundles the kernel, initrd, and command line into a single signed binary, the PCR 11 measurement of the entire UKI is stable and predictable — changing any component produces a new, different measurement. This contrasts with GRUB-based measured boot, where the PCR 8 and 9 values depend on the assembled-at-runtime configuration, making pre-calculation of expected values after updates significantly harder. Measured Boot is the foundational prerequisite for the full attestation stack: without it, a TPM can prove its own identity but cannot prove what software is running on the platform it is embedded in; with it, the TPM becomes the hardware anchor for the entire boot chain\u0026rsquo;s integrity.\n","externalUrl":null,"permalink":"/en/security/measured-boot/","section":"Index","summary":"Measured Boot is a boot process architecture in which each component in the boot chain — firmware, bootloader, kernel, initrd, kernel command line — is cryptographically hashed and that hash is recorded into a TPM Platform Configuration Register (PCR) before the component executes. The critical distinction from Secure Boot is in what each mechanism provides: Secure Boot is an enforcement mechanism that prevents unauthorised components from running at all; Measured Boot is a recording mechanism that creates a tamper-evident log of exactly what did run, without necessarily preventing anything. The two are complementary and typically deployed together — Secure Boot enforces a policy at boot time, Measured Boot produces the evidence that the policy was enforced as claimed. A system can have Measured Boot without Secure Boot (it records everything that ran, even unsigned components), but Secure Boot without Measured Boot provides enforcement with no attestable evidence of what was enforced.\n","title":"Measured Boot","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/mec/","section":"Tags","summary":"","title":"Mec","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/memory/","section":"Tags","summary":"","title":"Memory","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/mfa/","section":"Tags","summary":"","title":"Mfa","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/microservices/","section":"Tags","summary":"","title":"Microservices","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/microsoft/","section":"Tags","summary":"","title":"Microsoft","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/mig/","section":"Tags","summary":"","title":"Mig","type":"tags"},{"content":"MIG (Multi-Instance GPU) is an NVIDIA GPU partitioning mode on datacenter accelerators (e.g. A100, H100) that splits one physical card into up to seven GPU instances (GIs), each with isolated streaming multiprocessors, memory bandwidth, and HBM capacity. The objective is higher utilization in multi-tenant environments: several smaller models or dev/test workloads share one expensive GPU without time-slicing contention as severe as full-card sharing. Each MIG instance appears to the OS and CUDA as a separate GPU with fixed resources; workloads cannot oversubscribe another instance’s memory. MIG suits inference and modest training more often than massive single-job training that needs the entire GPU and NVLink domain.\nArchitecturally, MIG is a hardware partition, not a CPU hypervisor: the host still runs Linux and Kubernetes, but the NVIDIA driver exposes multiple minor devices. Kubernetes schedules pods with nvidia.com/mig-1g.5gb-style extended resources via the GPU Operator and device plugin. Compared with whole-GPU assignment, MIG caps per-tenant VRAM and compute—large LLMs may not fit a small profile. Compared with time-slicing, MIG provides stronger isolation and predictable performance. MIG does not replace tensor parallelism across cards; it partitions within one card. NCCL groups are typically scoped per instance, not across MIG slices on the same GPU for multi-GPU jobs.\nRed Hat supports MIG on RHEL and OpenShift through documented NVIDIA driver and GPU Operator flows: enabling MIG profiles on nodes, labeling profiles in OpenShift AI, and sizing vLLM/NIM deployments per instance memory. Reference architectures describe multi-tenant inference namespaces where each tenant receives a MIG slice rather than a full H100. Operators must plan profiles at node provisioning time (reboot may be required to change geometry) and align KV cache / model size with the instance’s fixed HBM quota.\n","externalUrl":null,"permalink":"/en/ai/mig/","section":"Index","summary":"MIG (Multi-Instance GPU) is an NVIDIA GPU partitioning mode on datacenter accelerators (e.g. A100, H100) that splits one physical card into up to seven GPU instances (GIs), each with isolated streaming multiprocessors, memory bandwidth, and HBM capacity. The objective is higher utilization in multi-tenant environments: several smaller models or dev/test workloads share one expensive GPU without time-slicing contention as severe as full-card sharing. Each MIG instance appears to the OS and CUDA as a separate GPU with fixed resources; workloads cannot oversubscribe another instance’s memory. MIG suits inference and modest training more often than massive single-job training that needs the entire GPU and NVLink domain.\n","title":"MIG (Multi-Instance GPU)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/ml/","section":"Tags","summary":"","title":"Ml","type":"tags"},{"content":"ML-DSA (Module-Lattice-Based Digital Signature Algorithm), standardised as NIST FIPS 204 in August 2024, is the primary post-quantum replacement for digital signatures. It replaces ECDSA, EdDSA, and RSA PSS/PKCS#1 signatures in X.509 certificates, code signing, TLS client and server authentication, SSH, JWT signing, and any other context where a party proves possession of a private key by producing a signature that others verify with the public key. ML-DSA is derived from CRYSTALS-Dilithium, the submission that won NIST\u0026rsquo;s lattice-based signature selection, and its security rests on the Module Learning With Errors (MLWE) and Module Short Integer Solution (MSIS) problems — the same mathematical family as ML-KEM, which is significant because both algorithms can share implementation code and hardware acceleration for the underlying polynomial arithmetic (NTT, number-theoretic transform).\nML-DSA defines three parameter sets. ML-DSA-44 targets NIST security level 2 (between AES-128 and AES-192) with a 1312-byte public key, 2420-byte signature, and 2560-byte private key. ML-DSA-65 targets level 3 (roughly AES-192) with a 1952-byte public key, 3309-byte signature, and 4032-byte private key — the recommended general-purpose parameter set. ML-DSA-87 targets level 5 (roughly AES-256) with a 2592-byte public key, 4627-byte signature, and 4896-byte private key, required by CNSA 2.0 for national security systems. All three parameter sets produce deterministic signatures: like RFC 6979 ECDSA or EdDSA, the nonce is derived from the private key and message, eliminating the catastrophic private-key-recovery vulnerability that affects naively randomised ECDSA implementations. Signature generation in ML-DSA is rejection-sampled — the algorithm internally loops until it produces a signature that meets a norm bound — which means signing time is variable (typically 2–5 iterations in practice) rather than strictly constant, a mild complication for timing-sensitive implementations.\nThe dominant deployment challenge for ML-DSA is signature and public key size. An ML-DSA-65 signature at 3309 bytes is 50× larger than a P-256 ECDSA signature (64 bytes) and 13× larger than a 2048-bit RSA signature (256 bytes). In X.509 certificate chains carried in TLS handshakes, every certificate in the chain (leaf, intermediate, root) bears a signature from its issuer; a three-certificate chain with ML-DSA-65 signatures adds roughly 10 KB of signature data to the TLS Certificate message, compared to roughly 200 bytes for ECDSA. This is large enough to require multiple TLS records and TCP segments, affecting handshake latency and middle-box compatibility. The PKI and cert-manager migration path is to deploy a parallel ML-DSA CA hierarchy — ML-DSA-65 root CA, ML-DSA-65 intermediate, ML-DSA-65 leaf certificates — and serve it alongside the existing ECDSA hierarchy in hybrid mode during the transition, allowing clients that support ML-DSA to verify the post-quantum chain while legacy clients fall back to the ECDSA chain. During the hybrid period, code-signing pipelines should produce both an ECDSA and an ML-DSA signature over the same artifact; verifiers that understand both check the ML-DSA signature for quantum protection, while legacy verifiers check the ECDSA signature. For SBOM and OCI artifact signing via cosign, ML-DSA support follows when the underlying Sigstore libraries and the sigstore/sigstore-go SDK add FIPS 204 support.\n","externalUrl":null,"permalink":"/en/security/ml-dsa/","section":"Index","summary":"ML-DSA (Module-Lattice-Based Digital Signature Algorithm), standardised as NIST FIPS 204 in August 2024, is the primary post-quantum replacement for digital signatures. It replaces ECDSA, EdDSA, and RSA PSS/PKCS#1 signatures in X.509 certificates, code signing, TLS client and server authentication, SSH, JWT signing, and any other context where a party proves possession of a private key by producing a signature that others verify with the public key. ML-DSA is derived from CRYSTALS-Dilithium, the submission that won NIST’s lattice-based signature selection, and its security rests on the Module Learning With Errors (MLWE) and Module Short Integer Solution (MSIS) problems — the same mathematical family as ML-KEM, which is significant because both algorithms can share implementation code and hardware acceleration for the underlying polynomial arithmetic (NTT, number-theoretic transform).\n","title":"ML-DSA (Module-Lattice-Based Digital Signature Algorithm)","type":"security"},{"content":"ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism), standardised as NIST FIPS 203 in August 2024, is the primary post-quantum replacement for key encapsulation and key exchange. It replaces the role of ECDH (X25519, P-256) and RSA key transport in TLS handshakes, IPsec IKEv2 negotiations, and any other protocol that needs two parties to establish a shared secret without prior key material. ML-KEM is derived from CRYSTALS-Kyber, the submission that won NIST\u0026rsquo;s lattice-based KEM selection, and its security rests on the Module Learning With Errors (MLWE) problem: distinguishing a structured noisy linear system from a random one is computationally hard, and no efficient quantum algorithm for this problem is known. The \u0026ldquo;module\u0026rdquo; qualifier means the construction uses polynomial rings structured in a way that allows a good balance between security and efficiency, contrasting with pure LWE (larger keys, simpler structure) and NTRU (smaller keys, different structure).\nML-KEM defines three parameter sets with different security levels. ML-KEM-512 targets NIST security level 1 (roughly equivalent to AES-128 against classical attacks) with a 800-byte public key, 768-byte ciphertext, and 1632-byte private key. ML-KEM-768 targets level 3 (roughly AES-192) with a 1184-byte public key, 1088-byte ciphertext, and 2400-byte private key — this is the parameter set recommended for general use and the one deployed in the Chrome / OpenSSL hybrid. ML-KEM-1024 targets level 5 (roughly AES-256) with a 1568-byte public key, 1568-byte ciphertext, and 3168-byte private key. All three share the same 32-byte shared secret output and the same encapsulation/decapsulation API. The algorithm is a KEM, not a Diffie-Hellman exchange: the sender generates a random shared secret, encapsulates it under the recipient\u0026rsquo;s public key to produce a ciphertext, and the recipient decapsulates the ciphertext with their private key to recover the shared secret. There is no interactive exchange of key shares; the ciphertext is a one-way transmission.\nThe most important operational fact about ML-KEM is that it is already in production. The hybrid key exchange X25519MLKEM768 (combining a classical X25519 share with an ML-KEM-768 share, XOR-ing the two outputs) has been the default in Chrome since version 131 (late 2024) and is available in OpenSSL 3.4+ and BoringSSL. The hybrid approach is the recommended migration pattern: the session key is secure if either the classical or the post-quantum component is unbroken, so hybrid deployment provides immediate HNDL protection against quantum adversaries while remaining safe against classical attacks even if a weakness in ML-KEM were discovered. The key size increase relative to ECC is the primary deployment engineering challenge: an ML-KEM-768 public key at 1184 bytes versus 32 bytes for X25519, and the ciphertext at 1088 bytes, are large enough to affect TLS Certificate message sizes and potentially fragmentation on constrained networks. In TLS 1.3, the key share travels in the ClientHello extension; with ML-KEM-768 this pushes the ClientHello well beyond a single TCP segment, requiring TCP fragmentation handling that some middle-boxes historically mismanage. PQC-aware load balancers and proxies must support larger TLS record sizes accordingly. For HSM-backed long-term keys, ML-KEM is used for key wrapping and recipient key pairs in encrypted message formats (CMS, JOSE); the key pair is generated and stored in the HSM, and the 1184-byte ML-KEM-768 public key is embedded in the X.509 certificate\u0026rsquo;s Subject Public Key Info field using the OID id-alg-ml-kem-768.\n","externalUrl":null,"permalink":"/en/security/ml-kem/","section":"Index","summary":"ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism), standardised as NIST FIPS 203 in August 2024, is the primary post-quantum replacement for key encapsulation and key exchange. It replaces the role of ECDH (X25519, P-256) and RSA key transport in TLS handshakes, IPsec IKEv2 negotiations, and any other protocol that needs two parties to establish a shared secret without prior key material. ML-KEM is derived from CRYSTALS-Kyber, the submission that won NIST’s lattice-based KEM selection, and its security rests on the Module Learning With Errors (MLWE) problem: distinguishing a structured noisy linear system from a random one is computationally hard, and no efficient quantum algorithm for this problem is known. The “module” qualifier means the construction uses polynomial rings structured in a way that allows a good balance between security and efficiency, contrasting with pure LWE (larger keys, simpler structure) and NTRU (smaller keys, different structure).\n","title":"ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/mlops/","section":"Tags","summary":"","title":"Mlops","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/monitoring/","section":"Tags","summary":"","title":"Monitoring","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/mtls/","section":"Tags","summary":"","title":"Mtls","type":"tags"},{"content":"mTLS (Mutual TLS) is the configuration of TLS in which certificate-based authentication is required from both sides of the connection, not just the server. In standard TLS, only the server presents an X.509 certificate, which the client verifies to confirm it is talking to the intended host; the client is typically anonymous to the server, or authenticates separately via a password or session token at the application layer. In mTLS, the client also presents a certificate during the TLS handshake; the server verifies it against a trusted CA before completing the connection. The result is cryptographic proof of identity in both directions: the client knows it is talking to the legitimate server (as in standard TLS), and the server knows the exact identity of the connecting client — without any password, API key, or token exchanged in the application layer.\nThe mechanics of mTLS follow the TLS 1.3 handshake closely. After the server sends its certificate and Finished message, the server\u0026rsquo;s CertificateRequest message prompts the client to send its own certificate and a CertificateVerify proof-of-possession — a signature over the handshake transcript using the client\u0026rsquo;s private key, proving the client holds the key corresponding to the presented certificate. The server validates the client certificate chain against its configured client CA trust store (which may be entirely separate from the public internet CA trust store it uses for server certificates), verifies the proof-of-possession signature, and checks any extensions or policy constraints — such as requiring the client certificate\u0026rsquo;s SAN to match a specific SPIFFE ID pattern. If any check fails, the handshake is aborted before any application data is exchanged. Importantly, mTLS client authentication happens inside the encrypted channel (after the handshake derives session keys), so neither the client certificate nor the proof-of-possession is visible to a network observer.\nmTLS is the standard mechanism for zero-trust service-to-service authentication in microservice architectures and is the primary transport-layer use of SPIFFE/SPIRE: every service receives a short-lived X.509-SVID from its SPIRE Agent, presents it as its client certificate in every outbound connection, and validates the SVID presented by the server against the SPIFFE trust bundle — without any pre-provisioned shared secret or API key. Istio and other service meshes implement mTLS transparently via sidecar proxies (Envoy), intercepting pod traffic and adding certificate-based mutual authentication without application code changes; in this model the application sees a plaintext local connection while the mesh handles mTLS on its behalf. In the CoCo stack, the connection from the Attestation Agent inside the TEE to the Trustee KBS uses a variant called attested TLS (aTLS): the server\u0026rsquo;s TLS certificate is embedded in or bound to the TEE\u0026rsquo;s attestation report, so the client simultaneously completes an mTLS handshake and verifies that the server is running in a genuine TDX or SEV-SNP enclave — combining transport security and remote attestation in a single protocol exchange. In the PQC transition, mTLS is affected on both the key exchange axis (ML-KEM for the session key, already deployable) and the certificate axis (ML-DSA signatures in client and server certificates), with the client certificate chain being a commonly overlooked migration target since organisations that migrate their public-facing TLS certificates often forget that their internal mTLS client certs carry the same HNDL-exposed classical signatures.\n","externalUrl":null,"permalink":"/en/security/mtls/","section":"Index","summary":"mTLS (Mutual TLS) is the configuration of TLS in which certificate-based authentication is required from both sides of the connection, not just the server. In standard TLS, only the server presents an X.509 certificate, which the client verifies to confirm it is talking to the intended host; the client is typically anonymous to the server, or authenticates separately via a password or session token at the application layer. In mTLS, the client also presents a certificate during the TLS handshake; the server verifies it against a trusted CA before completing the connection. The result is cryptographic proof of identity in both directions: the client knows it is talking to the legitimate server (as in standard TLS), and the server knows the exact identity of the connecting client — without any password, API key, or token exchanged in the application layer.\n","title":"mTLS (Mutual TLS)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/multi-tenancy/","section":"Tags","summary":"","title":"Multi-Tenancy","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/national/","section":"Tags","summary":"","title":"National","type":"tags"},{"content":"NBDE (Network-Bound Disk Encryption) is an approach to automatic LUKS disk unlocking that binds the volume key not to hardware state (a TPM PCR measurement) but to network presence: a LUKS-encrypted volume unlocks automatically at boot if and only if the machine can reach a designated Tang server on a trusted network. Remove the machine from that network — because it was stolen, because a data centre drive was pulled, because someone exfiltrated the hardware — and the volume key becomes unrecoverable without a fallback passphrase. The threat model is therefore complementary to TPM-based unlocking: TPM sealing asks \u0026ldquo;is this the right software stack?\u0026rdquo; and locks the key to a specific platform measurement; NBDE asks \u0026ldquo;is this machine on the trusted network?\u0026rdquo; and locks the key to network presence. Neither addresses both threat classes alone, which is why the two are routinely combined — and why RHEL formalises NBDE as a subcategory of the broader Policy-Based Decryption (PBD) framework that the Clevis pin system implements.\nTang is the server component: a minimal, stateless HTTP service (typically running on port 80 or 443 behind a reverse proxy) that advertises a set of JOSE-formatted elliptic curve public keys and responds to key-derivation requests. Tang has no persistent state, no client registry, no authentication, and no TLS requirement — it is designed to be simple enough that its security properties are easy to audit and its availability is easy to ensure. The cryptographic protocol underlying the Tang exchange is the McCallum-Relyea exchange (named after Nathaniel McCallum and Robert Relyea who discovered it in 2015): a two-party protocol built on elliptic curve Diffie-Hellman and the Integrated Encryption Scheme that allows a client to derive a secret using the server\u0026rsquo;s private key without the server ever learning the secret and without the secret ever being transmitted over the network. The exchange proceeds as follows: at bind time, Clevis generates a random client key pair, computes a point on the curve using the Tang server\u0026rsquo;s advertised public key and the client\u0026rsquo;s private key, derives the LUKS unlock key from that point, and stores an encrypted JWE (JSON Web Encryption) token — containing the client\u0026rsquo;s public key and a recovery point — in the LUKS header\u0026rsquo;s metadata. The client\u0026rsquo;s private key is then discarded. At unlock time, Clevis sends the recovery point to the Tang server via an HTTP POST; Tang performs an elliptic curve scalar multiplication using its own private key and returns the result; Clevis combines this with locally stored data to reconstruct the original derived point and recover the LUKS key. Tang never sees the LUKS key, never stores any per-client state, and cannot decrypt the volume even with full access to its own key material — it can only participate in the reconstruction protocol. Tang key rotation is manual: old keys in /var/db/tang/ are hidden by prefixing them with a dot (.) and new keys are generated; existing clients bound to the old key can no longer unlock until rebound, which is the intended revocation mechanism — rotating Tang keys revokes network-bound unlock for all clients bound to the old key simultaneously.\nClevis is the client-side framework: a pluggable, pin-based secret management system that binds LUKS keyslots to arbitrary unlock policies expressed as JSON configurations. A pin is a plugin that implements a specific unlock mechanism; the built-in pins are: tang (NBDE unlock via a Tang server), tpm2 (hardware-bound unlock via TPM2 PCR policy, as covered in the LUKS entry), pkcs11 (PKCS#11 hardware token), and trustee (unlock via the Trustee KBS attested TLS exchange, available in RHEL 10 for confidential computing integration). The sss (Shamir\u0026rsquo;s Secret Sharing) pin is the composition mechanism: it splits the LUKS key into n shares, encrypts each share with a different pin, and requires at least t shares to reconstruct the key — enabling threshold policies across heterogeneous unlock methods. The two most operationally important SSS configurations are: t=1 (OR policy) — any one of the listed pins suffices to unlock; used for high-availability where multiple Tang servers are listed so that the failure of one server does not prevent boot — clevis luks bind -d /dev/sda sss '{\u0026quot;t\u0026quot;:1,\u0026quot;pins\u0026quot;:{\u0026quot;tang\u0026quot;:[{\u0026quot;url\u0026quot;:\u0026quot;http://tang1\u0026quot;},{\u0026quot;url\u0026quot;:\u0026quot;http://tang2\u0026quot;}]}}'; and t=2 (AND policy) — both a Tang server and a TPM2 PCR measurement must be satisfied to unlock — clevis luks bind -d /dev/sda sss '{\u0026quot;t\u0026quot;:2,\u0026quot;pins\u0026quot;:{\u0026quot;tang\u0026quot;:[{\u0026quot;url\u0026quot;:\u0026quot;http://tang1\u0026quot;}],\u0026quot;tpm2\u0026quot;:{\u0026quot;pcr_ids\u0026quot;:\u0026quot;7\u0026quot;,\u0026quot;pcr_bank\u0026quot;:\u0026quot;sha256\u0026quot;}}}'. The AND policy is the recommended production pattern for bare-metal servers: the disk only unlocks if the machine is on the trusted network and booted with a Secure-Boot-verified software stack (PCR 7), protecting against both hardware theft and software tampering simultaneously. Clevis integrates into the boot process via dracut modules (clevis-dracut on RHEL/Fedora, clevis-initramfs on Debian/Ubuntu) that embed the Clevis client and its network stack into the initramfs, enabling Tang queries and TPM2 operations before the root filesystem is mounted. clevis luks bind adds a new LUKS keyslot containing the Clevis JWE token; the existing passphrase keyslot is retained as a fallback. clevis luks list -d /dev/sda shows all Clevis bindings on a device; clevis luks unbind removes one. The RHEL nbde_client and nbde_server Ansible system roles automate fleet-wide deployment of Tang servers and Clevis client bindings at scale. In the context of ODF and bare-metal OpenShift node provisioning, NBDE with Tang is the standard mechanism for automatic OSD and root filesystem unlocking during node bootstrap — the node boots, reaches the Tang server on the cluster network, and unlocks all LUKS volumes without operator intervention, while a node that boots off-network (e.g. after physical removal) cannot access any data.\n","externalUrl":null,"permalink":"/en/security/nbde-clevis-tang/","section":"Index","summary":"NBDE (Network-Bound Disk Encryption) is an approach to automatic LUKS disk unlocking that binds the volume key not to hardware state (a TPM PCR measurement) but to network presence: a LUKS-encrypted volume unlocks automatically at boot if and only if the machine can reach a designated Tang server on a trusted network. Remove the machine from that network — because it was stolen, because a data centre drive was pulled, because someone exfiltrated the hardware — and the volume key becomes unrecoverable without a fallback passphrase. The threat model is therefore complementary to TPM-based unlocking: TPM sealing asks “is this the right software stack?” and locks the key to a specific platform measurement; NBDE asks “is this machine on the trusted network?” and locks the key to network presence. Neither addresses both threat classes alone, which is why the two are routinely combined — and why RHEL formalises NBDE as a subcategory of the broader Policy-Based Decryption (PBD) framework that the Clevis pin system implements.\n","title":"NBDE / Clevis / Tang (Network-Bound Disk Encryption)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/nccl/","section":"Tags","summary":"","title":"Nccl","type":"tags"},{"content":"NCCL (NVIDIA Collective Communications Library) implements collective operations—all-reduce, broadcast, reduce-scatter, all-gather, and others—optimized for NVIDIA GPUs across NVLink within a node and RDMA (InfiniBand or RoCE) across nodes. Its objective in AI is to make distributed training and multi-GPU inference (tensor parallelism) scale: gradient shards must merge every step; attention and MLP partitions must exchange activations with minimal latency. Frameworks (PyTorch DDP/FSDP, vLLM tensor parallel) call NCCL (or delegate to it) rather than hand-rolling socket code.\nArchitecturally, NCCL selects transport based on topology discovery: NVLink peer copies inside the server, then network RDMA between servers, with CUDA streams overlapping communication and compute where possible. The CPU launches NCCL kernels and progress threads but avoids copying full tensors through host memory on the hot path. AMD stacks use RCCL instead; NCCL is NVIDIA-specific. Performance depends on NCCL environment variables, NIC count, rail-optimized topology, and whether traffic shares congested Ethernet without lossless QoS. NCCL is not a user-facing API for app developers but is mandatory plumbing for large LLM jobs.\nRed Hat supports NCCL indirectly through validated RHEL + NVIDIA driver + CUDA stacks on GPU servers and OpenShift AI training/inference guides. Multi-node job manifests (MPI, PyTorch operator, Slurm on RHEL HPC images) assume NCCL-over-IB/RoCE is correctly wired. Red Hat documentation emphasizes node labeling, huge pages, and driver versions from the support matrix; NVIDIA ships NCCL releases tied to CUDA versions. llm-d and vLLM multi-node serving likewise depend on healthy NCCL when tensor parallel spans hosts.\n","externalUrl":null,"permalink":"/en/ai/nccl/","section":"Index","summary":"NCCL (NVIDIA Collective Communications Library) implements collective operations—all-reduce, broadcast, reduce-scatter, all-gather, and others—optimized for NVIDIA GPUs across NVLink within a node and RDMA (InfiniBand or RoCE) across nodes. Its objective in AI is to make distributed training and multi-GPU inference (tensor parallelism) scale: gradient shards must merge every step; attention and MLP partitions must exchange activations with minimal latency. Frameworks (PyTorch DDP/FSDP, vLLM tensor parallel) call NCCL (or delegate to it) rather than hand-rolling socket code.\n","title":"NCCL (NVIDIA Collective Communications Library)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/netfilter/","section":"Tags","summary":"","title":"Netfilter","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/network-slicing/","section":"Tags","summary":"","title":"Network-Slicing","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/networking/","section":"Tags","summary":"","title":"Networking","type":"tags"},{"content":"nftables is the successor to iptables within the Linux Netfilter framework, merged into the mainline kernel in 3.13 (2014) and now the default firewall backend on all major distributions — Debian 10+, Ubuntu 20.04+, RHEL 8+, Fedora 32+. It replaces not just iptables but the entire family of legacy Netfilter frontends: ip6tables (IPv6), arptables (ARP), and ebtables (Ethernet bridging) are all unified under a single nft command and a single kernel subsystem. The kernel component is a generic, protocol-independent packet classification engine; the protocol-specific logic (IPv4, IPv6, ARP, bridging) is expressed in user-space rule syntax rather than hardcoded in separate kernel modules. This unification eliminates the fragmented ruleset management of the iptables era, where a firewall with consistent IPv4/IPv6 and bridging policy required coordinating four separate tools with four separate rulesets and four separate persistence mechanisms.\nThe nftables data model is more expressive than iptables. Rules are organised into tables (named, associated with a protocol family: ip, ip6, inet for dual-stack, arp, bridge, netdev) and chains (which declare their hook point and priority explicitly rather than being fixed as in iptables). The inet family is the key addition: a single inet table with inet chains handles both IPv4 and IPv6 traffic with one ruleset, eliminating the duplication of maintaining filter rules in both iptables and ip6tables. Rule syntax uses a consistent expression language: ip saddr 192.168.0.0/24, tcp dport { 80, 443 }, ct state established,related, meta oifname \u0026quot;eth0\u0026quot;. The major performance and expressiveness improvement over iptables is sets and maps: nftables maintains kernel-side data structures (hash tables, radix trees, intervals) that can hold thousands of IP addresses or port ranges and match against them in O(1) or O(log n) time, rather than iptables\u0026rsquo;s O(n) linear scan. A set is declared once and referenced by name in rules: ip saddr @blocked_hosts drop — updating the set (adding or removing an IP) does not require reloading or re-evaluating the ruleset. Maps extend this to verdict maps (ip daddr map { 10.0.0.1: accept, 10.0.0.2: drop }) and NAT translation maps, enabling compact, data-driven rulesets that would require thousands of individual iptables rules. Ruleset updates are atomic: the entire ruleset can be replaced in a single nft -f operation using a transaction, preventing the brief inconsistency windows that iptables rule loading creates when rules are added one at a time.\nIn Kubernetes environments, nftables is relevant in two contexts. kube-proxy added an nftables backend (beta in Kubernetes 1.31) that replaces the historically iptables-based Service load balancing with nftables sets and maps, dramatically reducing rule count and improving connection setup latency at scale — the same 10,000-Service cluster that generates hundreds of thousands of iptables rules generates a handful of nftables sets instead. firewalld uses nftables as its backend on RHEL 8+ and Fedora, translating its zone-based policy model into nftables rules. The iptables-nft compatibility shim allows legacy tooling that emits iptables commands to function on nftables systems, but the shim carries overhead and loses nftables\u0026rsquo; atomicity guarantees — production systems should migrate to native nftables rules or use firewalld rather than relying on the compatibility layer. eBPF-based CNI plugins like Cilium bypass Netfilter entirely for pod-to-pod traffic, attaching XDP and TC programs before packets reach the nftables hooks, so nftables and Cilium coexist at different layers of the networking stack: nftables handles host-level firewall policy, Cilium handles pod network policy in eBPF.\n","externalUrl":null,"permalink":"/en/security/nftables/","section":"Index","summary":"nftables is the successor to iptables within the Linux Netfilter framework, merged into the mainline kernel in 3.13 (2014) and now the default firewall backend on all major distributions — Debian 10+, Ubuntu 20.04+, RHEL 8+, Fedora 32+. It replaces not just iptables but the entire family of legacy Netfilter frontends: ip6tables (IPv6), arptables (ARP), and ebtables (Ethernet bridging) are all unified under a single nft command and a single kernel subsystem. The kernel component is a generic, protocol-independent packet classification engine; the protocol-specific logic (IPv4, IPv6, ARP, bridging) is expressed in user-space rule syntax rather than hardcoded in separate kernel modules. This unification eliminates the fragmented ruleset management of the iptables era, where a firewall with consistent IPv4/IPv6 and bridging policy required coordinating four separate tools with four separate rulesets and four separate persistence mechanisms.\n","title":"nftables","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/nfv/","section":"Tags","summary":"","title":"Nfv","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/nic/","section":"Tags","summary":"","title":"Nic","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/nim/","section":"Tags","summary":"","title":"Nim","type":"tags"},{"content":"NIM (NVIDIA Inference Microservices) are container images and Helm charts that deliver ready-to-run inference endpoints for specific models (LLMs, vision, embedding, reranking, and more). The objective is to shrink time-to-production: instead of assembling CUDA drivers, frameworks, model weights, and an OpenAI-compatible server yourself, operators pull a NIM that bundles a performance-tuned engine (often TensorRT-LLM or Triton-backed paths), default model artifacts or download hooks, health checks, and a stable HTTP/gRPC API. NIMs are sized for GPU deployment and target enterprise MLOps teams that want versioned, scannable containers with predictable resource requests rather than bespoke notebooks turned into scripts.\nArchitecturally, a NIM is not a new chip; it is a packaging and optimization layer above GPU hardware and below your application. Compared with running raw vLLM from source, a NIM trades some flexibility for NVIDIA-validated kernels, default parallelism settings, and curated model manifests. Compared with a CPU inference server, NIM still assumes accelerator memory for weights and KV state—the same fundamental limits as any LLM stack. In Kubernetes, each NIM is typically one Deployment (or Knative-style service) per model SKU, with GPU requests, liveness probes, and horizontal scaling driven by queue depth or latency SLOs. Multi-GPU and multi-node variants depend on the specific NIM profile (tensor parallel size, disaggregation options).\nRed Hat supports NIM through its NVIDIA partnership and Red Hat OpenShift AI: documented flows to deploy NIM microservices on OpenShift with GPU operators, RHEL-based nodes, and enterprise support boundaries defined in joint guidance. Customers use the same platform primitives—OpenShift security (SCCs, routes, secrets), RHEL driver stacks, and GitOps—as for other AI workloads, while NVIDIA maintains the NIM image lifecycle and model optimizations. RHEL AI and OpenShift AI reference architectures position NIM alongside open engines like vLLM so teams can choose managed NVIDIA microservices where they fit, and open-source stacks where they need maximum customization—often orchestrated at cluster scale with llm-d when many replicas and smart routing matter.\n","externalUrl":null,"permalink":"/en/ai/nim/","section":"Index","summary":"NIM (NVIDIA Inference Microservices) are container images and Helm charts that deliver ready-to-run inference endpoints for specific models (LLMs, vision, embedding, reranking, and more). The objective is to shrink time-to-production: instead of assembling CUDA drivers, frameworks, model weights, and an OpenAI-compatible server yourself, operators pull a NIM that bundles a performance-tuned engine (often TensorRT-LLM or Triton-backed paths), default model artifacts or download hooks, health checks, and a stable HTTP/gRPC API. NIMs are sized for GPU deployment and target enterprise MLOps teams that want versioned, scannable containers with predictable resource requests rather than bespoke notebooks turned into scripts.\n","title":"NIM (NVIDIA Inference Microservices)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/nis2/","section":"Tags","summary":"","title":"Nis2","type":"tags"},{"content":"The NIS2 Directive (EU 2022/2555) is an EU directive — the successor to the original NIS1 of 2016 — that entered into force on 16 January 2023 with a transposition deadline of 17 October 2024, meaning each EU Member State was required to adopt it into national law by that date and enforce it from 18 October 2024 onward. NIS2 is issued by the European Parliament and Council; as a directive (not a regulation), its exact requirements vary by Member State, but the baseline obligations are binding. It applies to medium and large organizations (50+ employees or €10M+ annual turnover) operating in 18 critical sectors including energy, transport, health, banking, digital infrastructure, ICT service management, public administration, and manufacturing. Entities are classified as essential (proactive supervision, fines up to €10M or 2 % of global turnover) or important (reactive supervision, fines up to €7M or 1.4 % of turnover). Compliance is mandatory — management bodies are personally liable for overseeing cybersecurity risk management. Key obligations include implementing proportionate technical and organizational security measures, conducting supply chain risk assessments, reporting significant incidents to the national CSIRT within 24 hours (early warning), 72 hours (full notification), and one month (final report), and cooperating with national cybersecurity authorities. Member States were required to publish their lists of essential and important entities by 17 April 2025.\nRed Hat is not itself a \u0026ldquo;NIS2 entity\u0026rdquo; in the direct sense — it is a software vendor, not an operator of essential services — but its customers across energy, finance, health, telecom, and digital infrastructure are NIS2-obligated entities, and their compliance posture depends heavily on the security properties of the platforms they run. Red Hat addresses NIS2\u0026rsquo;s four core obligation areas through its product portfolio. For risk management (Article 21): Red Hat Advanced Cluster Security (RHACS) provides continuous vulnerability scanning, network segmentation, and runtime threat detection across OpenShift clusters; the Compliance Operator automates enforcement of security profiles (CIS Benchmarks, DISA STIG) and detects configuration drift. For supply chain security: the Trusted Software Supply Chain portfolio delivers Sigstore-based image signing, SLSA-compliant build attestations, SBOM generation, and provenance verification via Trusted Profile Analyzer — directly supporting NIS2\u0026rsquo;s requirement that entities assess the security of their suppliers\u0026rsquo; development practices. For incident handling: Red Hat\u0026rsquo;s CSAF/VEX advisory feeds and integration with Red Hat Insights enable automated detection, prioritization, and remediation of vulnerabilities, compressing the time between discovery and response. For governance and auditability: Ansible Automation Platform enforces security policies as code across hybrid environments, providing the repeatable, auditable evidence trail NIS2 authorities expect. While no vendor can deliver \u0026ldquo;NIS2 compliance in a box,\u0026rdquo; Red Hat\u0026rsquo;s portfolio gives obligated entities the technical building blocks to satisfy directive requirements at the infrastructure and platform layers.\nAdditional Information # Red Hat Statement on NIS2 Compliance Red Hat Strategic Approach to Compliance, Sovereignty, and Lifecycle NIS2 Directive - European Commission ANSSI: Referentiel Cyber France (ReCyF) CCB: CyberFundamentals Framework (CyFUN) ","externalUrl":null,"permalink":"/en/compliance/nis2/","section":"Index","summary":"The NIS2 Directive (EU 2022/2555) is an EU directive — the successor to the original NIS1 of 2016 — that entered into force on 16 January 2023 with a transposition deadline of 17 October 2024, meaning each EU Member State was required to adopt it into national law by that date and enforce it from 18 October 2024 onward. NIS2 is issued by the European Parliament and Council; as a directive (not a regulation), its exact requirements vary by Member State, but the baseline obligations are binding. It applies to medium and large organizations (50+ employees or €10M+ annual turnover) operating in 18 critical sectors including energy, transport, health, banking, digital infrastructure, ICT service management, public administration, and manufacturing. Entities are classified as essential (proactive supervision, fines up to €10M or 2 % of global turnover) or important (reactive supervision, fines up to €7M or 1.4 % of turnover). Compliance is mandatory — management bodies are personally liable for overseeing cybersecurity risk management. Key obligations include implementing proportionate technical and organizational security measures, conducting supply chain risk assessments, reporting significant incidents to the national CSIRT within 24 hours (early warning), 72 hours (full notification), and one month (final report), and cooperating with national cybersecurity authorities. Member States were required to publish their lists of essential and important entities by 17 April 2025.\n","title":"NIS2 Directive","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/nist/","section":"Tags","summary":"","title":"Nist","type":"tags"},{"content":"NIST Special Publication 800-53 is published by the National Institute of Standards and Technology (NIST), a US federal agency within the Department of Commerce. The current version is Revision 5 (September 2020, updated December 2020), which defines over 1,000 security and privacy controls organized in 20 control families (Access Control, Audit and Accountability, Configuration Management, Incident Response, System and Communications Protection, Supply Chain Risk Management, etc.). NIST 800-53 is mandatory for US federal agencies and their contractors under FISMA (Federal Information Security Modernization Act) and serves as the control baseline for FedRAMP (cloud), CMMC (defense contractors), and many state/local government programs. Beyond the US, it is widely adopted internationally as a comprehensive reference catalog — organizations in finance, healthcare, and critical infrastructure worldwide use NIST 800-53 as their control framework. The standard defines three baselines (Low, Moderate, High) corresponding to the potential impact of a security breach. NIST 800-53 is not a certification itself but the control catalog against which systems are assessed; formal authorization (ATO — Authority to Operate) is granted by an authorizing official after an assessor verifies control implementation using NIST SP 800-53A assessment procedures. The companion OSCAL (Open Security Controls Assessment Language) standard, also from NIST, provides machine-readable formats for expressing 800-53 controls and assessment results.\nRed Hat has extensive, documented alignment with NIST 800-53. RHEL and OpenShift provide technical implementations for hundreds of 800-53 controls across all 20 families. The most direct integration is through the OpenSCAP tooling shipped with RHEL, which includes SCAP content mapping RHEL configurations to NIST 800-53 control requirements — enabling automated assessment of an entire system against the Low, Moderate, or High baseline. The OpenShift Compliance Operator extends this to Kubernetes environments, scanning both the platform and the underlying RHCOS nodes against 800-53 derived profiles. Red Hat\u0026rsquo;s alignment goes beyond scanning: FIPS 140-3 validated cryptography satisfies SC (System and Communications Protection) family controls; SELinux and namespace isolation address AC (Access Control) requirements; auditd and OpenShift API audit logging implement AU (Audit and Accountability) controls; the Trusted Software Supply Chain directly addresses the SA-8 through SA-15 controls in the Supply Chain Risk Management family (new in Rev 5). Red Hat also invests in OSCAL: the complyctl tool and forthcoming Kubernetes-native compliance toolkit generate OSCAL-formatted assessment results, enabling machine-to-machine evidence exchange with GRC platforms — critical for the continuous monitoring that NIST 800-53 and FedRAMP demand. For federal customers, Red Hat\u0026rsquo;s FedRAMP High-authorized ROSA service directly inherits the NIST 800-53 Rev 5 High baseline, reducing customer assessment scope by up to 70 % of controls.\nAdditional Information # NIST SP 800-53 Rev 5 - Official NIST 800-53 control catalog (searchable) Red Hat compliance activities - NIST OSCAL - NIST ","externalUrl":null,"permalink":"/en/compliance/nist-800-53/","section":"Index","summary":"NIST Special Publication 800-53 is published by the National Institute of Standards and Technology (NIST), a US federal agency within the Department of Commerce. The current version is Revision 5 (September 2020, updated December 2020), which defines over 1,000 security and privacy controls organized in 20 control families (Access Control, Audit and Accountability, Configuration Management, Incident Response, System and Communications Protection, Supply Chain Risk Management, etc.). NIST 800-53 is mandatory for US federal agencies and their contractors under FISMA (Federal Information Security Modernization Act) and serves as the control baseline for FedRAMP (cloud), CMMC (defense contractors), and many state/local government programs. Beyond the US, it is widely adopted internationally as a comprehensive reference catalog — organizations in finance, healthcare, and critical infrastructure worldwide use NIST 800-53 as their control framework. The standard defines three baselines (Low, Moderate, High) corresponding to the potential impact of a security breach. NIST 800-53 is not a certification itself but the control catalog against which systems are assessed; formal authorization (ATO — Authority to Operate) is granted by an authorizing official after an assessor verifies control implementation using NIST SP 800-53A assessment procedures. The companion OSCAL (Open Security Controls Assessment Language) standard, also from NIST, provides machine-readable formats for expressing 800-53 controls and assessment results.\n","title":"NIST 800-53","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/nlp/","section":"Tags","summary":"","title":"Nlp","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/npn/","section":"Tags","summary":"","title":"Npn","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/nvidia/","section":"Tags","summary":"","title":"Nvidia","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/nvlink/","section":"Tags","summary":"","title":"Nvlink","type":"tags"},{"content":"NVLink is NVIDIA’s proprietary high-speed interconnect between GPUs (and, on some platforms, between GPUs and CPUs) inside a server or across an NVLink switch system (e.g. NVL72-class racks). Its objective is to move tensors—activations, gradients, KV cache shards, or partial attention results—at much higher bandwidth and lower latency than PCIe or general Ethernet, so multi-GPU training and large-model inference (tensor parallelism) are not bottlenecked on the bus. NVLink domains define which GPUs can treat each other’s memory as peer-accessible for CUDA and NCCL without leaving the box.\nArchitecturally, NVLink is intra-node (or intra-tray) fabric, distinct from InfiniBand/RoCE RDMA that links servers. A CPU still initiates work, but bulk GPU–GPU copies use NVLink while the host PCIe bus carries I/O and smaller control messages. LLMs that exceed one GPU’s HBM are sharded across NVLink-connected devices; decode and prefill latency for tensor-parallel serving depend on all-reduce and attention communication over that link. MIG slices on one physical GPU do not extend NVLink as a multi-GPU pool—they partition a single card. When jobs span nodes, NCCL uses network RDMA; within the node, NVLink dominates.\nRed Hat documents multi-GPU RHEL and OpenShift nodes where NVLink topology is exposed to schedulers (NUMA, GPU affinity) and partner reference architectures (NVIDIA DGX, HGX) under Red Hat support matrices. OpenShift AI capacity planning assumes NVLink-aware placement for large models served via vLLM tensor parallel or NIM multi-GPU profiles. Operators verify BIOS, firmware, and driver bundles on certified hardware so NVLink lanes train at expected width—platform validation on RHEL, not a separate Red Hat product.\n","externalUrl":null,"permalink":"/en/ai/nvlink/","section":"Index","summary":"NVLink is NVIDIA’s proprietary high-speed interconnect between GPUs (and, on some platforms, between GPUs and CPUs) inside a server or across an NVLink switch system (e.g. NVL72-class racks). Its objective is to move tensors—activations, gradients, KV cache shards, or partial attention results—at much higher bandwidth and lower latency than PCIe or general Ethernet, so multi-GPU training and large-model inference (tensor parallelism) are not bottlenecked on the bus. NVLink domains define which GPUs can treat each other’s memory as peer-accessible for CUDA and NCCL without leaving the box.\n","title":"NVLink","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/o-ran/","section":"Tags","summary":"","title":"O-Ran","type":"tags"},{"content":"The O-RAN Alliance is an operator-led global industry alliance, formed in February 2018 through the merger of the C-RAN Alliance and the xRAN Forum, whose mission is to reshape how radio access networks are designed, built, and operated. Where traditional RAN stacks are vertically integrated — baseband software, radio hardware, and management tools delivered as a single vendor bundle — O-RAN promotes disaggregation: separating the RAN into open, standardised functional blocks connected by published interfaces, so a mobile operator can mix DU, CU, RU, and management software from different suppliers. The alliance\u0026rsquo;s core objectives are multi-vendor interoperability, cloud-native and virtualised deployment, programmable RAN intelligence through the RIC (RAN Intelligent Controller), and operational automation at scale. These goals address vendor lock-in, slow innovation cycles, and the cost structure of legacy RAN, while aligning with 5G and beyond requirements for network slicing, edge deployment, and AI/ML-driven optimisation.\nSpecification work is organised into eleven Working Groups (WGs), all under the Technical Steering Committee (TSC), each owning a slice of the architecture.\nWG Scope WG1 defines use cases and the overall O-RAN architecture WG2 covers the Non-RT RIC and the A1 interface WG3 the Near-RT RIC and the E2 interface WG4 Open Fronthaul between O-DU and O-RU WG5 the midhaul/backhaul interfaces (F1, W1, E1, X2, Xn) WG6 cloudification, O-Cloud, and the O2 interface WG7 white-box hardware WG8 O-CU/O-DU stack reference design WG9 xHaul transport WG10 OAM and the O1 interface WG11 security requirements, threat modelling, and assurance Architecturally, O-RAN is organised around three domains. The SMO (Service Management and Orchestration) framework sits at the top as the management and automation plane, hosting the Non-RT RIC and connecting southbound through O1 (to O-RAN NFs), O2 (to O-Cloud), A1 (to Near-RT RIC), and the Open Fronthaul M-plane. The O-RAN network functions — O-RU, O-DU, O-CU-CP, O-CU-UP, and the Near-RT RIC running xApps — form the radio processing and real-time control layer. The O-Cloud at the bottom provides the virtualised infrastructure (compute, storage, networking) on which those functions run, managed by the SMO over O2. This layered separation — intelligence (RIC), data plane (CU/DU/RU), management (SMO), and infrastructure (O-Cloud) — is what makes multi-vendor composition technically feasible rather than merely aspirational.\nMarket adoption has moved from early proof-of-concept trials toward commercial-scale industrialisation, though the pace varies widely by operator and region. Large operators in North America, Europe, and Asia have deployed or announced Open RAN in greenfield, rural, and enterprise scenarios; vendor ecosystems spanning traditional NEPs, cloud providers, and specialist Open RAN suppliers have matured around the SMO, O-Cloud, and disaggregated RU/DU/CU stack. Industry surveys in 2025–2026 indicate that a majority of operators plan to incorporate the SMO framework into their RAN automation strategy within three years — often by evolving existing SON platforms rather than a full rip-and-replace — and that SMO/Non-RT RIC with rApps is currently ahead of Near-RT RIC/xApp deployment in production roadmaps. Full-scale Open RAN rollouts nevertheless face real constraints: performance parity with integrated RAN in high-capacity macro sites, integration and testing complexity across multi-vendor chains, and the operational maturity of the broader ecosystem. O-RAN is widely treated as a long-term structural shift in RAN procurement and architecture rather than a near-term wholesale replacement of every legacy site — with adoption strongest where openness, automation, and supplier diversity deliver clear operational or economic value.\nAdditional Information # O-RAN Alliance Portal O-RAN Alliance Specifications ","externalUrl":null,"permalink":"/en/telco/o-ran-alliance/","section":"Index","summary":"The O-RAN Alliance is an operator-led global industry alliance, formed in February 2018 through the merger of the C-RAN Alliance and the xRAN Forum, whose mission is to reshape how radio access networks are designed, built, and operated. Where traditional RAN stacks are vertically integrated — baseband software, radio hardware, and management tools delivered as a single vendor bundle — O-RAN promotes disaggregation: separating the RAN into open, standardised functional blocks connected by published interfaces, so a mobile operator can mix DU, CU, RU, and management software from different suppliers. The alliance’s core objectives are multi-vendor interoperability, cloud-native and virtualised deployment, programmable RAN intelligence through the RIC (RAN Intelligent Controller), and operational automation at scale. These goals address vendor lock-in, slow innovation cycles, and the cost structure of legacy RAN, while aligning with 5G and beyond requirements for network slicing, edge deployment, and AI/ML-driven optimisation.\n","title":"O-RAN Alliance","type":"telco"},{"content":"OAuth 2.0 (RFC 6749, 2012) is an authorisation delegation framework — not an authentication protocol — that solves a specific problem: how does a user grant a third-party application access to their resources on a server, without giving that application their password? The canonical example is a user granting a calendar app access to their Google Drive files: OAuth 2.0 lets Google issue the calendar app a scoped, time-limited access token that permits it to read Drive files, without the app ever seeing the user\u0026rsquo;s Google password. The distinction between authorisation and authentication is fundamental: OAuth 2.0 proves that a token was issued by an authorisation server for a specific scope — it says nothing about who the user is. Attempting to use OAuth 2.0 for authentication (treating token possession as proof of identity) is a well-documented anti-pattern with concrete exploits; OIDC (OpenID Connect) is the authentication layer built on top of OAuth 2.0 that addresses this correctly.\nThe protocol defines an authorisation server (AS — the party that issues tokens, e.g. Google, GitHub, Okta, Keycloak), a resource server (RS — the API that accepts tokens and returns protected resources), a client (the application requesting access), and a resource owner (the user whose resources are being accessed). OAuth 2.0 defines several grant types — flows by which a client obtains tokens — appropriate for different client architectures. The Authorization Code grant is the standard flow for user-facing applications: the client redirects the user to the AS, the user authenticates and consents, the AS redirects back with a short-lived authorisation code, and the client exchanges that code for tokens at the token endpoint. PKCE (Proof Key for Code Exchange, RFC 7636) is a mandatory extension for public clients (SPAs, mobile apps) that cannot safely hold a client secret: the client generates a random code_verifier, sends a code_challenge (SHA-256 hash of the verifier) with the authorisation request, and proves possession of the verifier at token exchange, preventing authorisation code interception attacks. Client Credentials is the machine-to-machine grant: a client authenticates directly to the token endpoint with its own credentials (client ID + secret, or a client certificate for mTLS-based client authentication per RFC 8705) and receives an access token scoped to its own identity, with no user involved — the standard pattern for service-to-service API access. Device Authorization (RFC 8628) handles input-constrained devices (smart TVs, CLI tools) that cannot open a browser: the device displays a short code and URL, the user authenticates on a second device, and the device polls for the resulting token. The Implicit and Resource Owner Password Credentials grants are deprecated in OAuth 2.1 (the forthcoming consolidation of OAuth 2.0 best practices) and should not be used in new deployments.\nAccess tokens in modern OAuth 2.0 deployments are typically JWTs (JSON Web Tokens, RFC 7519): a base64url-encoded JSON header (algorithm, key ID) + payload (issuer iss, subject sub, audience aud, expiry exp, issued-at iat, scope scp, and custom claims) + signature (RS256/ES256/EdDSA produced by the AS\u0026rsquo;s signing key). A resource server validates a JWT access token by verifying the signature against the AS\u0026rsquo;s published public key (retrieved from the AS\u0026rsquo;s JWKS endpoint at /.well-known/oauth-authorization-server), checking the exp claim, confirming the aud matches its own identifier, and checking the scp or scope claim against the operation being requested. Opaque tokens are an alternative — a random string that the RS must validate by calling the AS\u0026rsquo;s introspection endpoint (RFC 7662) per request, trading RS statelessness for AS-controlled revocation. Token lifetimes are a security/UX trade-off: short-lived access tokens (5–15 minutes) limit the damage from token leakage; refresh tokens (RFC 6749 §6) allow the client to obtain new access tokens without re-involving the user, and are themselves long-lived but should be sender-constrained (via mTLS or DPoP, RFC 9449) to prevent use from a different client if stolen. In the Vault and SPIFFE/SPIRE context, OAuth 2.0 client credentials flows with mTLS client authentication or JWT client assertions (RFC 7523 — using a JWT signed with the client\u0026rsquo;s private key as the credential, rather than a shared secret) are the standard machine-to-machine access pattern; SPIRE\u0026rsquo;s OIDC federation endpoint issues JWT-SVIDs that can be used directly as RFC 7523 client assertions with cloud provider token endpoints (AWS STS, GCP STS), enabling workload identity without any static secret.\nAdditional Information # IETF RFC 6749: The OAuth 2.0 Authorization Framework ","externalUrl":null,"permalink":"/en/security/oauth2/","section":"Index","summary":"OAuth 2.0 (RFC 6749, 2012) is an authorisation delegation framework — not an authentication protocol — that solves a specific problem: how does a user grant a third-party application access to their resources on a server, without giving that application their password? The canonical example is a user granting a calendar app access to their Google Drive files: OAuth 2.0 lets Google issue the calendar app a scoped, time-limited access token that permits it to read Drive files, without the app ever seeing the user’s Google password. The distinction between authorisation and authentication is fundamental: OAuth 2.0 proves that a token was issued by an authorisation server for a specific scope — it says nothing about who the user is. Attempting to use OAuth 2.0 for authentication (treating token possession as proof of identity) is a well-documented anti-pattern with concrete exploits; OIDC (OpenID Connect) is the authentication layer built on top of OAuth 2.0 that addresses this correctly.\n","title":"OAuth 2.0","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/oauth2/","section":"Tags","summary":"","title":"Oauth2","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/observability/","section":"Tags","summary":"","title":"Observability","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/oci/","section":"Tags","summary":"","title":"Oci","type":"tags"},{"content":"The Open Container Initiative (OCI) is a Linux Foundation project founded in June 2015 by Docker, CoreOS, and others to prevent the container ecosystem from fragmenting around proprietary formats. It maintains three interlocking specifications that together describe the complete lifecycle of a container: how an image is structured, how it is transported, and how it is run. Any tool that conforms to these specs — builder, registry, runtime — is interoperable with any other conformant tool, which is why an image built by buildah can be pushed to a registry running Harbor, pulled by containerd, and executed by a runtime written in Rust.\nThe Image Specification defines the on-disk and on-wire format of a container image. An image is a Merkle DAG of content-addressed blobs: a manifest (a JSON document listing the image\u0026rsquo;s layers and config by their SHA-256 digests), a config blob (containing runtime defaults like entrypoint, environment variables, and architecture), and one or more layer blobs (filesystem changesets stored as tarballs, optionally compressed with gzip or zstd). Every component is addressed by its digest, so the manifest\u0026rsquo;s own digest serves as an immutable, content-addressable identifier for the entire image — the same digest always refers to exactly the same content, everywhere. Image v1.1 (2024) extended the format with artifacts: arbitrary blobs — SBOMs, signatures, attestations, Helm charts — can be stored in the same registry using the same manifest structure, with a subject field pointing at the image they annotate, and a referrers API in the distribution spec for querying them.\nThe Runtime Specification defines what happens when an OCI image is unpacked into a filesystem bundle and handed to a runtime. It specifies the config.json format that describes the container\u0026rsquo;s root filesystem, namespaces, cgroups, capabilities, mounts, and seccomp/apparmor profiles. runc is the OCI reference runtime implementation, donated by Docker at OCI\u0026rsquo;s founding, and remains the low-level execution engine underneath containerd and CRI-O on most Kubernetes nodes. The Distribution Specification standardises the HTTP API that registries expose for pushing and pulling content — the v2 registry API originally developed by Docker — ensuring that any OCI-conformant client can speak to any OCI-conformant registry. Together the three specs form the substrate on which the entire cloud-native container ecosystem — Kubernetes, CoCo, composefs image layer deduplication, and image-based Linux delivery via bootc — is built.\n","externalUrl":null,"permalink":"/en/security/oci/","section":"Index","summary":"The Open Container Initiative (OCI) is a Linux Foundation project founded in June 2015 by Docker, CoreOS, and others to prevent the container ecosystem from fragmenting around proprietary formats. It maintains three interlocking specifications that together describe the complete lifecycle of a container: how an image is structured, how it is transported, and how it is run. Any tool that conforms to these specs — builder, registry, runtime — is interoperable with any other conformant tool, which is why an image built by buildah can be pushed to a registry running Harbor, pulled by containerd, and executed by a runtime written in Rust.\n","title":"OCI (Open Container Initiative)","type":"security"},{"content":"OCI Referrers is a mechanism introduced in the OCI Image and Distribution Specification v1.1 (finalised 2024) that allows arbitrary artifacts — signatures, SBOMs, vulnerability scan reports, attestations, provenance documents — to be attached to an existing image in a registry without modifying the image itself and without requiring out-of-band storage or tag conventions. The attachment is expressed through a subject field added to any OCI manifest: a descriptor pointing to the digest of the target image. The registry then indexes these relationships, and the referrers API makes them discoverable.\nThe mechanics are straightforward. An artifact manifest carrying a subject field is pushed to the same repository as the image it annotates; conformant registries respond with an OCI-Subject header confirming the relationship was recorded. To discover what is attached to a given image, any client issues a GET /v2/\u0026lt;name\u0026gt;/referrers/\u0026lt;digest\u0026gt; request; the registry returns an OCI Image Index whose descriptors point to all manifests with that digest as their subject. Each descriptor in the response carries an artifactType field — a media type string identifying what kind of artifact it is (e.g. application/vnd.dev.cosign.artifact.sig.v1+json for a cosign signature, application/spdx+json for an SPDX SBOM) — enabling clients to filter the response to only the artifact types they need without fetching everything. For registries that do not yet implement the referrers API, a client-side fallback exists: the client maintains a tag derived from the subject digest (replacing : with -) that points to an equivalent index, preserving interoperability with older infrastructure at the cost of requiring client-side writes.\nThe practical effect is a content-addressed, registry-native supply chain graph. Cosign uses referrers to attach signatures and attestations (including SLSA provenance) to images without the tag mutation that cosign:sha256-\u0026lt;digest\u0026gt;.sig tags previously required. ORAS uses referrers to attach arbitrary files — Helm charts, OPA policies, licence documents — as first-class registry objects linked to the images they govern. bootc and image-based Linux tooling can attach OS-level SBOMs and attestation bundles to OS image releases, queryable by any tool that speaks the distribution spec. Because the subject relationship is expressed as a content-addressed digest, the attachment is immutable and tamper-evident: a referrer can only claim to be attached to an image it actually knows the digest of, and the image\u0026rsquo;s own digest — and therefore its referrers list — changes if the image changes. The referrers API is the OCI ecosystem\u0026rsquo;s answer to the question of how supply chain metadata travels with an image through promotion across registries and deployment into production.\n","externalUrl":null,"permalink":"/en/security/oci-referrers/","section":"Index","summary":"OCI Referrers is a mechanism introduced in the OCI Image and Distribution Specification v1.1 (finalised 2024) that allows arbitrary artifacts — signatures, SBOMs, vulnerability scan reports, attestations, provenance documents — to be attached to an existing image in a registry without modifying the image itself and without requiring out-of-band storage or tag conventions. The attachment is expressed through a subject field added to any OCI manifest: a descriptor pointing to the digest of the target image. The registry then indexes these relationships, and the referrers API makes them discoverable.\n","title":"OCI Referrers API","type":"security"},{"content":"OCSP (Online Certificate Status Protocol), standardised in RFC 6960, is a request-response protocol that allows a verifier to query an OCSP responder — a service operated by the CA or a delegated party — for the current revocation status of a specific X.509 certificate. Where a CRL requires downloading an entire list and searching it locally, an OCSP query asks about exactly one certificate and receives a signed response: good (the certificate is currently valid and not revoked), revoked (revoked, with the revocation time and reason), or unknown (the responder does not know this certificate). The OCSP response is signed by the CA\u0026rsquo;s OCSP signing key (or a dedicated OCSP responder key with the id-pkix-ocsp-nocheck extension, exempt from its own revocation checking to prevent circularity) and carries a thisUpdate and nextUpdate timestamp defining its freshness window. Verifiers in strict mode reject responses outside the freshness window; in practice, OCSP responses are valid for 24 hours to 7 days depending on the CA\u0026rsquo;s policy, meaning OCSP shares CRL\u0026rsquo;s staleness problem, albeit with a smaller window.\nThe naive OCSP model — the client sends a request to the responder on every TLS connection — has two significant problems. Privacy: the OCSP responder learns exactly which certificate the client is verifying, and therefore which website the client is visiting, at the time of the connection. Since OCSP responders are operated by CAs (a small number of parties), this creates a centralised surveillance point for a significant fraction of HTTPS browsing — every connection to a site whose certificate chains to a major CA is reported to that CA\u0026rsquo;s OCSP responder in real time. Latency: the OCSP query is an additional network round-trip on the TLS handshake critical path, adding 50–300 ms to connection establishment depending on responder proximity and load, and introducing a failure mode if the responder is slow or unavailable. OCSP stapling (RFC 6066 §8, the status_request TLS extension) solves both problems: the server periodically fetches its own OCSP response from the responder, caches it, and staples it to the TLS handshake — delivering it in the CertificateStatus message alongside the certificate. The client receives a fresh, CA-signed response without making its own network request, the CA\u0026rsquo;s responder sees only the server\u0026rsquo;s queries (not individual clients), and the OCSP check adds zero latency to the client\u0026rsquo;s connection. OCSP Must-Staple (RFC 7633, the status_request X.509 extension in the leaf certificate) takes this further: it instructs compliant TLS implementations to require a valid stapled OCSP response and hard-fail if none is present, preventing an attacker who has compromised a certificate\u0026rsquo;s private key from blocking OCSP checks to extend the certificate\u0026rsquo;s effective validity.\nOCSP\u0026rsquo;s practical status in the web PKI is ambiguous. Browsers have largely abandoned client-side OCSP checking for leaf certificates: Chrome disabled OCSP soft-fail checking in 2012 (citing the privacy problem and the fact that soft-fail — accepting the certificate if the OCSP check fails — provides no security against an attacker who can block OCSP requests), relying instead on CRLSets and the short certificate lifetimes mandated by the CA/Browser Forum (currently 398-day maximum validity, with proposals for 90-day and 47-day maximums actively under ballot). Firefox retains OCSP for EV certificates but has moved to CRLite (a compressed, locally cached revocation database built from CRLs) for DV certificates. Despite this retreat in the browser context, OCSP stapling remains important for server operators because non-browser TLS clients — Java applications, Python\u0026rsquo;s requests, Go\u0026rsquo;s crypto/tls, curl — typically do perform OCSP checking (or at minimum respect stapled responses), and mTLS client certificate verification in cert-manager-managed and SPIFFE/SPIRE-adjacent deployments relies on OCSP or CRL checking for client certificate revocation. Vault\u0026rsquo;s PKI engine issues certificates with OCSP responder URLs and supports a built-in OCSP responder, making it the natural revocation infrastructure for short-lived certificates issued to Kubernetes workloads. For very short-lived certificates — the hours-to-days lifetime favoured by SPIRE SVIDs, Vault PKI leases, and cert-manager with aggressive renewal — revocation becomes operationally moot: a compromised certificate expires before a CRL or OCSP response is stale enough to matter, which is why short lifetimes are the preferred revocation mitigation in modern certificate management. In the PQC transition, OCSP response signatures must migrate from ECDSA/RSA to ML-DSA alongside the certificates they cover, and OCSP responder keys should be among the first infrastructure keys migrated given their role in the trust validation chain.\n","externalUrl":null,"permalink":"/en/security/ocsp/","section":"Index","summary":"OCSP (Online Certificate Status Protocol), standardised in RFC 6960, is a request-response protocol that allows a verifier to query an OCSP responder — a service operated by the CA or a delegated party — for the current revocation status of a specific X.509 certificate. Where a CRL requires downloading an entire list and searching it locally, an OCSP query asks about exactly one certificate and receives a signed response: good (the certificate is currently valid and not revoked), revoked (revoked, with the revocation time and reason), or unknown (the responder does not know this certificate). The OCSP response is signed by the CA’s OCSP signing key (or a dedicated OCSP responder key with the id-pkix-ocsp-nocheck extension, exempt from its own revocation checking to prevent circularity) and carries a thisUpdate and nextUpdate timestamp defining its freshness window. Verifiers in strict mode reject responses outside the freshness window; in practice, OCSP responses are valid for 24 hours to 7 days depending on the CA’s policy, meaning OCSP shares CRL’s staleness problem, albeit with a smaller window.\n","title":"OCSP (Online Certificate Status Protocol)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/odf/","section":"Tags","summary":"","title":"Odf","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/offload/","section":"Tags","summary":"","title":"Offload","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/oidc/","section":"Tags","summary":"","title":"Oidc","type":"tags"},{"content":"OpenID Connect (OIDC) is an authentication protocol built as a thin layer on top of OAuth 2.0, published by the OpenID Foundation in 2014. Where OAuth 2.0 defines how to delegate authorisation (granting access to resources), OIDC adds the missing authentication semantics: a standard ID token that proves who the user is, a UserInfo endpoint that returns standardised identity claims, and a discovery document that allows clients to configure themselves automatically from a single well-known URL. The separation is precise: OAuth 2.0 access tokens prove that a client is authorised to call an API; OIDC ID tokens prove that a specific user authenticated with a specific identity provider at a specific time. OIDC is the protocol behind virtually every \u0026ldquo;Sign in with Google / GitHub / Microsoft\u0026rdquo; flow, every SAML-to-modern-stack migration, and every Kubernetes service account token issued today — making it the dominant authentication federation standard in cloud-native infrastructure.\nThe OIDC flow follows the OAuth 2.0 Authorization Code + PKCE pattern, with one critical addition: the openid scope. When a client includes openid in its authorisation request, the authorisation server returns both an access token and an ID token from the token endpoint. The ID token is a JWT with a mandatory set of claims: iss (issuer — the identity provider\u0026rsquo;s URL), sub (subject — a stable, unique identifier for the user within this issuer), aud (audience — the client ID), exp and iat (expiry and issued-at), and nonce (a client-generated random value included in the authorisation request and echoed in the ID token, binding the token to the specific session and preventing replay). Optional but standard claims include name, email, email_verified, phone_number, preferred_username, picture, and locale; extended claims are returned from the UserInfo endpoint (GET /userinfo with the access token as a Bearer credential). The discovery document at \u0026lt;issuer\u0026gt;/.well-known/openid-configuration is a JSON document that publishes the provider\u0026rsquo;s token endpoint, authorisation endpoint, JWKS URI (where the provider\u0026rsquo;s signing keys are published for token verification), supported scopes, supported response types, and claims supported — enabling clients to configure themselves without hardcoded endpoint URLs. A client verifies an ID token by: fetching the JWKS from the JWKS URI, finding the key matching the token\u0026rsquo;s kid header claim, verifying the JWT signature, checking iss matches the expected provider, checking aud contains the client\u0026rsquo;s ID, checking exp is in the future, and checking the nonce matches what was sent — this is the complete verification sequence; omitting any step is a security vulnerability.\nOIDC\u0026rsquo;s most significant infrastructure use case beyond user-facing SSO is workload identity federation: using OIDC-issued tokens as credentials for machine-to-machine access without static secrets. Kubernetes issues service account tokens (since Kubernetes 1.21, projected service account tokens are OIDC JWTs signed by the cluster\u0026rsquo;s OIDC provider, discoverable at the cluster\u0026rsquo;s /.well-known/openid-configuration) that pods can present to external services. AWS STS\u0026rsquo;s AssumeRoleWithWebIdentity API accepts a Kubernetes service account JWT and, if the cluster\u0026rsquo;s OIDC issuer is registered as a trusted identity provider in the AWS account, returns temporary IAM credentials — no AWS_ACCESS_KEY_ID stored anywhere, the pod\u0026rsquo;s identity is its Kubernetes service account. GCP Workload Identity Federation and Azure AD federated credentials work identically. SPIFFE/SPIRE\u0026rsquo;s OIDC federation endpoint issues JWT-SVIDs as OIDC tokens, allowing SPIRE-identified workloads to access cloud APIs through the same mechanism. On the Kubernetes control plane, the API server itself acts as an OIDC relying party: --oidc-issuer-url, --oidc-client-id, and --oidc-username-claim configure it to accept OIDC JWTs from an external identity provider (Dex, Keycloak, Okta, GitHub) as kubectl authentication tokens, enabling SSO for cluster access without distributing static kubeconfig credentials. cert-manager uses OIDC tokens for ACME DNS-01 and HTTP-01 challenge solvers when authenticating to cloud DNS providers, and Vault\u0026rsquo;s JWT/OIDC auth method accepts OIDC tokens as Vault login credentials — mapping OIDC claims to Vault policies. The PQC implication for OIDC is the same as for any JWT-based system: the ID token and service account token signatures are ECDSA or RSA today; migrating the identity provider\u0026rsquo;s signing key to ML-DSA propagates quantum-safe signatures into every federated authentication decision downstream.\n","externalUrl":null,"permalink":"/en/security/oidc/","section":"Index","summary":"OpenID Connect (OIDC) is an authentication protocol built as a thin layer on top of OAuth 2.0, published by the OpenID Foundation in 2014. Where OAuth 2.0 defines how to delegate authorisation (granting access to resources), OIDC adds the missing authentication semantics: a standard ID token that proves who the user is, a UserInfo endpoint that returns standardised identity claims, and a discovery document that allows clients to configure themselves automatically from a single well-known URL. The separation is precise: OAuth 2.0 access tokens prove that a client is authorised to call an API; OIDC ID tokens prove that a specific user authenticated with a specific identity provider at a specific time. OIDC is the protocol behind virtually every “Sign in with Google / GitHub / Microsoft” flow, every SAML-to-modern-stack migration, and every Kubernetes service account token issued today — making it the dominant authentication federation standard in cloud-native infrastructure.\n","title":"OIDC (OpenID Connect)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/open-ran/","section":"Tags","summary":"","title":"Open-Ran","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/open-source/","section":"Tags","summary":"","title":"Open-Source","type":"tags"},{"content":"OpenPGP is an open standard for encryption and digital signatures of arbitrary data, defined in RFC 4880 (2007) and substantially revised in RFC 9580 (2024, adding Ed25519, X25519, and modern AEAD encryption). GnuPG (GPG) is the dominant open-source implementation, maintained by Werner Koch and the GnuPG project, and the tool most users interact with. OpenPGP predates the PKI/CA model and takes a fundamentally different approach to trust: rather than a hierarchy of certificate authorities that users must trust transitively, OpenPGP uses a Web of Trust in which individual users sign each other\u0026rsquo;s public keys, and trust is established through chains of personal endorsements. In the Web of Trust model, Alice trusts Bob\u0026rsquo;s key because she verified it in person and signed it; Carol trusts Bob\u0026rsquo;s key because Alice (whom Carol trusts) signed it. This decentralised, peer-to-peer trust model made sense for email encryption between individuals who could meet at key-signing parties, but does not scale to automated infrastructure verification, which is why OpenPGP\u0026rsquo;s role in modern infrastructure is primarily supply chain signing — package repositories, Git commits, and release artifacts — rather than interactive authentication.\nAn OpenPGP key is a certificate that bundles a primary key (used for certification — signing other keys — and optionally for signing data) with one or more subkeys (for encryption, signing, and authentication), each with its own algorithm and validity period, all bound together by self-signatures from the primary key. The primary key\u0026rsquo;s fingerprint (SHA-1 historically, SHA-256 in RFC 9580) is the durable identity of the key, and is what users publish on keyservers (SKS, keys.openpgp.org), in DNS DANE records, or in their GitHub profiles. Key management in GnuPG is handled by the gpg CLI and, for smartcard/hardware token integration, by gpg-agent and the scdaemon: OpenPGP keys can be generated on and stored in hardware tokens (YubiKey with OpenPGP applet, Nitrokey) so that the private key never leaves the hardware, providing FIDO2-like physical presence requirements for signing operations. A signed OpenPGP packet (a --clearsign, --detach-sig, or --sign output) contains the data, the signature, and the signer\u0026rsquo;s key fingerprint; a verifier who has the signer\u0026rsquo;s public key can verify the signature without any CA or network call. Encryption in OpenPGP uses a hybrid scheme: a random session key is encrypted under each recipient\u0026rsquo;s public encryption subkey using RSA or X25519 (ECDH, per RFC 9580), and the data is encrypted with AES-256 using that session key.\nThe primary infrastructure uses of OpenPGP in this glossary\u0026rsquo;s context are three. Linux package signing: RPM (RHEL, Fedora) and DEB (Debian, Ubuntu) packages are signed with the distribution\u0026rsquo;s OpenPGP key; dnf and apt verify these signatures against the distribution\u0026rsquo;s public key (distributed in /etc/pki/rpm-gpg/ or via apt-key) before installing any package — GPG is the trust anchor for the entire package supply chain on Linux. Git signing: git commit --gpg-sign and git tag --sign embed OpenPGP or SSH signatures in Git objects; GitHub, GitLab, and Forgejo display verified badges for commits signed with a key registered to the author\u0026rsquo;s account, and tools like gitsign (from Sigstore) use ephemeral OIDC-bound certificates rather than long-lived OpenPGP keys for keyless Git signing. Email encryption: S/MIME and OpenPGP are the two competing email encryption standards; OpenPGP via Thunderbird/Enigmail or native Thunderbird 78+ support provides end-to-end encrypted email without a CA, though the Web of Trust\u0026rsquo;s usability barriers have limited adoption. The PQC transition is partially addressed in RFC 9580: the standard adds support for ML-KEM-768 and ML-DSA-65 (alongside the existing Ed25519/X25519 support) as OpenPGP algorithm identifiers, and GnuPG 2.5.x development branch implements these. The transition path is adding a PQC encryption subkey and a PQC signing subkey to existing OpenPGP keys — compatible with existing key management infrastructure — while retaining the classical subkeys for interoperability with verifiers that have not yet updated.\n","externalUrl":null,"permalink":"/en/security/gpg/","section":"Index","summary":"OpenPGP is an open standard for encryption and digital signatures of arbitrary data, defined in RFC 4880 (2007) and substantially revised in RFC 9580 (2024, adding Ed25519, X25519, and modern AEAD encryption). GnuPG (GPG) is the dominant open-source implementation, maintained by Werner Koch and the GnuPG project, and the tool most users interact with. OpenPGP predates the PKI/CA model and takes a fundamentally different approach to trust: rather than a hierarchy of certificate authorities that users must trust transitively, OpenPGP uses a Web of Trust in which individual users sign each other’s public keys, and trust is established through chains of personal endorsements. In the Web of Trust model, Alice trusts Bob’s key because she verified it in person and signed it; Carol trusts Bob’s key because Alice (whom Carol trusts) signed it. This decentralised, peer-to-peer trust model made sense for email encryption between individuals who could meet at key-signing parties, but does not scale to automated infrastructure verification, which is why OpenPGP’s role in modern infrastructure is primarily supply chain signing — package repositories, Git commits, and release artifacts — rather than interactive authentication.\n","title":"OpenPGP / GPG","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/openshift/","section":"Tags","summary":"","title":"Openshift","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/openshift-ai/","section":"Tags","summary":"","title":"Openshift-Ai","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/openssf/","section":"Tags","summary":"","title":"Openssf","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/openssl/","section":"Tags","summary":"","title":"Openssl","type":"tags"},{"content":"OpenSSL is an open-source cryptographic library and command-line toolkit, originally derived from SSLeay in 1998 and now governed by the OpenSSL Software Foundation under an Apache 2.0 licence (since version 3.0). It is the default cryptographic substrate for the majority of Linux server software: Apache httpd, nginx, curl, wget, PostgreSQL, MySQL, Postfix, OpenLDAP, and hundreds of other projects link against libssl and libcrypto by default. It implements TLS (all versions from 1.2 through 1.3), X.509 certificate parsing and validation, PKI operations (CSR generation, certificate signing, CRL and OCSP processing), and the full range of cryptographic primitives — symmetric ciphers (AES-GCM, ChaCha20-Poly1305), hash functions (SHA-2, SHA-3, SHAKE), RSA, ECC (ECDSA, ECDH, Ed25519, X25519), HMAC, HKDF, and key derivation functions. The library has two primary components: libcrypto, the algorithm library, and libssl, the TLS protocol layer built on top of it. The openssl command-line tool exposes both as a single swiss-army interface for certificate management, key generation, encryption, hashing, benchmarking, and protocol testing.\nOpenSSL\u0026rsquo;s versioning history is operationally important. Versions 0.9.x through 1.0.2 are end-of-life and contain known vulnerabilities including Heartbleed (CVE-2014-0160, 2014 — an out-of-bounds read in the TLS heartbeat extension that exposed up to 64 KB of server memory per request, including private keys, and triggered a global certificate revocation event). Version 1.1.1 reached end-of-life in September 2023; version 3.0 was the transition that restructured the library into a provider architecture — a plugin model where algorithm implementations are supplied by provider modules (the built-in default provider, the legacy provider for deprecated algorithms, and the fips provider). OpenSSL 3.x is the current supported branch, with 3.0 LTS (end-of-life 2026) and 3.4+ as the actively developed line. The FIPS provider for OpenSSL 3.x has received FIPS 140-3 validation, making OpenSSL 3.x+FIPS the production path for US federal and compliance-mandated deployments. OpenSSL 3.4 added initial support for ML-KEM (FIPS 203) and ML-DSA (FIPS 204) via the default provider, with SLH-DSA (FIPS 205) following in 3.5 — making OpenSSL 3.4+ the primary PQC migration path for the Linux ecosystem. The hybrid TLS 1.3 key exchange group X25519MLKEM768 is supported from OpenSSL 3.4, enabling the already-deployed Chrome interoperability without additional patching.\nThe openssl CLI is the universal screwdriver for certificate and key operations in the Linux ecosystem, and knowing its most operationally important commands is essential for anyone managing PKI or TLS infrastructure. openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -keyout key.pem -out csr.pem generates an ECDSA P-256 private key and CSR. openssl x509 -in cert.pem -noout -text decodes and displays a certificate\u0026rsquo;s full contents including SANs, validity, and extensions. openssl verify -CAfile ca-bundle.pem cert.pem validates a certificate chain against a trust store. openssl s_client -connect host:443 -showcerts opens a TLS connection and displays the full certificate chain presented by the server — the most reliable way to diagnose certificate chain issues in production. openssl pkeyutl -sign and openssl dgst handle signing and hashing from scripts. openssl speed benchmarks algorithm performance on the local hardware, producing reference numbers for algorithm selection decisions. For LUKS users, cryptsetup uses libgcrypt rather than OpenSSL, but the conceptual mapping of operations is the same. For cert-manager and Vault, OpenSSL\u0026rsquo;s algorithm support matrix defines what the underlying certificate operations can produce; the addition of ML-DSA to OpenSSL 3.4 is therefore the dependency that unblocks those tools\u0026rsquo; PQC certificate issuance. BoringSSL (Google\u0026rsquo;s fork) and LibreSSL (OpenBSD\u0026rsquo;s fork) provide API-compatible alternatives with narrower, more conservative algorithm sets; AWS-LC (Amazon\u0026rsquo;s fork of BoringSSL) adds FIPS 140-3 validation and ML-KEM/ML-DSA support and is the default in AWS SDK and Rust aws-lc-rs deployments.\n","externalUrl":null,"permalink":"/en/security/openssl/","section":"Index","summary":"OpenSSL is an open-source cryptographic library and command-line toolkit, originally derived from SSLeay in 1998 and now governed by the OpenSSL Software Foundation under an Apache 2.0 licence (since version 3.0). It is the default cryptographic substrate for the majority of Linux server software: Apache httpd, nginx, curl, wget, PostgreSQL, MySQL, Postfix, OpenLDAP, and hundreds of other projects link against libssl and libcrypto by default. It implements TLS (all versions from 1.2 through 1.3), X.509 certificate parsing and validation, PKI operations (CSR generation, certificate signing, CRL and OCSP processing), and the full range of cryptographic primitives — symmetric ciphers (AES-GCM, ChaCha20-Poly1305), hash functions (SHA-2, SHA-3, SHAKE), RSA, ECC (ECDSA, ECDH, Ed25519, X25519), HMAC, HKDF, and key derivation functions. The library has two primary components: libcrypto, the algorithm library, and libssl, the TLS protocol layer built on top of it. The openssl command-line tool exposes both as a single swiss-army interface for certificate management, key generation, encryption, hashing, benchmarking, and protocol testing.\n","title":"OpenSSL","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/operations/","section":"Tags","summary":"","title":"Operations","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/operator/","section":"Tags","summary":"","title":"Operator","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/optimization/","section":"Tags","summary":"","title":"Optimization","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/oran/","section":"Tags","summary":"","title":"Oran","type":"tags"},{"content":"ORAS (OCI Registry As Storage) is a CNCF project that treats an OCI-conformant registry not as a container image store but as a general-purpose content-addressable storage system for any kind of artifact. Its central insight is that the OCI Distribution and Image specifications are already a well-understood, widely-deployed, access-controlled, geo-replicated, content-addressed storage substrate — and that the ecosystem does not need a separate storage solution for every new artifact type (Helm charts, WebAssembly modules, ML models, firmware images, OPA policies, SBOMs, attestations) when the same registry infrastructure can store all of them, using the same authentication, the same tooling, and the same pull-by-digest semantics that container images already use.\nThe mechanics of storing an artifact in an OCI registry with ORAS follow the OCI Image Specification directly. ORAS packages files as a manifest plus one or more layer blobs; the manifest carries an artifactType field (a media type string) to identify what kind of artifact it is, and a config blob typed as application/vnd.oci.empty.v1+json if no separate config is needed. The content-addressed digest of the manifest is then the artifact\u0026rsquo;s permanent, immutable identifier — pull it by digest anywhere and you get exactly the bytes pushed. ORAS implements the full OCI Referrers API: when pushing an artifact that annotates an existing image (a signature, an SBOM, a provenance attestation), ORAS sets the manifest\u0026rsquo;s subject field to the image\u0026rsquo;s digest, and registries that support referrers index the relationship automatically. An oras discover command then queries that index, showing all artifacts associated with a given image without the caller needing to know their tags or digests in advance. For registries that predate the referrers API, ORAS falls back transparently to the tag-schema fallback defined in the distribution spec.\nORAS ships as three layers of tooling designed for different audiences. The oras CLI is a command-line client for humans and CI pipelines: oras push, oras pull, oras cp (registry-to-registry copy, including transitive referrers), oras discover, and oras manifest fetch. The oras-go library is the Go SDK consumed by projects integrating OCI artifact support into their own tooling — cosign, Notation, and several Kubernetes operators use it directly. Client libraries for .NET, Rust, and Python follow the same core SDK compliance matrix. The practical effect is that the supply chain graph that the OCI Referrers API makes possible — an image with attached signature, SBOM, and attestation, all discovered and verified in a single registry round-trip — is primarily constructed and consumed via ORAS primitives, whether or not the end user ever invokes the oras CLI directly.\n","externalUrl":null,"permalink":"/en/security/oras/","section":"Index","summary":"ORAS (OCI Registry As Storage) is a CNCF project that treats an OCI-conformant registry not as a container image store but as a general-purpose content-addressable storage system for any kind of artifact. Its central insight is that the OCI Distribution and Image specifications are already a well-understood, widely-deployed, access-controlled, geo-replicated, content-addressed storage substrate — and that the ecosystem does not need a separate storage solution for every new artifact type (Helm charts, WebAssembly modules, ML models, firmware images, OPA policies, SBOMs, attestations) when the same registry infrastructure can store all of them, using the same authentication, the same tooling, and the same pull-by-digest semantics that container images already use.\n","title":"ORAS (OCI Registry As Storage)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/orchestration/","section":"Tags","summary":"","title":"Orchestration","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/os/","section":"Tags","summary":"","title":"Os","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ostree/","section":"Tags","summary":"","title":"Ostree","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/pagedattention/","section":"Tags","summary":"","title":"Pagedattention","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/pam/","section":"Tags","summary":"","title":"Pam","type":"tags"},{"content":"Privileged Access Management (PAM) is the security discipline concerned with controlling, auditing, and minimising the use of privileged accounts: root access, domain administrator rights, cloud IAM roles with wide permissions, database superuser credentials, service account tokens, and any other identity that can cause systemic damage if misused. The threat PAM addresses is specific: an attacker who obtains a regular user credential can typically access that user\u0026rsquo;s data; an attacker who obtains a privileged credential can move laterally, disable security controls, exfiltrate everything, and deploy ransomware. PAM is therefore not a generalisation of identity and access management (IAM) but a specialisation of it — the same concepts of authentication and authorisation, applied with far higher friction to the accounts that most need it.\nThe operational core of a PAM system rests on four capabilities. Credential vaulting stores privileged passwords, SSH keys, and API tokens in an encrypted, access-controlled vault rather than in scripts, configuration files, or the heads of administrators; the vault issues the credential into a session on behalf of the user so the user never directly handles the raw secret, and rotates it automatically after use so that a recorded or stolen credential is immediately useless. Session management proxies every privileged connection through the PAM platform, enabling real-time monitoring, full session recording with timestamped keystroke logging, and live termination if a session behaves anomalously — creating an immutable forensic record of every privileged action taken. Just-in-time (JIT) access eliminates standing privileges: rather than an administrator having permanent root or admin rights, they request elevated access for a defined task window, the request triggers an approval workflow (or auto-approves based on policy), the elevated rights are provisioned for the duration, and they are automatically revoked when the window closes. This zero-standing-privilege model means a stolen credential for a privileged account has no inherent value outside an active, approved session. Privilege elevation and delegation extends this to individual commands on a host: rather than giving a user root access, a PAM agent on the target system allows only specific commands to run elevated, enforcing least privilege at the command level rather than the account level.\nPAM is distinct from, but deeply connected to, the other entries in this glossary. A bastion host is the traditional network-level implementation of a single, monitored ingress point for privileged access — PAM is the software layer that adds policy, vaulting, and recording to that model, and in modern deployments replaces the bastion with a PAM-brokered session that requires no network-level intermediary at all. Vault (HashiCorp) is a secrets management tool that a PAM system might consume to store credentials, but Vault does not itself record sessions, enforce JIT workflows, or provide the approval and governance model that PAM platforms do — the two are complementary. In a confidential computing context, Trustee plays a role analogous to PAM for machine identities inside TEEs: it gates secret release on attestation evidence rather than human approval, and represents the same zero-standing-privilege principle applied to automated workloads. A break-glass user is the access pattern that PAM explicitly must account for: the pre-defined emergency escape hatch that bypasses normal PAM controls when they are unavailable, and whose use must itself trigger the highest tier of alerting and post-incident review.\n","externalUrl":null,"permalink":"/en/security/pam/","section":"Index","summary":"Privileged Access Management (PAM) is the security discipline concerned with controlling, auditing, and minimising the use of privileged accounts: root access, domain administrator rights, cloud IAM roles with wide permissions, database superuser credentials, service account tokens, and any other identity that can cause systemic damage if misused. The threat PAM addresses is specific: an attacker who obtains a regular user credential can typically access that user’s data; an attacker who obtains a privileged credential can move laterally, disable security controls, exfiltrate everything, and deploy ransomware. PAM is therefore not a generalisation of identity and access management (IAM) but a specialisation of it — the same concepts of authentication and authorisation, applied with far higher friction to the accounts that most need it.\n","title":"PAM (Privileged Access Management)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/parallel-computing/","section":"Tags","summary":"","title":"Parallel-Computing","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/payment-cards/","section":"Tags","summary":"","title":"Payment-Cards","type":"tags"},{"content":"The Payment Card Industry Data Security Standard (PCI-DSS) is a global security standard developed and maintained by the PCI Security Standards Council (PCI SSC), which was founded in 2006 by the five major payment card brands (Visa, Mastercard, American Express, Discover, JCB). The current version is PCI-DSS v4.0.1 (published June 2024, with mandatory compliance required from 31 March 2025 for all new requirements). PCI-DSS is not government legislation but a contractual obligation — compliance is enforced through the agreements between merchants/service providers and their acquiring banks. Failure to comply results in fines (up to $100,000/month from card brands), increased transaction fees, and ultimately loss of the ability to process card payments. PCI-DSS applies to any organization worldwide that stores, processes, or transmits cardholder data (CHD) or sensitive authentication data (SAD), regardless of size or transaction volume. The standard defines 12 requirements organized in 6 control objectives: build and maintain secure networks (firewalls, secure configurations), protect cardholder data (encryption, key management), maintain a vulnerability management program (patching, anti-malware), implement strong access controls (least privilege, MFA, physical access), regularly monitor and test networks (logging, penetration testing), and maintain an information security policy. Compliance is validated through either a Qualified Security Assessor (QSA) on-site assessment (Level 1 merchants) or a Self-Assessment Questionnaire (SAQ) for smaller entities.\nRed Hat\u0026rsquo;s platform is deployed across financial institutions, payment processors, and e-commerce companies that must comply with PCI-DSS. Red Hat maps to PCI-DSS requirements across the entire stack. For Requirement 2 (secure configurations): RHEL ships CIS and DISA STIG hardening profiles that exceed PCI-DSS baseline expectations, and the Compliance Operator continuously validates OpenShift cluster configurations. For Requirements 3 \u0026amp; 4 (protect stored data, encrypt transmission): RHEL provides FIPS 140-3 validated cryptographic modules, LUKS disk encryption for data at rest, system-wide TLS policy enforcement, and OpenShift\u0026rsquo;s service mesh enables automatic mTLS between all microservices in a cardholder data environment (CDE). For Requirement 5 (vulnerability management): Red Hat\u0026rsquo;s predictive vulnerability analytics through Insights, CSAF/VEX feeds, and automated patching via Ansible reduce the time-to-remediate that PCI-DSS demands. For Requirement 6 (secure development): Red Hat Trusted Software Supply Chain provides signed images, SBOM transparency, and SLSA attestations — directly addressing PCI-DSS v4.0\u0026rsquo;s new supply chain requirements. For Requirements 7–8 (access control): OpenShift RBAC, network policies, namespace isolation, and integration with enterprise identity providers enforce least-privilege access and MFA. For Requirement 10 (logging and monitoring): RHEL auditd, OpenShift audit logging, and RHACS provide the one-year log retention and real-time alerting PCI-DSS requires. Red Hat publishes a PCI-DSS compliance guide mapping its product features to each of the 12 requirements.\nAdditional Information # PCI Security Standards Council PCI-DSS v4.0.1 - Official Red Hat PCI-DSS compliance ","externalUrl":null,"permalink":"/en/compliance/pci-dss/","section":"Index","summary":"The Payment Card Industry Data Security Standard (PCI-DSS) is a global security standard developed and maintained by the PCI Security Standards Council (PCI SSC), which was founded in 2006 by the five major payment card brands (Visa, Mastercard, American Express, Discover, JCB). The current version is PCI-DSS v4.0.1 (published June 2024, with mandatory compliance required from 31 March 2025 for all new requirements). PCI-DSS is not government legislation but a contractual obligation — compliance is enforced through the agreements between merchants/service providers and their acquiring banks. Failure to comply results in fines (up to $100,000/month from card brands), increased transaction fees, and ultimately loss of the ability to process card payments. PCI-DSS applies to any organization worldwide that stores, processes, or transmits cardholder data (CHD) or sensitive authentication data (SAD), regardless of size or transaction volume. The standard defines 12 requirements organized in 6 control objectives: build and maintain secure networks (firewalls, secure configurations), protect cardholder data (encryption, key management), maintain a vulnerability management program (patching, anti-malware), implement strong access controls (least privilege, MFA, physical access), regularly monitor and test networks (logging, penetration testing), and maintain an information security policy. Compliance is validated through either a Qualified Security Assessor (QSA) on-site assessment (Level 1 merchants) or a Self-Assessment Questionnaire (SAQ) for smaller entities.\n","title":"PCI-DSS","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/pci-ssc/","section":"Tags","summary":"","title":"Pci-Ssc","type":"tags"},{"content":"Peer Pods is the deployment model for CoCo (Confidential Containers) designed for public cloud environments where the Kubernetes worker nodes are standard VMs — not bare metal — and therefore cannot host a nested confidential VM for each pod. The fundamental constraint it solves is physical: confidential computing hardware (TDX, SEV-SNP) does not support nested virtualisation, meaning a confidential guest cannot be launched inside another VM. In the conventional CoCo deployment, the Kata Containers runtime asks a local hypervisor (QEMU/KVM) on the worker node to create a micro-VM for each pod; if the worker node is itself a VM, this requires nested virtualisation that the TEE hardware cannot provide. Peer Pods sidestep this entirely by moving the pod\u0026rsquo;s VM off the worker node and onto a separate, cloud-provisioned instance running directly on bare-metal TEE-capable hardware.\nThe mechanism is the Cloud API Adaptor (CAA), a daemonset running on each Kubernetes worker node that implements Kata Containers\u0026rsquo; remote hypervisor interface. When the Kata shim would normally call a local hypervisor to create a pod sandbox VM, it instead calls the CAA over a local socket. The CAA translates that request into a cloud provider API call — Azure VM API, AWS EC2, IBM Cloud, or others — to provision a new TEE-capable instance (a CVM) on the provider\u0026rsquo;s infrastructure. A network tunnel is then established between the worker node and the remote pod VM, through which the Kata agent inside the VM communicates with the Kata shim on the node as if the VM were local. From Kubernetes\u0026rsquo; perspective the pod behaves identically to any other Kata pod: the worker node schedules it, the kubelet manages its lifecycle, and standard kubectl tooling works unchanged. The pod VM itself, however, is a first-class CVM on the cloud provider\u0026rsquo;s physical TEE hardware — a genuine SEV-SNP guest or TDX Trust Domain, not a nested VM.\nThe attestation and secret delivery flow is the same as in conventional CoCo: the Attestation Agent inside the peer pod VM collects hardware evidence, presents it to Trustee (KBS/AS), and receives secrets only after the evidence validates. The key operational trade-off of peer pods is latency: each pod start requires a cloud API call to provision a new VM, which adds seconds compared to the milliseconds of a local VM launch. This makes peer pods better suited to longer-lived, latency-tolerant workloads — inference services, batch jobs, data processing pipelines — than to short-lived or highly burst-scheduled tasks. In exchange, peer pods allow CoCo to run on any managed Kubernetes service (AKS, GKE, ROSA, IKS) without any special worker node configuration, making confidential containers accessible to the vast majority of cloud Kubernetes users who have no access to bare-metal nodes.\nRelevant Red Hat blog posts # Red Hat OpenShift Sandboxed Containers peer pods technical deep dive (Feb 1, 2023) ","externalUrl":null,"permalink":"/en/security/peer-pods/","section":"Index","summary":"Peer Pods is the deployment model for CoCo (Confidential Containers) designed for public cloud environments where the Kubernetes worker nodes are standard VMs — not bare metal — and therefore cannot host a nested confidential VM for each pod. The fundamental constraint it solves is physical: confidential computing hardware (TDX, SEV-SNP) does not support nested virtualisation, meaning a confidential guest cannot be launched inside another VM. In the conventional CoCo deployment, the Kata Containers runtime asks a local hypervisor (QEMU/KVM) on the worker node to create a micro-VM for each pod; if the worker node is itself a VM, this requires nested virtualisation that the TEE hardware cannot provide. Peer Pods sidestep this entirely by moving the pod’s VM off the worker node and onto a separate, cloud-provisioned instance running directly on bare-metal TEE-capable hardware.\n","title":"Peer Pods","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/peft/","section":"Tags","summary":"","title":"Peft","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/performance/","section":"Tags","summary":"","title":"Performance","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/pki/","section":"Tags","summary":"","title":"Pki","type":"tags"},{"content":"Public Key Infrastructure (PKI) is the framework that makes asymmetric cryptography operationally useful at scale. Asymmetric cryptography provides a mathematical relationship between a public key and a private key, but by itself it cannot answer the question a relying party cares about: whose public key is this? PKI answers that question by introducing a trusted third party — the Certificate Authority (CA) — that cryptographically binds a public key to an identity (a hostname, an organisation name, an email address, a SPIFFE ID) by signing a certificate. A relying party that trusts the CA can therefore trust any certificate the CA signs, without needing to know the subject directly. The chain of trust extends recursively: a Root CA signs Intermediate CA certificates, which sign end-entity certificates (also called leaf certificates). Root CA private keys are kept offline in HSMs and used rarely; intermediate CAs handle day-to-day issuance and can be revoked without rotating the root. The set of root CA certificates a system trusts is its trust store — browsers and operating systems ship with a pre-populated trust store of publicly-trusted roots, while private PKIs use custom roots distributed by administrators.\nA PKI encompasses more than certificate issuance. Certificate revocation is the mechanism for marking a certificate invalid before its expiry — necessary when a private key is compromised, a subject\u0026rsquo;s identity changes, or a certificate is mis-issued. The two standard mechanisms are CRL (Certificate Revocation List), a periodically published signed list of revoked serial numbers fetched from a distribution point in the certificate, and OCSP (Online Certificate Status Protocol), a real-time query to a responder operated by the CA. Both have well-known operational weaknesses (CRL staleness, OCSP responder availability and privacy), which is why short certificate lifetimes — hours to days rather than years — have become the preferred mitigation in modern deployments: a certificate that expires tomorrow cannot be usefully revoked. Certificate lifecycle management covers the operational processes around issuance (CSR generation and validation), renewal (before expiry, automated where possible via ACME), and rotation (replacing a certificate and its associated key). Tools like Vault\u0026rsquo;s PKI engine, cert-manager on Kubernetes, and Let\u0026rsquo;s Encrypt automate these processes, eliminating the manual CSR/approval cycles that have historically caused outages from missed renewals.\nPKI appears throughout the infrastructure stack in this glossary at every point where cryptographic identity is needed. TLS uses PKI to authenticate servers (and in mTLS, clients) via X.509 certificates. Secure Boot relies on a PKI rooted in the UEFI firmware trust store to validate bootloader and kernel signatures. Code signing uses a PKI to bind a public key to a software publisher so that a package manager or OS can verify a binary\u0026rsquo;s provenance. SPIFFE/SPIRE implements a specialised PKI scoped to workload identities within a trust domain, issuing short-lived X.509-SVIDs from a SPIRE-operated CA. OCI image signing via cosign, and attestation distribution via the referrers API, rely on a PKI (Sigstore\u0026rsquo;s certificate transparency-backed one, or a private CA) to bind signatures to developer identities. The transition to PQC has direct implications for PKI: every CA key, every leaf certificate, and every signature in the chain that was generated under RSA or ECDSA is potentially HNDL-exposed, and migration requires standing up a parallel PQC CA hierarchy — ML-DSA root and intermediate CAs — and re-issuing the entire certificate population under quantum-safe signatures.\n","externalUrl":null,"permalink":"/en/security/pki/","section":"Index","summary":"Public Key Infrastructure (PKI) is the framework that makes asymmetric cryptography operationally useful at scale. Asymmetric cryptography provides a mathematical relationship between a public key and a private key, but by itself it cannot answer the question a relying party cares about: whose public key is this? PKI answers that question by introducing a trusted third party — the Certificate Authority (CA) — that cryptographically binds a public key to an identity (a hostname, an organisation name, an email address, a SPIFFE ID) by signing a certificate. A relying party that trusts the CA can therefore trust any certificate the CA signs, without needing to know the subject directly. The chain of trust extends recursively: a Root CA signs Intermediate CA certificates, which sign end-entity certificates (also called leaf certificates). Root CA private keys are kept offline in HSMs and used rarely; intermediate CAs handle day-to-day issuance and can be revoked without rotating the root. The set of root CA certificates a system trusts is its trust store — browsers and operating systems ship with a pre-populated trust store of publicly-trusted roots, while private PKIs use custom roots distributed by administrators.\n","title":"PKI (Public Key Infrastructure)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/policy/","section":"Tags","summary":"","title":"Policy","type":"tags"},{"content":"IEEE 802.1X is a standard for Port-Based Network Access Control (PNAC) that prevents any device from sending or receiving traffic on a network port until it has successfully authenticated. Originally designed for wired Ethernet and ratified in 2001, it now equally underpins enterprise Wi-Fi (WPA-Enterprise/WPA3-Enterprise), where access points act as the port gatekeeper. The core premise is that physical access to a port — plugging in a cable or being in range of an access point — does not grant network access. The port is logically divided into two channels: the uncontrolled port, which passes only EAP authentication traffic (EAPOL frames), and the controlled port, which is fully blocked until authentication succeeds. Only after the authentication server approves the device does the switch or access point open the controlled port and allow normal traffic. This port-level gate is what separates 802.1X from higher-layer authentication: a device that fails 802.1X receives no IP address, cannot reach any network resource, and cannot even attempt an attack at layer 3.\nThe authentication architecture has three roles. The supplicant is the device seeking network access — a laptop, phone, IoT sensor, or server NIC — and runs 802.1X client software (wpa_supplicant on Linux, native on Windows and macOS). It initiates authentication by sending an EAPOL-Start frame or responding to the authenticator\u0026rsquo;s EAP-Request/Identity challenge. The authenticator is the network device that enforces access — a switch port or wireless access point — that physically sits between the supplicant and the rest of the network. It speaks EAPOL toward the supplicant and proxies the EAP messages to the authentication server encapsulated in RADIUS packets. On Linux, the authenticator role is implemented by hostapd: the same daemon handles both Wi-Fi access point operation (beacon broadcast, association, WPA/WPA2/WPA3 key exchange) and 802.1X port authentication toward a RADIUS server, making it the software that turns a Linux machine with a wireless NIC or a wired bridge into a full 802.1X authenticator. hostapd is configured via /etc/hostapd/hostapd.conf, where ieee8021x=1 enables 802.1X, auth_server_addr and auth_server_shared_secret point it at the RADIUS server, and wpa=2 with wpa_key_mgmt=WPA-EAP enables WPA2-Enterprise on a wireless interface. The authentication server — almost universally a RADIUS server (FreeRADIUS, Cisco ISE, Aruba ClearPass, Microsoft NPS) — receives the EAP exchange, validates the supplicant\u0026rsquo;s identity and credentials, and returns an Access-Accept or Access-Reject. On Access-Accept it also returns RADIUS attributes that the authenticator enforces: the VLAN to assign (Tunnel-Private-Group-ID), a downloadable ACL (Filter-Id), a session timeout, and — for MACsec deployments — the Connectivity Association Key material derived from the EAP session. The EAP method used determines the strength of authentication: EAP-TLS provides mutual certificate-based authentication (client certificate validates to a CA the RADIUS server trusts, server certificate validates to a CA the supplicant trusts) and is the strongest method; EAP-PEAP and EAP-TTLS tunnel weaker inner methods (MSCHAPv2, password) inside a TLS tunnel to the RADIUS server; EAP-MD5 provides no server authentication and should not be used.\n802.1X is the network admission layer on which MACsec and zero-trust network access are built. When 802.1X authentication uses EAP-TLS, the TLS master secret is used to derive the CAK (Connectivity Association Key) that seeds MACsec\u0026rsquo;s MKA protocol, meaning that a successfully 802.1X-authenticated port automatically has a MACsec-encrypted channel established — authentication and encryption are a single unified operation. For cert-manager and SPIFFE/SPIRE users, 802.1X EAP-TLS is the network-admission analogue of mTLS at the transport layer: both rely on mutual X.509 certificate validation against a PKI, both gate access on identity rather than location, and both fit naturally into a posture where network admission requires a device certificate issued and rotated by the organisation\u0026rsquo;s CA. The break-glass consideration for 802.1X deployments is MAC Authentication Bypass (MAB): devices that cannot run a supplicant (printers, IP cameras, industrial controllers) authenticate using their MAC address, which the RADIUS server looks up in a device database. MAB is inherently weaker than EAP-TLS — MAC addresses are spoofable — and should be isolated to a restricted VLAN with firewall policy limiting what MAB-authenticated devices can reach. The PQC transition affects 802.1X through EAP-TLS: migrating to ML-DSA certificates in the RADIUS server and device PKI automatically propagates quantum-safe identity into every 802.1X-authenticated network admission decision.\n","externalUrl":null,"permalink":"/en/security/8021x/","section":"Index","summary":"IEEE 802.1X is a standard for Port-Based Network Access Control (PNAC) that prevents any device from sending or receiving traffic on a network port until it has successfully authenticated. Originally designed for wired Ethernet and ratified in 2001, it now equally underpins enterprise Wi-Fi (WPA-Enterprise/WPA3-Enterprise), where access points act as the port gatekeeper. The core premise is that physical access to a port — plugging in a cable or being in range of an access point — does not grant network access. The port is logically divided into two channels: the uncontrolled port, which passes only EAP authentication traffic (EAPOL frames), and the controlled port, which is fully blocked until authentication succeeds. Only after the authentication server approves the device does the switch or access point open the controlled port and allow normal traffic. This port-level gate is what separates 802.1X from higher-layer authentication: a device that fails 802.1X receives no IP address, cannot reach any network resource, and cannot even attempt an attack at layer 3.\n","title":"Port-based Network Access Control (IEEE 802.1X)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/pqc/","section":"Tags","summary":"","title":"Pqc","type":"tags"},{"content":"Post-Quantum Cryptography (PQC) is the set of cryptographic algorithms designed to resist attacks from a Cryptographically Relevant Quantum Computer (CRQC) — a quantum computer large and stable enough to run Shor\u0026rsquo;s algorithm at scale. Shor\u0026rsquo;s algorithm can solve the integer factorisation and discrete logarithm problems that underpin RSA, ECDSA, and ECDH in polynomial time, meaning that every asymmetric algorithm in wide use today — TLS key exchange, X.509 certificate signatures, SSH host keys, code signing, and encrypted email — becomes trivially breakable by a CRQC. Symmetric algorithms (AES, SHA-256) are substantially less affected: Grover\u0026rsquo;s algorithm provides only a quadratic speedup against them, which is mitigated by doubling key lengths (AES-256 remains appropriate). PQC replaces the asymmetric primitives only, on hard mathematical problems for which no efficient quantum algorithm is known: structured lattices (the Learning With Errors and Module-LWE problems), hash functions (the security of SHA-3 family variants), and error-correcting codes.\nThe urgency of PQC migration is not determined solely by the timeline to a CRQC. The operative threat is HNDL (Harvest Now, Decrypt Later): nation-state adversaries are intercepting and archiving encrypted traffic today, at scale, with the expectation of decrypting it retroactively once a CRQC becomes available. Expert estimates for CRQC arrival range from 2029 to 2040; intelligence assessments suggest state-level adversaries are targeting long-lived secrets now. Any data with a confidentiality requirement extending beyond the expected CRQC arrival window — long-lived signing keys, archived medical or financial records, government communications, code-signing infrastructure — is already within the active HNDL risk window regardless of when a quantum computer actually arrives. This is why NIST, CISA, NSA, and equivalent bodies globally are mandating migration timelines anchored to now rather than to Q-Day: the White House NSM-10 (2022) requires US federal agencies to prioritise PQC migration, NIST IR 8547 targets deprecation of RSA and ECC for new systems after 2030 and disallowance including legacy interoperability after 2035, and CNSA 2.0 specifies the highest-assurance parameter sets for national security systems.\nIn August 2024, NIST published the first three finalised PQC standards, concluding an eight-year evaluation process that began in 2016 with 82 candidate submissions. FIPS 203 specifies ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism, derived from CRYSTALS-Kyber) in three parameter sets (ML-KEM-512, -768, -1024) for key establishment — the quantum-safe replacement for ECDH and RSA key transport in TLS and similar protocols. FIPS 204 specifies ML-DSA (Module-Lattice-Based Digital Signature Algorithm, derived from CRYSTALS-Dilithium) in three parameter sets (ML-DSA-44, -65, -87) as the primary quantum-safe signature algorithm, intended to replace ECDSA and RSA signatures in X.509 certificates, code signing, and authentication protocols. FIPS 205 specifies SLH-DSA (Stateless Hash-Based Digital Signature Algorithm, derived from SPHINCS+) as a conservative alternative signature algorithm whose security relies only on hash function properties rather than lattice hardness assumptions, providing algorithm diversity should lattice security be undermined. The recommended migration pattern during the transition period is hybrid schemes — running ML-KEM alongside ECDH in the same TLS handshake so that the session key is secure against both classical and quantum attackers simultaneously — which is the approach already deployed by default in Chrome and available in OpenSSL 3.4+. The practical challenge for infrastructure is key and signature size: ML-KEM-768 public keys are 1,184 bytes versus 65 bytes for P-256, and ML-DSA-65 signatures are 3,309 bytes versus 64 bytes for ECDSA — large enough to affect TCP congestion windows and certificate chain transmission, making PQC migration a deployment engineering problem as much as a cryptographic one. In the context of this glossary, PQC bears directly on TPM attestation keys, Secure Boot signing certificates, LUKS key wrapping, HSM-protected signing infrastructure, and any TLS termination point — all carry long-lived key material that must be treated as HNDL-exposed if it was generated under classical algorithms and has not yet been rotated to PQC.\n","externalUrl":null,"permalink":"/en/security/pqc/","section":"Index","summary":"Post-Quantum Cryptography (PQC) is the set of cryptographic algorithms designed to resist attacks from a Cryptographically Relevant Quantum Computer (CRQC) — a quantum computer large and stable enough to run Shor’s algorithm at scale. Shor’s algorithm can solve the integer factorisation and discrete logarithm problems that underpin RSA, ECDSA, and ECDH in polynomial time, meaning that every asymmetric algorithm in wide use today — TLS key exchange, X.509 certificate signatures, SSH host keys, code signing, and encrypted email — becomes trivially breakable by a CRQC. Symmetric algorithms (AES, SHA-256) are substantially less affected: Grover’s algorithm provides only a quadratic speedup against them, which is mitigated by doubling key lengths (AES-256 remains appropriate). PQC replaces the asymmetric primitives only, on hard mathematical problems for which no efficient quantum algorithm is known: structured lattices (the Learning With Errors and Module-LWE problems), hash functions (the security of SHA-3 family variants), and error-correcting codes.\n","title":"PQC (Post-Quantum Cryptography)","type":"security"},{"content":"Prefill is the first stage of LLM inference after a user (or RAG pipeline) submits a prompt: the model runs a forward pass over all input tokens at once (or in chunked blocks for very long contexts) to compute hidden states and populate the KV cache for every layer. Its objective is to prepare context the model will attend to during generation; the user-visible metric is often time to first token (TTFT), which is dominated by prefill for long prompts. Prefill is compute-intensive (large matrix multiplies across the full sequence) compared with decode, which adds one token at a time. In chat, each new user message typically triggers a new prefill over the accumulated conversation (unless caching optimizations apply).\nArchitecturally, prefill uses GPU tensor cores heavily; the CPU tokenizes text and submits batches to vLLM or NIM. Long prompts (big RAG retrievals, large system instructions) inflate prefill FLOPs and VRAM for the KV cache linearly with sequence length. llm-d can route requests to replicas with overlapping prefix cache so prefill work is skipped or shortened. Disaggregated inference assigns prefill to dedicated “prefill workers” and ships KV tensors to decode workers over RDMA, because prefill and decode have different optimal hardware profiles. A CPU-only server cannot prefill a large LLM at production speed; prefill is why context length and batching matter as much as decode tuning.\nRed Hat addresses prefill sizing in OpenShift AI and llm-d reference architectures: GPU memory for prompt + cache, network bandwidth for disaggregated KV transfer, and SLO dashboards for TTFT. Guardrails and input filters run before or around prefill, adding latency that must be budgeted. On OpenShift, horizontal scale adds replicas; llm-d improves per-cluster efficiency via cache-aware routing rather than only adding GPUs. Operators benchmark prefill separately from decode when tuning vLLM batch limits and MIG profiles.\n","externalUrl":null,"permalink":"/en/ai/prefill/","section":"Index","summary":"Prefill is the first stage of LLM inference after a user (or RAG pipeline) submits a prompt: the model runs a forward pass over all input tokens at once (or in chunked blocks for very long contexts) to compute hidden states and populate the KV cache for every layer. Its objective is to prepare context the model will attend to during generation; the user-visible metric is often time to first token (TTFT), which is dominated by prefill for long prompts. Prefill is compute-intensive (large matrix multiplies across the full sequence) compared with decode, which adds one token at a time. In chat, each new user message typically triggers a new prefill over the accumulated conversation (unless caching optimizations apply).\n","title":"Prefill","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/prefill/","section":"Tags","summary":"","title":"Prefill","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/primitives/","section":"Tags","summary":"","title":"Primitives","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/privacy/","section":"Tags","summary":"","title":"Privacy","type":"tags"},{"content":"Private 5G (also non-public 5G, dedicated 5G, or campus/industrial 5G) denotes 3GPP-conformant 5G systems operated for a defined organisation or site — factory, port, mine, hospital, stadium, or utility — rather than as a nationwide public mobile service. 3GPP Release 16+ formalised Non-Public Networks (NPN) with two principal models: Standalone NPN (SNPN) — an isolated PLMN (dedicated MCC/MNC or PLMN ID) with its own 5GC and NG-RAN; and Public Network Integrated NPN (PNI-NPN) — a slice or dedicated DNN on a public operator’s 5G with contractual isolation. Private 5G delivers URLLC-capable connectivity, local breakout (traffic stays on-site via local UPF), deterministic QoS, and control over upgrades and security policies — advantages over Wi-Fi 6/7 in mobility, scheduling, and industrial TSN integration scenarios, at higher cost and regulatory complexity.\nSpectrum approaches vary by region: locally licensed bands (Germany 3.7–3.8 GHz campus licences, UK shared/local, Japan local 5G), CBRS in the United States (GAA general access and PAL priority licences in 3.5 GHz), or operator-leased spectrum with neutral host models. Architectures range from fully on-prem (mini 5GC, indoor/campus RAN, MEC) to hybrid (operator-hosted core, enterprise RAN) and as-a-service from CSPs, integrators, or hyperscalers. Key functions mirror public 5G — AMF/SMF/UPF, gNB/DU/CU, often simplified vendor stacks (Ericsson Industry Connect, Nokia NDAC, Celona, Federated Wireless, etc.) with OPC-UA / MQTT / TSN industrial integration.\nDriver Typical requirement Industry 4.0 AGV, robotics, machine vision, low latency Ports / logistics Wide area coverage, outdoor mobility Energy / utilities Remote monitoring, private WAN replacement Venues High density, temporary capacity Challenges include spectrum licensing, integration with IT/OT, device ecosystem (industrial 5G modules), operational skills, and roaming between private and public networks where needed. Private 5G is strongest where mission-critical wireless justifies dedicated infrastructure; many deployments pair it with edge computing and on-prem UPF for data sovereignty and latency.\nAdditional Information # 3GPP Non-Public Networks 5G-ACIA (Industry 4.0) FCC CBRS overview ","externalUrl":null,"permalink":"/en/telco/private-5g/","section":"Index","summary":"Private 5G (also non-public 5G, dedicated 5G, or campus/industrial 5G) denotes 3GPP-conformant 5G systems operated for a defined organisation or site — factory, port, mine, hospital, stadium, or utility — rather than as a nationwide public mobile service. 3GPP Release 16+ formalised Non-Public Networks (NPN) with two principal models: Standalone NPN (SNPN) — an isolated PLMN (dedicated MCC/MNC or PLMN ID) with its own 5GC and NG-RAN; and Public Network Integrated NPN (PNI-NPN) — a slice or dedicated DNN on a public operator’s 5G with contractual isolation. Private 5G delivers URLLC-capable connectivity, local breakout (traffic stays on-site via local UPF), deterministic QoS, and control over upgrades and security policies — advantages over Wi-Fi 6/7 in mobility, scheduling, and industrial TSN integration scenarios, at higher cost and regulatory complexity.\n","title":"Private 5G","type":"telco"},{"content":"","externalUrl":null,"permalink":"/en/tags/private-5g/","section":"Tags","summary":"","title":"Private-5g","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/production/","section":"Tags","summary":"","title":"Production","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/programming/","section":"Tags","summary":"","title":"Programming","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/protocol/","section":"Tags","summary":"","title":"Protocol","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/provenance/","section":"Tags","summary":"","title":"Provenance","type":"tags"},{"content":"Pod Security Admission (PSA) is the built-in Kubernetes admission controller that enforces the Pod Security Standards (PSS), a set of predefined security profiles that constrain what a pod is allowed to do. It became stable in Kubernetes 1.25, at which point its predecessor PodSecurityPolicy (PSP) was simultaneously removed. Where PSP was a complex, cluster-scoped object requiring deep RBAC wiring and prone to misconfiguration, PSA is deliberately simpler: it is always enabled, requires no CRDs or RBAC setup, and is configured entirely through namespace labels. The trade-off for that simplicity is that PSA is opinionated and coarse-grained — it enforces fixed profiles rather than arbitrary custom rules, and its granularity is the namespace rather than the individual workload or service account. Teams needing finer-grained policy beyond what PSA offers typically combine it with a policy engine such as Kyverno or OPA Gatekeeper.\nPSA enforces three fixed Pod Security Standards profiles, each a named set of controls over the pod spec. Privileged imposes no restrictions and is intended only for system-level infrastructure components that genuinely require full host access — CNI plugins, storage drivers, node agents. Baseline blocks the most commonly exploited privilege escalation vectors — privileged containers, hostNetwork/hostPID/hostIPC sharing, dangerous volume types, and certain capabilities — while remaining compatible with most applications that do not require special privileges. Restricted applies the full set of current pod hardening best practices on top of Baseline: non-root user required, root filesystem read-only encouraged, all capabilities dropped with only specific ones allowable, a seccomp profile mandatory. Each profile is versioned by Kubernetes minor release, allowing administrators to pin a namespace to the policy as it existed at a given version and prevent unexpected tightening during cluster upgrades. Enforcement is applied independently per namespace across three modes: enforce (pod is rejected), audit (violation is logged to the audit log but pod is admitted), and warn (a user-facing warning is returned but the pod is admitted). A namespace can combine modes and levels independently — the standard migration pattern is to set enforce=baseline, audit=restricted, warn=restricted, which blocks clear violations immediately while surfacing restricted-level gaps without breaking workloads.\nPSA operates as a pure validating admission controller — it inspects the pod spec and either admits or rejects it, but does not mutate the pod. This is the fundamental architectural difference from SCCs on OpenShift, which are both validating and mutating: an SCC can inject missing security context fields (a UID range, an SELinux label) into a pod that did not specify them, making the pod compliant without any change to the workload manifest. PSA will simply reject a non-compliant pod and return an error. Exemptions from PSA enforcement can be configured at the cluster level for specific usernames, namespace names, and RuntimeClasses — used to exclude infrastructure namespaces and privileged system components without labelling every individual namespace. On OpenShift, PSA and SCCs coexist with a label synchronisation component that automatically sets PSA namespace labels to match the effective privilege level of the SCCs bound to service accounts in that namespace, preventing conflicts between the two enforcement layers.\n","externalUrl":null,"permalink":"/en/security/psa/","section":"Index","summary":"Pod Security Admission (PSA) is the built-in Kubernetes admission controller that enforces the Pod Security Standards (PSS), a set of predefined security profiles that constrain what a pod is allowed to do. It became stable in Kubernetes 1.25, at which point its predecessor PodSecurityPolicy (PSP) was simultaneously removed. Where PSP was a complex, cluster-scoped object requiring deep RBAC wiring and prone to misconfiguration, PSA is deliberately simpler: it is always enabled, requires no CRDs or RBAC setup, and is configured entirely through namespace labels. The trade-off for that simplicity is that PSA is opinionated and coarse-grained — it enforces fixed profiles rather than arbitrary custom rules, and its granularity is the namespace rather than the individual workload or service account. Teams needing finer-grained policy beyond what PSA offers typically combine it with a policy engine such as Kyverno or OPA Gatekeeper.\n","title":"PSA (Pod Security Admission)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/ptp/","section":"Tags","summary":"","title":"Ptp","type":"tags"},{"content":"Precision Time Protocol (PTP), standardised as IEEE 1588, distributes a common reference time across packet networks so that distributed nodes share a clock with sub-microsecond to nanosecond accuracy — far beyond what NTP typically achieves over IP. PTP operates in a master–slave hierarchy: a Grandmaster Clock (GM) holds traceability to GNSS (GPS, Galileo, etc.) or a Primary Reference Time Clock (PRTC); Boundary Clocks (BC) terminate and regenerate timing on hops; Transparent Clocks (TC) correct residence time in switches without terminating the protocol. Messages (Sync, Follow_Up, Delay_Req/Resp, optional Announce) implement a delay request–response mechanism to estimate path asymmetry and offset each Ordinary Clock (OC) slave relative to the grandmaster.\nTelecom and mobile deployments use profiled subsets of IEEE 1588 for interoperability:\nProfile Typical use ITU-T G.8275.1 Full timing support from PRTC; often phase delivery in RAN/backhaul G.8275.2 Partial timing support; packet networks without full on-path support IEEE 802.1AS (gPTP) Time-sensitive networking (TSN) in Ethernet LANs SMPTE / AES67 Media and broadcast (related ecosystem) In 5G, synchronisation underpins TDD operation (aligned uplink/downlink slots across cells), carrier aggregation, CoMP, and O-RAN fronthaul (strict phase requirements between O-DU and O-RU, often Class C or better depending on split and band). SyncE (Synchronous Ethernet) frequently carries frequency on physical layer while PTP carries phase/time — combined SyncE + PTP architectures are common in operator transport. Holdover oscillators (OCXO, rubidium) maintain stability when GNSS or upstream reference fails.\nDesign and operations focus on asymmetry, packet loss, VLAN/QoS marking for timing traffic, BC/TC placement in switches (especially Cell Site Routers and fronthaul switches), and monitoring (TE, packet delay variation) per ITU-T G.827x series. Misconfiguration is a leading cause of interference, handover failures, and PRACH issues in TDD networks — making PTP as critical as routing for RAN engineers.\nAdditional Information # IEEE 1588 Standard ITU-T Timing and synchronization (G.827x) O-RAN Synchronization specifications ","externalUrl":null,"permalink":"/en/telco/ptp-precision-time-protocol/","section":"Index","summary":"Precision Time Protocol (PTP), standardised as IEEE 1588, distributes a common reference time across packet networks so that distributed nodes share a clock with sub-microsecond to nanosecond accuracy — far beyond what NTP typically achieves over IP. PTP operates in a master–slave hierarchy: a Grandmaster Clock (GM) holds traceability to GNSS (GPS, Galileo, etc.) or a Primary Reference Time Clock (PRTC); Boundary Clocks (BC) terminate and regenerate timing on hops; Transparent Clocks (TC) correct residence time in switches without terminating the protocol. Messages (Sync, Follow_Up, Delay_Req/Resp, optional Announce) implement a delay request–response mechanism to estimate path asymmetry and offset each Ordinary Clock (OC) slave relative to the grandmaster.\n","title":"PTP (Precision Time Protocol)","type":"telco"},{"content":"","externalUrl":null,"permalink":"/en/tags/public-sector/","section":"Tags","summary":"","title":"Public-Sector","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/pytorch/","section":"Tags","summary":"","title":"Pytorch","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/qemu/","section":"Tags","summary":"","title":"Qemu","type":"tags"},{"content":"Quantization is the process of representing a model’s weights and/or activations with fewer bits than full FP32 training precision—commonly FP16, BF16, FP8, INT8, or INT4 (GPTQ, AWQ, GGUF-style formats). The objective is lower GPU memory (larger models or more concurrent sessions per card), higher throughput, and sometimes faster kernels on hardware with native low-precision units, at the cost of possible quality degradation if pushed too aggressively. Quantization can be applied post-training (calibration on a sample dataset) or during training (quantization-aware training). For inference, serving engines vLLM and NIM load quantized checkpoints and dispatch to vendor libraries (TensorRT-LLM, CUTLASS, etc.) that implement fused low-precision matmuls.\nArchitecturally, quantization changes the memory/compute balance on the accelerator, not the role of the CPU. Weights shrink (e.g. 70B FP16 → much less VRAM with INT4), so models that could not fit on one GPU may serve without tensor parallel sharding; decode may become more compute-bound on tensor cores supporting FP8. A CPU fallback for INT4 LLMs is generally impractical at useful speeds. Different schemes matter: weight-only vs activation quantization, per-channel scales, and dynamic vs static scales affect accuracy on reasoning and code tasks. Quantized models are not interchangeable binaries—each format requires matching runtime support in CUDA/ROCm stacks and the serving engine.\nRed Hat documents quantized inference on OpenShift AI and RHEL GPU nodes: validated driver stacks, container images with vLLM or NVIDIA NIM, and capacity guidance (how many users per GPU at FP8 vs FP16). Red Hat does not define a proprietary quant format; customers use Hugging Face–published AWQ/GPTQ models or vendor NIMs with pre-quantized artifacts. Platform teams treat quantization as a release and test decision—benchmark perplexity and task accuracy after quant—within the same GitOps and model-promotion workflows as full-precision deployments.\n","externalUrl":null,"permalink":"/en/ai/quantization/","section":"Index","summary":"Quantization is the process of representing a model’s weights and/or activations with fewer bits than full FP32 training precision—commonly FP16, BF16, FP8, INT8, or INT4 (GPTQ, AWQ, GGUF-style formats). The objective is lower GPU memory (larger models or more concurrent sessions per card), higher throughput, and sometimes faster kernels on hardware with native low-precision units, at the cost of possible quality degradation if pushed too aggressively. Quantization can be applied post-training (calibration on a sample dataset) or during training (quantization-aware training). For inference, serving engines vLLM and NIM load quantized checkpoints and dispatch to vendor libraries (TensorRT-LLM, CUTLASS, etc.) that implement fused low-precision matmuls.\n","title":"Quantization","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/quantization/","section":"Tags","summary":"","title":"Quantization","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/radius/","section":"Tags","summary":"","title":"Radius","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/rag/","section":"Tags","summary":"","title":"Rag","type":"tags"},{"content":"RAG (retrieval-augmented generation) is an architecture pattern, not a single product: before the LLM generates an answer, a retriever finds relevant chunks from a knowledge base (wikis, tickets, PDFs, databases) and injects them into the prompt as context. The objective is grounded responses—fewer hallucinations on company facts, answers that reflect documents updated yesterday, and traceability to sources—without running full fine-tuning every time content changes. A typical pipeline embeds queries and documents with an embedding model, stores vectors in a search index, retrieves top-k passages, optionally reranks them, then calls the LLM with a system prompt plus retrieved text. RAG is the dominant enterprise pattern for private AI assistants and support bots.\nArchitecturally, RAG adds CPU and I/O work around GPU inference: embedding batches, index lookups, and prompt assembly happen on the host or separate services, while the LLM still runs on GPU with a longer prefill (large context from retrieved chunks). Repeated identical system prompts and document prefixes make prefix caching and KV-aware routing (llm-d, vLLM) valuable—many users ask different questions over the same knowledge base header. Compared with stuffing an entire corpus into context, RAG trades retrieval latency for bounded prompt size and lower cost. Poor chunking, stale indexes, or wrong embeddings fail at the retrieval layer even when the LLM is capable; ops concerns include PII in indexes, access control per tenant, and refresh pipelines when documents change.\nRed Hat supports RAG through OpenShift AI and partner ecosystems: GPU-backed inference for the generator, optional NIM embedding microservices, storage (Ceph, object stores) for corpora, and OpenShift for deploying vector databases and ingestion jobs. RHEL AI and InstructLab address model quality and alignment; RAG addresses knowledge freshness. Reference designs describe secure multi-tenant RAG (namespace isolation, OAuth/SSO, network policies) on OpenShift with RHEL GPU nodes. Operators combine open stacks (LangChain-style orchestration, open vector DBs) with Red Hat platform primitives rather than a single bundled “RAG appliance.”\nAdditional Information # What is retrieval-augmented generation? (Apr 15, 2026) ","externalUrl":null,"permalink":"/en/ai/rag/","section":"Index","summary":"RAG (retrieval-augmented generation) is an architecture pattern, not a single product: before the LLM generates an answer, a retriever finds relevant chunks from a knowledge base (wikis, tickets, PDFs, databases) and injects them into the prompt as context. The objective is grounded responses—fewer hallucinations on company facts, answers that reflect documents updated yesterday, and traceability to sources—without running full fine-tuning every time content changes. A typical pipeline embeds queries and documents with an embedding model, stores vectors in a search index, retrieves top-k passages, optionally reranks them, then calls the LLM with a system prompt plus retrieved text. RAG is the dominant enterprise pattern for private AI assistants and support bots.\n","title":"RAG (Retrieval-Augmented Generation)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/ran/","section":"Tags","summary":"","title":"Ran","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/rdma/","section":"Tags","summary":"","title":"Rdma","type":"tags"},{"content":"RDMA (Remote Direct Memory Access) allows a network adapter to transfer data between the memory of two machines with little CPU overhead, low latency, and often kernel bypass (userspace stacks such as verbs on InfiniBand or RoCE). Its objective in AI infrastructure is to keep GPUs fed and synchronized: distributed training exchanges gradients quickly, disaggregated inference (llm-d) moves KV cache blocks between prefill and decode nodes, and NVMe-oF storage delivers checkpoints without the host spending cycles copying every byte. DPUs and SmartNICs also use RDMA paths for storage and east-west traffic while the host CPU runs models.\nArchitecturally, RDMA differs from plain TCP on a CPU-centric socket API: queues and memory regions are registered in advance; the NIC performs DMA after a one-sided or two-sided operation is posted. InfiniBand is RDMA-native; RoCE (RDMA over Converged Ethernet) carries RDMA on lossless Ethernet with PFC/ECN tuning. Without lossless fabric or correct switch config, RoCE performance collapses. RDMA is not a substitute for NVLink inside a server (GPU–GPU) but extends similar “remote memory” semantics across the cluster. Security and ops require partitioning (PKeys, VPC isolation), monitoring of retransmits, and coordination with Kubernetes CNI/multus where RDMA devices are passed through to pods.\nRed Hat supports RDMA on RHEL and OpenShift through drivers (Mellanox/NVIDIA ConnectX, etc.), SR-IOV, device plugins, and telco/cloud networking docs that overlap AI clusters. OpenShift AI and llm-d reference designs assume RDMA-capable networks for prefill/decode disaggregation and large-scale training. DOCA on BlueField DPUs exposes RDMA for offload scenarios. Customers enable RDMA in the same supported RHEL kernel and firmware matrix as other high-performance networking, with Red Hat handling platform integration while hardware vendors document topology and cable plans.\n","externalUrl":null,"permalink":"/en/ai/rdma/","section":"Index","summary":"RDMA (Remote Direct Memory Access) allows a network adapter to transfer data between the memory of two machines with little CPU overhead, low latency, and often kernel bypass (userspace stacks such as verbs on InfiniBand or RoCE). Its objective in AI infrastructure is to keep GPUs fed and synchronized: distributed training exchanges gradients quickly, disaggregated inference (llm-d) moves KV cache blocks between prefill and decode nodes, and NVMe-oF storage delivers checkpoints without the host spending cycles copying every byte. DPUs and SmartNICs also use RDMA paths for storage and east-west traffic while the host CPU runs models.\n","title":"RDMA (Remote Direct Memory Access)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/registry/","section":"Tags","summary":"","title":"Registry","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/remote-access/","section":"Tags","summary":"","title":"Remote-Access","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/resources/","section":"Tags","summary":"","title":"Resources","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/retrieval/","section":"Tags","summary":"","title":"Retrieval","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/revocation/","section":"Tags","summary":"","title":"Revocation","type":"tags"},{"content":"RHCOS (Red Hat Enterprise Linux CoreOS) is the operating system that runs on every OpenShift control plane and worker node. It is not a general-purpose Linux distribution — it is a purpose-built, immutable, container-optimised OS designed to run exclusively as a managed node in an OpenShift cluster. Its security posture is architecturally different from a hardened RHEL installation: rather than hardening a mutable system through configuration management, RHCOS makes the OS layer structurally resistant to modification by design. The root filesystem\u0026rsquo;s /usr tree is read-only (enforced at mount time by rpm-ostree and, in recent versions, by composefs over the OSTree object store), /etc and /var are writable but managed exclusively by the Machine Config Operator (MCO), and no package manager is available at runtime for ad-hoc software installation. An operator who wants to change any node-level configuration — kernel arguments, sysctl settings, systemd units, certificates, kubelet configuration — creates a MachineConfig object in the OpenShift API; the MCO renders it into an Ignition config, applies it to the target MachineConfigPool (master, worker, or custom), and drains and reboots the affected nodes in a rolling fashion. Direct SSH access to nodes for configuration changes is explicitly unsupported and actively discouraged — oc debug node/\u0026lt;name\u0026gt; is the supported emergency access path, dropping into a privileged container on the node\u0026rsquo;s host namespaces under audit.\nProvisioning and first-boot security in RHCOS is handled by Ignition: a first-boot provisioning tool that runs in the initramfs before any systemd unit, reads a JSON configuration document (the Ignition config) delivered via userdata, kernel argument, or a URL, and applies an ordered set of filesystem operations, file writes, and systemd unit enablements before handing off to systemd. The Ignition config is the canonical bootstrap artifact — it configures network interfaces, writes SSH authorised keys, installs certificates, and optionally configures disk encryption before any user data is written. RHCOS disk encryption is not enabled by default and must be explicitly opted into via the diskEncryption stanza in the OpenShift install-config: tpm2 mode seals the LUKS2 volume key to the node\u0026rsquo;s TPM2 chip using a Clevis tpm2 pin (with PCR 7 for Secure Boot state), tang mode binds it to a Tang server using NBDE/Clevis, and combining both — with a Clevis SSS threshold-2 policy requiring both the TPM PCR measurement and Tang server reachability — is the recommended pattern for bare-metal deployments requiring the strongest protection. The cipher used is AES-256-XTS (or AES-256-CBC in FIPS mode). When encryption is configured, it is applied before the first systemd unit runs — all data written to the root disk from the very first journal entry onwards is encrypted, with no unencrypted window during installation. Secure Boot is supported and recommended on bare-metal: RHCOS ships a shim-signed EFI binary chain rooted in the Microsoft CA, with GRUB as the bootloader (RHCOS does not yet support UKI-based boot) measuring boot components into TPM PCRs via GRUB\u0026rsquo;s TPM module, enabling the TPM2 PCR 7 Clevis binding to reflect the Secure Boot policy state that was active when the disk was sealed.\nRuntime security controls in RHCOS are non-negotiable by design. SELinux is always enforcing — disabling it is explicitly unsupported, and a node with SELinux disabled must be re-provisioned rather than reconfigured before it can rejoin a production cluster. The targeted policy with MCS category separation confines every container process to a unique label pair and the sVirt model (via libvirt on KVM-backed nodes) extends this to VM processes. cgroups v2 is the default resource controller since OpenShift 4.14, enabling the QoS-based eviction and memory pressure handling that cgroupv2 provides. seccomp profiles are applied to containers by the container runtime (CRI-O, which replaced Docker in OpenShift 4.x) using the RuntimeDefault profile mandated by the PSA Restricted policy; SCCs provide the OpenShift-specific pod security layer on top of PSA, with the restricted-v2 SCC as the default for all authenticated users. The CRI-O container runtime implements only the features required by Kubernetes, deliberately excluding the broader feature surface of daemon-oriented container engines — reducing the attack surface compared to a general-purpose container runtime. FIPS 140-3 mode can be enabled cluster-wide at install time (fips: true in install-config.yaml); this switches the kernel and all cryptographic libraries to FIPS-approved algorithms (AES-256-CBC for LUKS, HMAC-SHA-256 for integrity, RSA-2048 minimum for TLS), and once enabled cannot be disabled without re-provisioning. The MCO manages day-2 security hardening through MachineConfig objects: kernel arguments (audit=1, slub_debug), sysctl settings via MachineConfig with kernel-devel extensions, custom SELinux policy modules via MachineConfig file drops into /etc/selinux/targeted/, and AIDE configuration — all applied uniformly across node pools through the same GitOps-friendly MachineConfig API, making RHCOS security posture reproducible, auditable, and version-controlled in the same repository as the workloads it runs.\n","externalUrl":null,"permalink":"/en/security/rhcos/","section":"Index","summary":"RHCOS (Red Hat Enterprise Linux CoreOS) is the operating system that runs on every OpenShift control plane and worker node. It is not a general-purpose Linux distribution — it is a purpose-built, immutable, container-optimised OS designed to run exclusively as a managed node in an OpenShift cluster. Its security posture is architecturally different from a hardened RHEL installation: rather than hardening a mutable system through configuration management, RHCOS makes the OS layer structurally resistant to modification by design. The root filesystem’s /usr tree is read-only (enforced at mount time by rpm-ostree and, in recent versions, by composefs over the OSTree object store), /etc and /var are writable but managed exclusively by the Machine Config Operator (MCO), and no package manager is available at runtime for ad-hoc software installation. An operator who wants to change any node-level configuration — kernel arguments, sysctl settings, systemd units, certificates, kubelet configuration — creates a MachineConfig object in the OpenShift API; the MCO renders it into an Ignition config, applies it to the target MachineConfigPool (master, worker, or custom), and drains and reboots the affected nodes in a rolling fashion. Direct SSH access to nodes for configuration changes is explicitly unsupported and actively discouraged — oc debug node/\u003cname\u003e is the supported emergency access path, dropping into a privileged container on the node’s host namespaces under audit.\n","title":"RHCOS (Red Hat Enterprise Linux CoreOS)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/rhel/","section":"Tags","summary":"","title":"Rhel","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/rhel-ai/","section":"Tags","summary":"","title":"Rhel-Ai","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/ric/","section":"Tags","summary":"","title":"Ric","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/roce/","section":"Tags","summary":"","title":"Roce","type":"tags"},{"content":"RoCE (RDMA over Converged Ethernet) implements RDMA semantics on Ethernet (RoCEv2 uses UDP/IP), so NICs can perform remote memory access with low CPU utilization over the same physical switches many enterprises already operate. Its objective is to deliver InfiniBand-like GPU communication economics—fast NCCL all-reduces, NVMe-oF, llm-d KV moves—without maintaining a separate InfiniBand fabric. RoCE requires lossless Ethernet behavior: Priority Flow Control (PFC), Explicit Congestion Notification (ECN), buffer tuning, and often dedicated traffic classes so RDMA traffic is not dropped under burst load.\nArchitecturally, RoCEv2 is routable L3 Ethernet; InfiniBand uses different link and subnet management. Misconfigured switches cause silent performance cliffs (retransmits, collapse to slow paths), so RoCE is as much a datacenter design choice as a NIC feature. Within a server, NVLink still handles GPU peer traffic; RoCE links nodes. The CPU role matches other RDMA: setup and orchestration, not per-byte copying. AI workloads do not distinguish RoCE vs IB at the PyTorch API—NCCL selects transports based on environment and hardware—but ops teams must qualify firmware, cable, and QoS end to end.\nRed Hat documents RoCE on RHEL (ConnectX drivers, rdma-core, tuning guides) and OpenShift networking for accelerated workloads, overlapping telco core and AI cluster designs. Customers who standardize on Ethernet for cost and operations use RoCE for GPU scale-out while running OpenShift AI or bare-metal training clusters on supported RHEL. Red Hat support focuses on kernel, driver, and platform integration; switch QoS profiles remain a joint validation exercise with network vendors.\n","externalUrl":null,"permalink":"/en/ai/roce/","section":"Index","summary":"RoCE (RDMA over Converged Ethernet) implements RDMA semantics on Ethernet (RoCEv2 uses UDP/IP), so NICs can perform remote memory access with low CPU utilization over the same physical switches many enterprises already operate. Its objective is to deliver InfiniBand-like GPU communication economics—fast NCCL all-reduces, NVMe-oF, llm-d KV moves—without maintaining a separate InfiniBand fabric. RoCE requires lossless Ethernet behavior: Priority Flow Control (PFC), Explicit Congestion Notification (ECN), buffer tuning, and often dedicated traffic classes so RDMA traffic is not dropped under burst load.\n","title":"RoCE (RDMA over Converged Ethernet)","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/rocm/","section":"Tags","summary":"","title":"Rocm","type":"tags"},{"content":"ROCm (Radeon Open Compute) is AMD’s software stack for GPU compute on datacenter Instinct accelerators (and select consumer GPUs in community setups). Its objective mirrors CUDA for NVIDIA: provide kernel compilers (HIP), math libraries (rocBLAS, rocFFT), collective communication (RCCL, analogous to NCCL), and framework integrations so PyTorch and inference runtimes can execute training and inference on AMD hardware. ROCm is positioned as an open platform (Linux-first) for customers who want accelerator choice or who standardize on AMD in HPC and AI clusters.\nArchitecturally, HIP source can be written portably from CUDA in many projects; at runtime ROCm talks to the AMD GPU driver on RHEL, mapping work to compute units and HBM like CUDA maps to NVIDIA SMs. The CPU still orchestrates launches, dataloader pipelines, and Kubernetes control planes. Not every NVIDIA-optimized kernel or NIM container has a ROCm equivalent—ecosystem gaps appear in cutting-edge LLM kernels, though vLLM and others expand AMD support over time. Multi-GPU jobs use RCCL over InfiniBand/RoCE like NCCL. ROCm does not change LLM fundamentals (KV cache, batching); it is the execution layer beneath the framework.\nRed Hat supports ROCm on Red Hat Enterprise Linux for validated AMD Instinct configurations, and documents AI workloads on RHEL alongside NVIDIA paths. OpenShift AI and GPU operator ecosystems increasingly include AMD device plugins where customers deploy heterogeneous or AMD-only clusters. Red Hat’s value is supported Linux (kABI, SELinux, subscription), Kubernetes scheduling, and reference architectures—not shipping ROCm itself (AMD does). Teams choose ROCm when hardware procurement favors AMD; they choose CUDA/NIM when maximum LLM serving maturity on NVIDIA is required.\n","externalUrl":null,"permalink":"/en/ai/rocm/","section":"Index","summary":"ROCm (Radeon Open Compute) is AMD’s software stack for GPU compute on datacenter Instinct accelerators (and select consumer GPUs in community setups). Its objective mirrors CUDA for NVIDIA: provide kernel compilers (HIP), math libraries (rocBLAS, rocFFT), collective communication (RCCL, analogous to NCCL), and framework integrations so PyTorch and inference runtimes can execute training and inference on AMD hardware. ROCm is positioned as an open platform (Linux-first) for customers who want accelerator choice or who standardize on AMD in HPC and AI clusters.\n","title":"ROCm (Radeon Open Compute)","type":"ai"},{"content":"RSA (Rivest–Shamir–Adleman), published in 1977, was the first widely adopted public-key cryptosystem and for decades the most deployed asymmetric algorithm in existence. Its security rests on the integer factorisation problem: given a public modulus n = p × q (the product of two large primes), recovering p and q is computationally infeasible on classical computers for sufficiently large n. The public key is the pair (n, e) and the private key is (n, d), where e and d are related by the modular arithmetic of Euler\u0026rsquo;s totient function. RSA enables two operations: encryption (the sender uses the public key to encrypt a message that only the private key holder can decrypt) and signing (the private key holder produces a signature that anyone with the public key can verify). In practice, RSA encryption is used almost exclusively for key encapsulation — encrypting a randomly generated symmetric key — rather than encrypting arbitrary data directly, both because RSA is slow and because direct RSA encryption of large messages requires padding schemes that are historically error-prone.\nRSA\u0026rsquo;s operational security is entirely determined by key size. A 512-bit RSA key was broken in 1999; 768-bit in 2009; 1024-bit is considered insecure and deprecated; 2048-bit is the current minimum considered safe against classical attacks, and 3072-bit or 4096-bit is recommended for new keys with long lifetime requirements. The dominant padding schemes are OAEP (Optimal Asymmetric Encryption Padding) for encryption and PSS (Probabilistic Signature Scheme) for signatures — both specified in PKCS#1 v2.2 (RFC 8017). The older PKCS#1 v1.5 padding remains in wide deployment for historical reasons but carries known vulnerabilities (Bleichenbacher\u0026rsquo;s 1998 padding oracle attack against RSA encryption, and related attacks against TLS 1.2 RSA key exchange that necessitated the RFC 7568 deprecation of those cipher suites). RSA private key operations are computationally expensive: a 2048-bit RSA signature requires roughly 1000× more CPU than an equivalent ECDSA operation at the same security level, which is why ECC-based algorithms have largely displaced RSA for new deployments in TLS and SSH.\nRSA is the primary target of PQC migration. Shor\u0026rsquo;s algorithm running on a CRQC solves integer factorisation in polynomial time, meaning all RSA keys — at any size — become trivially breakable. NIST IR 8547 designates RSA for deprecation in new systems after 2030 and full disallowance after 2035. The HNDL (Harvest Now, Decrypt Later) threat is particularly acute for RSA key encapsulation: TLS sessions using RSA key exchange recorded today can be retroactively decrypted once a CRQC exists. TLS 1.3 mitigated part of this by removing RSA key exchange entirely (all TLS 1.3 sessions use ephemeral Diffie-Hellman, providing forward secrecy), but RSA signatures on X.509 certificates remain in the chain of every HTTPS connection. The replacement for RSA key encapsulation is ML-KEM; the replacement for RSA signatures is ML-DSA (primary) or SLH-DSA (hash-based conservative alternative). HSMs protecting RSA signing keys must be re-keyed with ML-DSA keys and re-certified under the new algorithm before the deprecation deadlines.\n","externalUrl":null,"permalink":"/en/security/rsa/","section":"Index","summary":"RSA (Rivest–Shamir–Adleman), published in 1977, was the first widely adopted public-key cryptosystem and for decades the most deployed asymmetric algorithm in existence. Its security rests on the integer factorisation problem: given a public modulus n = p × q (the product of two large primes), recovering p and q is computationally infeasible on classical computers for sufficiently large n. The public key is the pair (n, e) and the private key is (n, d), where e and d are related by the modular arithmetic of Euler’s totient function. RSA enables two operations: encryption (the sender uses the public key to encrypt a message that only the private key holder can decrypt) and signing (the private key holder produces a signature that anyone with the public key can verify). In practice, RSA encryption is used almost exclusively for key encapsulation — encrypting a randomly generated symmetric key — rather than encrypting arbitrary data directly, both because RSA is slow and because direct RSA encryption of large messages requires padding schemes that are historically error-prone.\n","title":"RSA (Rivest–Shamir–Adleman)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/runtime/","section":"Tags","summary":"","title":"Runtime","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/safety/","section":"Tags","summary":"","title":"Safety","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/sbom/","section":"Tags","summary":"","title":"Sbom","type":"tags"},{"content":"A Software Bill of Materials (SBOM) is a structured, machine-readable list of the components that make up a software artifact: open-source libraries, proprietary packages, operating system packages, programming language dependencies, and the transitive dependencies of all of the above. It is the software analogue of the ingredient list on packaged food — the thing that tells a consumer (or an automated system) precisely what is inside. The term and concept predate current security mandates but became a regulatory requirement in the US through Executive Order 14028 (May 2021), which directed NIST and NTIA to define minimum SBOM elements for software sold to the federal government. The NTIA\u0026rsquo;s resulting guidance specifies seven minimum data fields per component: supplier name, component name, version, component identifier (CPE or PURL), dependency relationships, SBOM author, and timestamp. The practical use cases SBOMs enable are vulnerability management (correlating component versions against CVE databases to identify affected software), licence compliance (detecting GPL or other licence obligations across the dependency graph), and incident response (determining within minutes which systems in a fleet contain a newly-disclosed vulnerable component, as organisations that had SBOMs could do during the Log4Shell response and those without could not).\nTwo formats dominate production use. SPDX (Software Package Data Exchange, ISO/IEC 5962:2021) originated at the Linux Foundation, focuses on licence expression and is the format most commonly produced by build tooling such as Syft, Trivy, and the Go and Java build ecosystems. CycloneDX (OWASP) takes a broader \u0026ldquo;bill of materials\u0026rdquo; framing, supports not just software components but services, hardware, and firmware, and has stronger native support for vulnerability data including embedded VEX statements and CycloneDX\u0026rsquo;s own Vulnerability Disclosure Report (VDR) format. Both formats support JSON, XML, and — in SPDX\u0026rsquo;s case — tag-value text. A third format, SWID tags (ISO/IEC 19770-2), is used primarily in firmware and enterprise software asset management contexts but sees limited use in cloud-native supply chains. The two primary formats are not automatically interoperable; tools such as CycloneDX\u0026rsquo;s cdxgen and anchore\u0026rsquo;s syft can produce either, and CISA\u0026rsquo;s SBOM sharing guidance recommends accepting both at ingestion boundaries. Component identity across formats is best addressed through PURLs (Package URLs, pkg:type/namespace/name@version), a format-neutral scheme for uniquely identifying a package across ecosystems that both SPDX and CycloneDX support.\nSBOMs are most valuable when they travel with the artifact they describe and when they are verifiable. In the OCI ecosystem, SBOMs are attached to container images as OCI referrers — pushed to the same registry as the image they document, linked via the subject field, and discoverable via the referrers API with artifactType: application/spdx+json or application/vnd.cyclonedx+json. Tools such as ORAS and cosign handle the attachment and retrieval. Signing an SBOM (via cosign or Notation) with a key rooted in a PKI or Sigstore\u0026rsquo;s certificate transparency log binds the SBOM to a verified identity and makes tampering detectable. For bootc and image-based Linux systems, an OS-level SBOM attached to the OCI OS image as a referrer allows operators and automated compliance systems to know the exact package versions in a deployed OS image, query them against vulnerability databases, and verify the SBOM has not been substituted — forming the foundation of a software supply chain that is both transparent and attested. SBOM generation is increasingly automated: Tekton and GitHub Actions pipelines produce SBOMs as a build step, rpm --query --provides and dpkg-query extract OS package lists, and language-ecosystem tools like cyclonedx-gomod and syft walk dependency graphs at build time.\nRelevant Red Hat blog posts # How the contextual SBOM pattern improves vulnerability management (Feb 17, 2026) ","externalUrl":null,"permalink":"/en/security/sbom/","section":"Index","summary":"A Software Bill of Materials (SBOM) is a structured, machine-readable list of the components that make up a software artifact: open-source libraries, proprietary packages, operating system packages, programming language dependencies, and the transitive dependencies of all of the above. It is the software analogue of the ingredient list on packaged food — the thing that tells a consumer (or an automated system) precisely what is inside. The term and concept predate current security mandates but became a regulatory requirement in the US through Executive Order 14028 (May 2021), which directed NIST and NTIA to define minimum SBOM elements for software sold to the federal government. The NTIA’s resulting guidance specifies seven minimum data fields per component: supplier name, component name, version, component identifier (CPE or PURL), dependency relationships, SBOM author, and timestamp. The practical use cases SBOMs enable are vulnerability management (correlating component versions against CVE databases to identify affected software), licence compliance (detecting GPL or other licence obligations across the dependency graph), and incident response (determining within minutes which systems in a fleet contain a newly-disclosed vulnerable component, as organisations that had SBOMs could do during the Log4Shell response and those without could not).\n","title":"SBOM (Software Bill of Materials)","type":"security"},{"content":"Security Context Constraints (SCCs) are OpenShift\u0026rsquo;s mechanism for controlling and enforcing the security posture of pods at admission time. They predate and are more expressive than Kubernetes PSA: where PSA validates a pod spec against a fixed profile and either admits or rejects it, an SCC acts as both a validator and a mutator — it can inject missing fields into the pod spec (a UID from the namespace\u0026rsquo;s allocated range, an SELinux context, capability drops) so that a pod that did not specify its full security context in its manifest is brought into compliance automatically rather than rejected. SCCs are cluster-scoped resources, and access to them is controlled via RBAC: a service account must be granted use of an SCC through a Role or ClusterRole binding before pods running under that service account can be admitted with the permissions that SCC grants.\nAn SCC is a declarative object that specifies allowed, required, and default values across a comprehensive set of security dimensions. Linux capabilities are controlled through three fields: allowedCapabilities (the ceiling of what a container may request), defaultAddCapabilities (injected into every pod using this SCC), and requiredDropCapabilities (always removed, regardless of what the container requests — restricted-v2 sets this to ALL). User identity is controlled by runAsUser strategy: MustRunAsRange constrains the pod to a UID within the namespace\u0026rsquo;s pre-allocated range (the default for the restricted-v2 SCC), MustRunAsNonRoot requires a non-zero UID without constraining which one, and RunAsAny imposes no constraint. SELinux context is similarly governed by strategy: MustRunAs requires and enforces a specific label; RunAsAny allows any. Additional axes include allowPrivilegedContainer, allowHostNetwork/allowHostPID/allowHostIPC, allowedVolumes (an enumeration of permitted volume plugin types), fsGroup strategy, seccompProfiles, and readOnlyRootFilesystem. OpenShift ships a set of built-in SCCs ordered by restrictiveness — restricted-v2 (default for all authenticated users since OCP 4.11, drops all capabilities), restricted, nonroot-v2, anyuid, hostaccess, hostmount-anyuid, node-exporter, and privileged — which should not be modified, with custom SCCs created for workloads needing specific grants.\nThe admission algorithm is the operationally critical part. When a pod is submitted, the SCC admission plugin collects all SCCs accessible to the pod\u0026rsquo;s service account (via RBAC), sorts them by priority (a numeric field, higher wins; anyuid has priority 10 by default), and then iterates through the sorted list to find the most restrictive SCC that the pod can satisfy — not necessarily the first one. If an SCC can admit the pod only by mutating its spec (injecting the UID or SELinux label), it does so; the admitted pod is annotated with openshift.io/scc: \u0026lt;name\u0026gt; identifying which SCC was applied. If no SCC in the list can accommodate the pod, admission is rejected with an error detailing which constraints failed. This selection model means that granting a service account access to a permissive SCC like anyuid does not unconditionally use it — if the pod is compatible with restricted-v2, that more restrictive SCC wins. On OCP 4.11 and later, OpenShift also runs a PSA label synchronisation controller alongside SCCs: it inspects the effective SCC privilege level of each namespace\u0026rsquo;s service accounts and automatically sets the corresponding PSA namespace labels, ensuring that PSA enforcement does not conflict with what SCCs already permit — PSA and SCCs are complementary layers on OpenShift, not competing ones.\n","externalUrl":null,"permalink":"/en/security/scc/","section":"Index","summary":"Security Context Constraints (SCCs) are OpenShift’s mechanism for controlling and enforcing the security posture of pods at admission time. They predate and are more expressive than Kubernetes PSA: where PSA validates a pod spec against a fixed profile and either admits or rejects it, an SCC acts as both a validator and a mutator — it can inject missing fields into the pod spec (a UID from the namespace’s allocated range, an SELinux context, capability drops) so that a pod that did not specify its full security context in its manifest is brought into compliance automatically rather than rejected. SCCs are cluster-scoped resources, and access to them is controlled via RBAC: a service account must be granted use of an SCC through a Role or ClusterRole binding before pods running under that service account can be admitted with the permissions that SCC grants.\n","title":"SCC (Security Context Constraints)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/sdk/","section":"Tags","summary":"","title":"Sdk","type":"tags"},{"content":"Sealed Secrets is a Kubernetes controller and companion CLI tool (kubeseal) created by Bitnami that solves a specific GitOps problem: how to store Kubernetes Secret manifests in a Git repository without exposing their contents. A standard Kubernetes Secret is base64-encoded, not encrypted — anyone who can read the manifest file or the Git history can decode the values instantly. Sealed Secrets resolves this by encrypting the secret values using asymmetric cryptography before they ever leave the developer\u0026rsquo;s machine, producing a SealedSecret custom resource that contains only ciphertext and is safe to commit to any repository, public or private. The corresponding plaintext Secret is materialised exclusively inside the cluster by the controller, which holds the only private key capable of decryption.\nThe mechanics follow a strict one-way trust model. On installation, the Sealed Secrets controller generates an RSA key pair and stores the private key as a Kubernetes Secret inside the cluster. Developers retrieve the public key via kubeseal --fetch-cert and use it to encrypt a standard Secret manifest locally: kubeseal encrypts each value individually using the public key, embeds the cluster and namespace identity as associated data in the ciphertext (so a SealedSecret created for one namespace cannot be decrypted and applied to another, and a SealedSecret from one cluster cannot be decrypted by a different cluster\u0026rsquo;s controller), and outputs a SealedSecret YAML manifest. That manifest is committed to Git and applied to the cluster through the normal GitOps pipeline (Argo CD, Flux). When the controller detects a new or updated SealedSecret, it decrypts the values using its private key and creates or updates a standard Kubernetes Secret object in the specified namespace. From that point, pods consume the Secret in the normal way with no awareness of the Sealed Secrets layer. Key rotation is handled by the controller generating a new key pair periodically (defaulting to every 30 days); old keys are retained for decrypting existing SealedSecrets and new sealings use the latest key.\nSealed Secrets occupies a different architectural niche from ESO and the Secrets Store CSI Driver: it has no dependency on an external secret backend at runtime, making it operationally simpler — there is no Vault, no AWS Secrets Manager, no external service to be available for a pod to start. The entire system is self-contained within the cluster. The trade-off is that secret values live in the Git repository (encrypted) and in etcd (as a native Secret), rather than in a purpose-built secret store with rotation, leasing, and audit capabilities; Sealed Secrets provides no rotation lifecycle, no dynamic credentials, and no centralised audit trail beyond the Kubernetes API server\u0026rsquo;s own audit log. It is the right choice for teams adopting GitOps who want a simple, infrastructure-light path to committing secrets safely, and the wrong choice for teams who need credential rotation, short-lived secrets, or cross-cluster secret management — scenarios better served by ESO backed by Vault or a cloud secret manager.\n","externalUrl":null,"permalink":"/en/security/sealed-secrets/","section":"Index","summary":"Sealed Secrets is a Kubernetes controller and companion CLI tool (kubeseal) created by Bitnami that solves a specific GitOps problem: how to store Kubernetes Secret manifests in a Git repository without exposing their contents. A standard Kubernetes Secret is base64-encoded, not encrypted — anyone who can read the manifest file or the Git history can decode the values instantly. Sealed Secrets resolves this by encrypting the secret values using asymmetric cryptography before they ever leave the developer’s machine, producing a SealedSecret custom resource that contains only ciphertext and is safe to commit to any repository, public or private. The corresponding plaintext Secret is materialised exclusively inside the cluster by the controller, which holds the only private key capable of decryption.\n","title":"Sealed Secrets","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/seccomp/","section":"Tags","summary":"","title":"Seccomp","type":"tags"},{"content":"seccomp (Secure Computing Mode) is a Linux kernel facility, activated by the seccomp(2) syscall, that restricts which system calls a process may subsequently invoke. In its original SECCOMP_SET_MODE_STRICT form (2005) it was a blunt instrument: the process could call only read, write, _exit, and sigreturn. The operationally useful form is SECCOMP_SET_MODE_FILTER, introduced in kernel 3.5 (2012), which accepts a BPF (classic BPF, predating eBPF) filter program that receives each syscall\u0026rsquo;s number and arguments and returns one of several verdicts: ALLOW (continue normally), ERRNO (return a specified error to the process), KILL_PROCESS or KILL_THREAD (terminate immediately without giving the process a chance to handle signals), TRAP (deliver SIGSYS), or TRACE (notify a ptracer). Once installed, a seccomp filter cannot be removed, and child processes created by fork() or threads created by clone() inherit it. Filters may only add restrictions, never loosen them — so a chain of filters is the intersection of all their allowlists. The filter runs entirely in the kernel, in BPF bytecode verified for safety, before the syscall implementation is entered, making it extremely low-overhead relative to the security it provides.\nA seccomp profile in practice is a list of permitted syscalls (an allowlist) rather than a denylist, because the Linux syscall surface is large and new dangerous syscalls are added with kernel releases. Container runtimes generate and apply seccomp profiles automatically: containerd, CRI-O, and Docker all ship a default seccomp profile — a curated allowlist of roughly 300 syscalls sufficient for the vast majority of containerised workloads — which blocks a targeted set of dangerous calls including kexec_load, ptrace, mount, unshare, setns, perf_event_open, bpf, userfaultfd, and the full set of privileged clock operations. Kubernetes 1.27+ enables RuntimeDefault seccomp by default in the Restricted PSA profile. Custom profiles are specified in the pod spec via securityContext.seccompProfile.type: Localhost with a node-local profile path, or distributed across nodes via the Security Profiles Operator (SPO), which manages seccomp (and AppArmor) profiles as Kubernetes CRDs and syncs them to nodes. The SPO can also run in recording mode: it attaches a BPF program to the pod\u0026rsquo;s syscall path, records every syscall the workload actually makes, and synthesises a minimal allowlist profile, dramatically reducing the effort of profile authoring for existing applications.\nseccomp is complementary to and layered with the other Linux isolation mechanisms in this glossary. Namespaces restrict what a process can see; cgroups restrict what it can consume; LSM (AppArmor, SELinux) restricts what it can access based on MAC policy; seccomp restricts which kernel operations it can invoke at all — each layer addresses a different dimension of the attack surface. The interaction between seccomp and LSM is precisely ordered: seccomp runs before LSM hooks, so a syscall blocked by seccomp never reaches the LSM check. eBPF programs loaded via bpf(2) are themselves subject to the seccomp filter of the loading process — the default container seccomp profile blocks bpf() for this reason. In the context of Kata Containers and KubeVirt, seccomp is applied to the QEMU or virt-launcher host process, constraining the hypervisor\u0026rsquo;s own syscall surface to limit the damage from a QEMU vulnerability, independently of whatever seccomp profile the workload inside the VM uses.\n","externalUrl":null,"permalink":"/en/security/seccomp/","section":"Index","summary":"seccomp (Secure Computing Mode) is a Linux kernel facility, activated by the seccomp(2) syscall, that restricts which system calls a process may subsequently invoke. In its original SECCOMP_SET_MODE_STRICT form (2005) it was a blunt instrument: the process could call only read, write, _exit, and sigreturn. The operationally useful form is SECCOMP_SET_MODE_FILTER, introduced in kernel 3.5 (2012), which accepts a BPF (classic BPF, predating eBPF) filter program that receives each syscall’s number and arguments and returns one of several verdicts: ALLOW (continue normally), ERRNO (return a specified error to the process), KILL_PROCESS or KILL_THREAD (terminate immediately without giving the process a chance to handle signals), TRAP (deliver SIGSYS), or TRACE (notify a ptracer). Once installed, a seccomp filter cannot be removed, and child processes created by fork() or threads created by clone() inherit it. Filters may only add restrictions, never loosen them — so a chain of filters is the intersection of all their allowlists. The filter runs entirely in the kernel, in BPF bytecode verified for safety, before the syscall implementation is entered, making it extremely low-overhead relative to the security it provides.\n","title":"seccomp (Secure Computing Mode)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/secrets/","section":"Tags","summary":"","title":"Secrets","type":"tags"},{"content":"Secrets Store CSI Driver (formally secrets-store.csi.k8s.io) is a Kubernetes SIG Auth project that uses the Container Storage Interface to mount secrets, certificates, and keys from external secret backends directly into pod filesystems as ephemeral tmpfs volumes, bypassing the Kubernetes Secret object and etcd entirely. The driver runs as a DaemonSet on every node; when a pod referencing a CSI volume of type secrets-store.csi.k8s.io is scheduled, the driver communicates with a provider plugin over gRPC to retrieve the secret content from the configured backend, writes it to a per-pod tmpfs mount, and makes it available inside the container at the specified path. When the pod terminates, the tmpfs is unmounted and the data is gone — secrets have no persistence beyond the lifetime of the pod that requested them.\nThe central configuration object is the SecretProviderClass CRD, which specifies the provider to use (Vault, Azure Key Vault, AWS Secrets Manager, GCP Secret Manager), the objects to retrieve and their target filenames inside the volume, and any provider-specific authentication parameters. Each provider ships as a separate plugin installed alongside the driver. A pod requests the secrets by declaring a volume of type csi referencing the driver and a named SecretProviderClass, then mounting that volume into a container; no other changes to the pod spec are needed. By default, secrets are available only as files at the mount path. An optional sync-to-Kubernetes-Secret feature creates a native Secret object mirroring the mounted content — useful for workloads that require environment variables rather than files — but with an important caveat: the synced Secret only exists while at least one pod mounting the volume is running, and is deleted when all such pods are gone. The driver also supports periodic rotation: it re-fetches secret content from the backend on a configurable interval and updates the mounted files in place, allowing applications to detect and reload credential changes without a pod restart.\nThe defining advantage of the CSI driver over ESO is that secrets never enter etcd or the Kubernetes API: they flow from the external backend directly into the pod\u0026rsquo;s memory-backed filesystem, reducing the blast radius of a control-plane compromise. This matters most in environments with strict data residency or compliance requirements, or in CoCo and confidential computing deployments where minimising the trust surface of the Kubernetes control plane is a design goal. The trade-off is operational friction: the pod spec must be modified to declare the CSI volume (whereas ESO works with standard Secret references that require no pod changes), and the sync-to-Secret behaviour has the lifecycle coupling noted above. In practice, ESO and the CSI driver are deployed complementarily rather than exclusively — ESO for the broad workload base that can tolerate etcd storage, and the CSI driver for specific workloads where the stronger isolation is worth the additional configuration cost.\n","externalUrl":null,"permalink":"/en/security/csi-secret-store/","section":"Index","summary":"Secrets Store CSI Driver (formally secrets-store.csi.k8s.io) is a Kubernetes SIG Auth project that uses the Container Storage Interface to mount secrets, certificates, and keys from external secret backends directly into pod filesystems as ephemeral tmpfs volumes, bypassing the Kubernetes Secret object and etcd entirely. The driver runs as a DaemonSet on every node; when a pod referencing a CSI volume of type secrets-store.csi.k8s.io is scheduled, the driver communicates with a provider plugin over gRPC to retrieve the secret content from the configured backend, writes it to a per-pod tmpfs mount, and makes it available inside the container at the specified path. When the pod terminates, the tmpfs is unmounted and the data is gone — secrets have no persistence beyond the lifetime of the pod that requested them.\n","title":"Secrets Store CSI Driver","type":"security"},{"content":"UEFI Secure Boot is a firmware-level mechanism that ensures each binary executed during the boot process — bootloader, kernel, UEFI drivers — is cryptographically signed by a key the firmware trusts, before it is allowed to run. It is defined in the UEFI specification and implemented by the firmware on virtually all modern x86 and ARM platforms. Its threat model is bootkits and rootkits that install themselves before the OS loads and therefore survive reboots, OS reinstalls, and cannot be detected by any software running after them.\nTrust is managed through a four-level key hierarchy stored in authenticated UEFI variables. The Platform Key (PK) — enrolled by the OEM or system owner — is the root of trust; its private key is required to authorize any changes to the next layer. The Key Exchange Key (KEK) database holds keys authorized to update the signature databases. The signature database (db) lists the public keys and binary hashes that are trusted to execute at boot time. The revocation database (dbx) lists keys and hashes that are explicitly blocked, and always takes precedence over db — a binary matching a dbx entry is refused regardless of any db entry. At boot, firmware verifies each EFI binary\u0026rsquo;s signature against db (and checks it against dbx) before executing it; any failure halts the chain. The entire Secure Boot configuration — PK, KEK, db, dbx — is measured into TPM PCR 7, making the Secure Boot state part of the platform\u0026rsquo;s attestable identity. In day-to-day operation, firmware decides whether a binary may run by checking db and dbx only; most administrators never change PK, which is typically enrolled once by the OEM or platform owner and left in place for the life of the machine. PK and KEK become relevant when you take ownership of the trust store: enrolling your own keys into firmware, rotating or replacing signature databases, or running enterprise key management and custom Secure Boot policies (for example, restricting which signers may appear in db). For attestation and disk sealing, the full PK/KEK/db/dbx state still matters because it is what TPM PCR 7 records.\nOn Linux, distributions do not hold a key in the firmware\u0026rsquo;s db directly. Instead they rely on shim: a small Microsoft-signed EFI binary that acts as a second-stage trust anchor. Shim embeds the distribution\u0026rsquo;s own CA certificate and validates GRUB and the kernel against it, extending the chain of trust without requiring firmware modification. Shim also maintains a Machine Owner Key (MOK) database — a user-managed secondary trust store stored outside the UEFI variable hierarchy — that allows sysadmins to enroll their own signing keys (for custom kernels or out-of-tree modules) using mokutil, with changes only confirmable from the physical console at boot to prevent userland malware from silently enrolling keys. Secure Boot is a prerequisite for UKI-based measured boot: a UKI\u0026rsquo;s value as a single signed payload depends entirely on the firmware\u0026rsquo;s willingness to reject anything not carrying a valid signature.\nSecure Boot does not, by itself, restrict what the running kernel may do after boot. Many Linux distributions therefore enable kernel lockdown when Secure Boot is active — typically integrity mode — which blocks or limits actions that could undermine boot-time guarantees, such as loading unsigned kernel modules, abusing sensitive interfaces, or using certain debugging features from privileged context. Lockdown is a runtime complement to firmware verification: Secure Boot attests what was loaded; lockdown reduces the chance that a compromised or malicious root can weaken the system in ways that matter for integrity-focused threat models. It is not a substitute for signed boot artifacts and does not replace measured boot or IMA where those are required.\nAdditional Information # What is UEFI Secure Boot and how it works? kernel_lockdown(7) — Linux manual page UEFI Secure Boot in modern computer security solutions ","externalUrl":null,"permalink":"/en/security/secure-boot/","section":"Index","summary":"UEFI Secure Boot is a firmware-level mechanism that ensures each binary executed during the boot process — bootloader, kernel, UEFI drivers — is cryptographically signed by a key the firmware trusts, before it is allowed to run. It is defined in the UEFI specification and implemented by the firmware on virtually all modern x86 and ARM platforms. Its threat model is bootkits and rootkits that install themselves before the OS loads and therefore survive reboots, OS reinstalls, and cannot be detected by any software running after them.\n","title":"Secure Boot (UEFI Secure Boot)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/security/","section":"Tags","summary":"","title":"Security","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/security-testing/","section":"Tags","summary":"","title":"Security-Testing","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/selinux/","section":"Tags","summary":"","title":"Selinux","type":"tags"},{"content":"SELinux (Security-Enhanced Linux) is a Mandatory Access Control (MAC) implementation developed by the NSA and released as open source in 2000, merged into the mainline Linux kernel in 2.6 via the LSM framework in 2003. Its defining characteristic is default deny: unlike the standard Linux Discretionary Access Control model (file permission bits), where anything not explicitly forbidden is permitted, SELinux refuses all access that is not explicitly allowed by policy. Every process and every object — every file, socket, pipe, device node, and IPC object — carries a security context (also called a label) of the form user:role:type:level. The policy is a compiled set of rules, loaded at boot, that defines precisely which combinations of process context and object context may interact and how. An Apache web server process running in the httpd_t domain can read files labelled httpd_sys_content_t but is denied access to files labelled user_home_t or shadow_t, regardless of what Unix file permission bits say. If the web server is compromised, the attacker is confined to what httpd_t permits — typically a narrow, well-defined set of files and network operations — rather than having the full access of the user account running Apache.\nThe dominant SELinux policy component is Type Enforcement (TE), where the type field in the security context is the primary axis of access control. Each process type (called a domain) has a defined set of access rules for each object type — what it can read, write, execute, connect to, or signal. On top of TE, SELinux supports Role-Based Access Control (RBAC), where a user\u0026rsquo;s role constrains which domains they can transition into (preventing a developer account from transitioning into an administrator domain), and Multi-Level Security (MLS) and Multi-Category Security (MCS), which implement Bell-LaPadula confidentiality classifications (secret processes cannot read top-secret data) and are used in government deployments and container isolation (MCS categories separate containers from each other using unique s0:c1,c2-style labels). In practice, most RHEL/Fedora deployments use the targeted policy: a pragmatic subset that applies type enforcement to high-risk daemons (network-facing services, CUPS, DBus, the container runtime) while leaving most user processes in the unconfined_t domain, which has essentially no MAC restrictions. Three operating modes are supported: Enforcing (violations are blocked and logged as AVC denials), Permissive (violations are logged but not blocked, used during policy development and debugging), and Disabled (no SELinux policy loaded at all, requiring a filesystem relabel to re-enable). Switching from Disabled to Permissive requires booting with autorelabel, since files created while SELinux was off carry no context and must be labelled according to the policy\u0026rsquo;s file context database before MAC can be correctly applied.\nSELinux is the default MAC system on RHEL, CentOS Stream, Fedora, and their derivatives, and is mandatory for OpenShift nodes — SCCs on OpenShift build directly on SELinux contexts, with the SCC admission plugin setting MCS labels on pod processes to ensure containers cannot access each other\u0026rsquo;s files even if they run as the same UID. Container runtimes (containerd, CRI-O, Podman) automatically assign unique MCS category pairs to each container, and the OCI runtime spec\u0026rsquo;s linux.selinuxOptions field allows administrators to override the label for specific containers. The most common operational pain point with SELinux is mislabelled files: any file created by a process outside the context SELinux expects (a configuration file dropped by a custom install script, a bind mount from an unexpected path) may carry the wrong type and trigger AVC denials that appear as mysterious permission failures with correct Unix permissions. The tooling chain for diagnosis is ausearch -m AVC, audit2why, and audit2allow; the correct long-term fix is a file context rule (semanage fcontext), not disabling enforcement. SELinux is one of the few Linux security controls that is simultaneously mandatory in high-assurance government deployments (Common Criteria EAL4+ certified in targeted policy form) and widely deployed in commodity cloud infrastructure.\n","externalUrl":null,"permalink":"/en/security/selinux/","section":"Index","summary":"SELinux (Security-Enhanced Linux) is a Mandatory Access Control (MAC) implementation developed by the NSA and released as open source in 2000, merged into the mainline Linux kernel in 2.6 via the LSM framework in 2003. Its defining characteristic is default deny: unlike the standard Linux Discretionary Access Control model (file permission bits), where anything not explicitly forbidden is permitted, SELinux refuses all access that is not explicitly allowed by policy. Every process and every object — every file, socket, pipe, device node, and IPC object — carries a security context (also called a label) of the form user:role:type:level. The policy is a compiled set of rules, loaded at boot, that defines precisely which combinations of process context and object context may interact and how. An Apache web server process running in the httpd_t domain can read files labelled httpd_sys_content_t but is denied access to files labelled user_home_t or shadow_t, regardless of what Unix file permission bits say. If the web server is compromised, the attacker is confined to what httpd_t permits — typically a narrow, well-defined set of files and network operations — rather than having the full access of the user account running Apache.\n","title":"SELinux (Security-Enhanced Linux)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/sensing/","section":"Tags","summary":"","title":"Sensing","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/service-based-architecture/","section":"Tags","summary":"","title":"Service-Based-Architecture","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/serving/","section":"Tags","summary":"","title":"Serving","type":"tags"},{"content":"SEV-SNP is AMD\u0026rsquo;s third-generation confidential computing technology for EPYC processors, and the generation in production use across major cloud providers (AWS, Google Cloud) and Linux distributions today. It builds on two predecessors: SEV (2016), which encrypted each VM\u0026rsquo;s memory with a per-VM AES key managed by the AMD Secure Processor, and SEV-ES (2017), which additionally encrypted CPU register state on VM exit to prevent the hypervisor from reading guest execution state. SEV-SNP\u0026rsquo;s defining addition is memory integrity: using Secure Nested Paging, the firmware enforces that if a guest can read an encrypted memory location, the value returned must be exactly what the guest last wrote there — closing the replay, remap, and memory aliasing attacks that made earlier generations insufficient for a fully untrusted hypervisor threat model.\nThe trust boundary is enforced by the AMD Secure Processor (ASP), an on-die ARM Cortex-A5 running AMD firmware that owns key management and launch policy. At guest launch, the ASP measures the initial memory contents and binds a guest policy — a bitmask controlling whether debugging, SMT, or migration are permitted — that neither the guest nor the hypervisor can alter afterwards. The result is a launch measurement that uniquely identifies the initial state of the TD. For remote attestation, the guest can request a signed attestation report from the ASP containing that measurement along with current firmware version and platform identity, signed with an AMD-rooted key chain. A relying party can verify this report against AMD\u0026rsquo;s Key Distribution Service (KDS) to confirm the guest is running on genuine AMD hardware with a specific, unmodified software stack, before sending it secrets.\nCompared to TDX, the architectural approach differs: TDX uses a CPU-measured module in SEAM mode as an intermediary, while SEV-SNP places trust in the AMD Secure Processor firmware running entirely on-die. Both achieve a similar confidential computing threat model — a guest protected from a fully compromised hypervisor and host — and both are supported by the CNCF Confidential Containers and Linux kernel stacks. On Linux, SEV-SNP guests pair naturally with UKI-based measured boot and systemd-cryptenroll for secret injection at launch time.\n","externalUrl":null,"permalink":"/en/security/sev-snp/","section":"Index","summary":"SEV-SNP is AMD’s third-generation confidential computing technology for EPYC processors, and the generation in production use across major cloud providers (AWS, Google Cloud) and Linux distributions today. It builds on two predecessors: SEV (2016), which encrypted each VM’s memory with a per-VM AES key managed by the AMD Secure Processor, and SEV-ES (2017), which additionally encrypted CPU register state on VM exit to prevent the hypervisor from reading guest execution state. SEV-SNP’s defining addition is memory integrity: using Secure Nested Paging, the firmware enforces that if a guest can read an encrypted memory location, the value returned must be exactly what the guest last wrote there — closing the replay, remap, and memory aliasing attacks that made earlier generations insufficient for a fully untrusted hypervisor threat model.\n","title":"SEV-SNP (AMD Secure Encrypted Virtualization – Secure Nested Paging)","type":"security"},{"content":"SHA (Secure Hash Algorithm) is the name given to a series of cryptographic hash function families standardised by NIST under FIPS 180 and FIPS 202. Three generations exist with fundamentally different design lineages. SHA-1 (1995, FIPS 180-1) produces a 160-bit digest and is fully broken for collision resistance: the SHAttered attack (Google and CWI Amsterdam, 2017) produced a chosen-prefix collision — two different PDF files with identical SHA-1 hashes — using approximately 9.2 × 10^18 SHA-1 operations, within practical reach of well-resourced attackers. SHA-1 must not be used for any security purpose; it persists only in legacy Git object identifiers (SHA-1 is being phased out in Git\u0026rsquo;s object store in favour of SHA-256 under the sha256 object format) and in TOTP\u0026rsquo;s HMAC-SHA-1 inner construction (where collision resistance is not the relevant security property, but migration to SHA-256 variants is still recommended). SHA-2 (2001, FIPS 180-2 and subsequent revisions) is the Merkle-Damgård family that includes SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. SHA-256 and SHA-512 are the two variants in universal production use; the others serve niche roles. SHA-3 (2015, FIPS 202) is the Keccak sponge construction — structurally independent of SHA-2 — providing algorithm diversity and including fixed-output variants (SHA3-256, SHA3-512) and extendable output functions (SHAKE128, SHAKE256).\nSHA-256 (256-bit digest, part of SHA-2) is the universal default hash function in modern infrastructure. It is used in: TLS certificate fingerprints and the signature algorithm ecdsa-with-SHA256 in X.509 certificates; OCI and composefs content-addressed storage where every blob is identified by its sha256: digest; LUKS2 header integrity protection; the PBKDF2 and Argon2 key derivation functions used in password storage and disk encryption; HMAC-SHA-256 for message authentication and API signing; HKDF-SHA-256 for key derivation in TLS 1.3 and ML-KEM output processing; Git object hashing (under migration); and as the inner hash in ML-DSA and ML-KEM parameter sets. SHA-384 (truncated SHA-512 with a different initialisation vector) produces a 384-bit digest and is mandated by NSA CNSA 1.0 for top-secret data; it is the hash algorithm in ecdsa-with-SHA384 signatures on P-384 certificates and in TLS 1.3\u0026rsquo;s TLS_AES_256_GCM_SHA384 cipher suite. SHA-512 produces a 512-bit digest with the same Merkle-Damgård structure as SHA-256 but a larger internal state (512-bit vs 256-bit) and 80 rounds vs 64; it is used where the largest classical security margin is required and in IMA file measurements at the SHA-512 attribute level. SHA-512 is faster than SHA-256 on 64-bit CPUs for long messages because both process one block per iteration, but SHA-512\u0026rsquo;s block is 1024 bits vs SHA-256\u0026rsquo;s 512 bits; for short messages (certificates, JWTs, API payloads), SHA-256 is faster in absolute terms.\nSHA-3 (Keccak, FIPS 202) uses a sponge construction: a fixed-size state (1600 bits) is iteratively permuted with the Keccak-f permutation, absorbing input in chunks and squeezing output after. This is structurally independent of the Merkle-Damgård construction used by SHA-1 and SHA-2 — a weakness specific to Merkle-Damgård (such as length-extension attacks, which affect naive H(K ∥ m) constructions with SHA-256) does not apply to Keccak. SHA3-256 and SHA3-512 are drop-in replacements for SHA-256 and SHA-512 with identical output sizes; SHAKE128 and SHAKE256 are extendable output functions (XOFs) that produce an output of any requested length, making them the natural primitive for protocols that need variable-length pseudorandom output. SHAKE128 and SHAKE256 are used internally in ML-KEM, ML-DSA, and SLH-DSA (in their SHAKE-based parameter sets) as the pseudorandom generation primitive, and in OpenSSL 3.x as the underlying XOF for HKDF variants. Against quantum computers, all SHA-2 and SHA-3 variants are affected only by Grover\u0026rsquo;s algorithm, which halves the effective security level against preimage attacks: SHA-256 provides 128-bit quantum preimage security (adequate), SHA-384 provides 192-bit (conservative), SHA-512 provides 256-bit (maximum). Collision resistance under quantum attack is governed by the BHT (Brassard-Høyer-Tapp) algorithm, which reduces collision resistance to approximately two-thirds of the classical level — SHA-256 provides roughly 170-bit quantum collision resistance, SHA-384 roughly 256-bit. The practical implication is that SHA-256 remains safe for all current uses in the PQC transition; SHA-384 or SHA-512 is the conservative choice for new high-assurance deployments with long lifetimes, and SHA-3/SHAKE is preferred where design diversity from SHA-2 is valued.\n","externalUrl":null,"permalink":"/en/security/sha/","section":"Index","summary":"SHA (Secure Hash Algorithm) is the name given to a series of cryptographic hash function families standardised by NIST under FIPS 180 and FIPS 202. Three generations exist with fundamentally different design lineages. SHA-1 (1995, FIPS 180-1) produces a 160-bit digest and is fully broken for collision resistance: the SHAttered attack (Google and CWI Amsterdam, 2017) produced a chosen-prefix collision — two different PDF files with identical SHA-1 hashes — using approximately 9.2 × 10^18 SHA-1 operations, within practical reach of well-resourced attackers. SHA-1 must not be used for any security purpose; it persists only in legacy Git object identifiers (SHA-1 is being phased out in Git’s object store in favour of SHA-256 under the sha256 object format) and in TOTP’s HMAC-SHA-1 inner construction (where collision resistance is not the relevant security property, but migration to SHA-256 variants is still recommended). SHA-2 (2001, FIPS 180-2 and subsequent revisions) is the Merkle-Damgård family that includes SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. SHA-256 and SHA-512 are the two variants in universal production use; the others serve niche roles. SHA-3 (2015, FIPS 202) is the Keccak sponge construction — structurally independent of SHA-2 — providing algorithm diversity and including fixed-output variants (SHA3-256, SHA3-512) and extendable output functions (SHAKE128, SHAKE256).\n","title":"SHA (Secure Hash Algorithm)","type":"security"},{"content":"SIEM (Security Information and Event Management) is a platform that aggregates security telemetry from across an organisation\u0026rsquo;s infrastructure, normalises it into a common schema, applies correlation rules and behavioural analytics to detect threats, and retains the data for investigation and compliance reporting. The name combines two earlier disciplines: SIM (Security Information Management) — long-term log retention, compliance reporting, and forensic search — and SEM (Security Event Management) — real-time alert correlation and incident detection. Modern SIEMs do both simultaneously, serving as the primary visibility layer for a Security Operations Centre (SOC). Leading platforms include Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel, Elastic Security, Exabeam, and LogRhythm; all share the same fundamental architecture despite differing in query language (SPL for Splunk, KQL for Sentinel, EQL/KQL for Elastic, AQL for QRadar), correlation engine design (search-based vs dedicated CEP engine), and deployment model (on-premises, SaaS, or hybrid).\nInputs: logs vs events — and why the distinction matters. A SIEM consumes two categories of telemetry with different characteristics. Logs are structured or semi-structured records written by a system describing what it did: syslog lines from Linux hosts, Windows Event Log entries, web server access logs, audit records from the Linux kernel audit subsystem, IMA measurement events, SELinux AVC denials, firewalld/nftables packet drops, OpenShift API server audit logs (every kubectl API call, with verb, resource, user, namespace, and response code), container runtime logs from CRI-O, SSSD authentication events, and AIDE change reports. Logs are high-volume, append-only, and timestamped but do not inherently carry urgency or severity — they describe facts. Events (or alerts) are pre-processed, semantically enriched signals that something security-relevant may have occurred: a failed authentication threshold exceeded, a KEV-listed CVE detected in a running image, a NetworkPolicy violation, an unexpected privileged container start, or a Falco rule firing on a suspicious execve(). Events are lower-volume, carry a severity and a structured alert schema, and often include correlation context already applied by the source (a CNI plugin, an EDR agent, RHACS, or a cloud-native security platform). The SIEM must handle both — logs require parsing, field extraction, normalisation (mapping vendor-specific field names to a common schema such as ECS, CEF, or LEEF), and indexing before they can be correlated; events arrive pre-normalised but must be deduplicated, enriched with asset context, and correlated with related log evidence. Concretely from a Kubernetes or OpenShift environment, a SIEM receives: logs (OpenShift API audit log via Vector/Fluentd sidecar or the OpenShift Logging Operator forwarding to a SIEM-compatible endpoint; node-level syslog; container stdout/stderr forwarded by the node logging agent; ODF/Ceph audit events; SSSD and PAM authentication logs from the RHCOS node via journald) and events/alerts (RHACS/Stackrox policy violations forwarded via webhook or syslog integration; Falco alerts forwarded to a Fluentd/Fluent Bit aggregator; OPA Gatekeeper policy violation events from the Kubernetes API audit log; image vulnerability findings from an integrated scanner; network flow anomalies from a CNI plugin with flow logging such as Cilium Hubble).\nThe SIEM\u0026rsquo;s relationship to the Kubernetes/OpenShift platform is strictly one-directional: the platform pushes telemetry to the SIEM, and the SIEM has no feedback path back to the platform. A SIEM can detect, correlate, alert, and report — but it cannot delete a pod, apply a NetworkPolicy, revoke an RBAC binding, quarantine a node, or trigger a MachineConfig rollout. This is an architectural boundary, not a limitation: the SIEM is an observation and detection system, not a control plane. Actuation — the feedback loop that actually changes the state of the cluster in response to a detected threat — is the role of SOAR. What a SIEM can do on the Kubernetes side is drive the log collection configuration: the OpenShift Logging Operator\u0026rsquo;s ClusterLogForwarder CRD specifies which log streams are forwarded, to which SIEM endpoint, in which format (syslog, HTTP JSON, Kafka), and with what filtering (namespace selectors, log level thresholds, field inclusion/exclusion). This is the platform-side filtering mechanism: rather than forwarding every container\u0026rsquo;s stdout at full volume to the SIEM (which would be impractical at scale), the ClusterLogForwarder routes infrastructure logs, audit logs, and application logs to different SIEM indices or pipelines, applies namespace-level filters to exclude high-volume but low-value namespaces (monitoring, logging itself), and can drop DEBUG-level application logs while preserving all audit and security events. The SIEM then applies its own filtering, normalisation, and enrichment on top. Platform-side pre-filtering is not optional at Kubernetes scale: a 100-node OpenShift cluster generating 50,000 log lines per second from all sources would overwhelm most SIEM ingestion pipelines and licensing budgets; structured forwarding of only security-relevant streams — API audit, node auth, security tool alerts, policy violations — is the production-realistic approach.\n","externalUrl":null,"permalink":"/en/security/siem/","section":"Index","summary":"SIEM (Security Information and Event Management) is a platform that aggregates security telemetry from across an organisation’s infrastructure, normalises it into a common schema, applies correlation rules and behavioural analytics to detect threats, and retains the data for investigation and compliance reporting. The name combines two earlier disciplines: SIM (Security Information Management) — long-term log retention, compliance reporting, and forensic search — and SEM (Security Event Management) — real-time alert correlation and incident detection. Modern SIEMs do both simultaneously, serving as the primary visibility layer for a Security Operations Centre (SOC). Leading platforms include Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel, Elastic Security, Exabeam, and LogRhythm; all share the same fundamental architecture despite differing in query language (SPL for Splunk, KQL for Sentinel, EQL/KQL for Elastic, AQL for QRadar), correlation engine design (search-based vs dedicated CEP engine), and deployment model (on-premises, SaaS, or hybrid).\n","title":"SIEM (Security Information and Event Management)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/signatures/","section":"Tags","summary":"","title":"Signatures","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/signing/","section":"Tags","summary":"","title":"Signing","type":"tags"},{"content":"Sigstore is an OpenSSF project, initiated by Google, Red Hat, and Purdue University, that provides a free public-good infrastructure for cryptographically signing software artifacts — container images, binaries, SBOMs, attestations — without the operational burden of managing long-lived private keys. Its founding insight is that the two hardest problems in code signing are key management (generating, protecting, distributing, rotating, and revoking signing keys across thousands of developers and CI pipelines) and signature discoverability (how does a verifier find and trust the correct public key for an artifact it has never seen before). Sigstore solves both by eliminating long-lived keys entirely: every signing operation generates a fresh ephemeral key pair, uses it once, discards the private key, and records the event in a public transparency log — replacing \u0026ldquo;do you trust this key?\u0026rdquo; with \u0026ldquo;do you trust this identity at this moment in time?\u0026rdquo;.\nSigstore\u0026rsquo;s architecture consists of four components. Fulcio is the certificate authority: when a developer or CI pipeline wants to sign, it first authenticates to an OIDC provider (Google, GitHub, Microsoft — or any provider Fulcio trusts) and presents the resulting ID token to Fulcio. Fulcio verifies the token, extracts the identity claim (a GitHub Actions workflow path like https://github.com/org/repo/.github/workflows/release.yaml@refs/heads/main, or an email address), generates an ephemeral key pair, issues a short-lived X.509 certificate (valid for approximately 10 minutes) binding the public key to that identity, and logs the certificate to a certificate transparency log. The private key exists only in memory for the duration of the signing operation and is then discarded. Rekor is the signature transparency log: every signing event (the artifact digest, the signature, and the Fulcio certificate) is appended as an immutable entry in a Merkle-tree-backed log, and Rekor returns a Signed Entry Timestamp (SET) — a countersigned inclusion proof that the entry was logged at a specific time. The SET is the critical artifact that proves the signature was produced while the Fulcio certificate was valid, enabling verification long after the 10-minute certificate has expired. cosign is the primary client tool: cosign sign orchestrates the full flow (OIDC authentication → Fulcio certificate → sign → Rekor log → push signature to OCI registry as a referrer), and cosign verify fetches the signature, Rekor entry, and Fulcio certificate and verifies the complete chain. TUF (The Update Framework) distributes Sigstore\u0026rsquo;s root of trust — Fulcio\u0026rsquo;s root CA certificate and Rekor\u0026rsquo;s public key — securely to clients, protecting against key substitution attacks on the trust anchor itself.\nSigstore integrates throughout the supply chain stack in this glossary. Signatures and SLSA provenance attestations produced by cosign are stored as OCI referrers alongside container images, discoverable via the referrers API and fetchable by ORAS. Kubernetes admission controllers (Policy Controller from Sigstore, Kyverno with cosign support) can enforce that all images admitted to a cluster carry a valid Sigstore signature from an approved identity — a GitHub Actions workflow in a specific repository, a specific CI platform\u0026rsquo;s OIDC subject — before the image runs. SBOM documents and VEX assertions are signed with cosign and attached as referrers, so the entire supply chain metadata set (signature + SBOM + VEX + SLSA provenance) travels with the image in the registry. gitsign brings the same keyless model to Git commit signing, replacing long-lived GPG keys with OIDC-bound ephemeral certificates recorded in Rekor — every git commit --gpg-sign becomes a Rekor entry that can be verified years later without the signer maintaining a key. For private or air-gapped deployments, all Sigstore components (Fulcio, Rekor, cosign) can be self-hosted, with custom OIDC providers and private trust roots — enabling the same keyless signing model in environments that cannot use the public-good infrastructure. The PQC transition for Sigstore requires migrating Fulcio\u0026rsquo;s root CA to ML-DSA (so that the short-lived certificates it issues carry quantum-safe signatures) and Rekor\u0026rsquo;s signing key to ML-DSA (so that SETs remain unforgeable); the cosign and Sigstore library ecosystem will follow OpenSSL 3.4+ and Go\u0026rsquo;s PQC library support.\n","externalUrl":null,"permalink":"/en/security/sigstore/","section":"Index","summary":"Sigstore is an OpenSSF project, initiated by Google, Red Hat, and Purdue University, that provides a free public-good infrastructure for cryptographically signing software artifacts — container images, binaries, SBOMs, attestations — without the operational burden of managing long-lived private keys. Its founding insight is that the two hardest problems in code signing are key management (generating, protecting, distributing, rotating, and revoking signing keys across thousands of developers and CI pipelines) and signature discoverability (how does a verifier find and trust the correct public key for an artifact it has never seen before). Sigstore solves both by eliminating long-lived keys entirely: every signing operation generates a fresh ephemeral key pair, uses it once, discards the private key, and records the event in a public transparency log — replacing “do you trust this key?” with “do you trust this identity at this moment in time?”.\n","title":"Sigstore","type":"security"},{"content":"SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), standardised as NIST FIPS 205 in August 2024, is the post-quantum signature standard based on hash functions rather than lattice problems. Where ML-DSA and ML-KEM both rest their security on the hardness of Module Learning With Errors — a relatively young mathematical assumption first formulated in 2005 — SLH-DSA\u0026rsquo;s security rests exclusively on the collision resistance and preimage resistance of an underlying hash function (SHA-256, SHA-512, or SHAKE, depending on parameter set). Hash function security against quantum computers is well-understood: Grover\u0026rsquo;s algorithm provides at most a quadratic speedup, which is fully mitigated by doubling output size (SHA-256 remains adequate against classical attacks; SHA-512 provides AES-256-equivalent quantum resistance). The decades-long cryptanalytic confidence in SHA-2 and SHA-3 makes SLH-DSA\u0026rsquo;s security argument the most conservative available: it requires no new mathematical assumption beyond the hash functions already trusted throughout the entire cryptographic stack.\nSLH-DSA is derived from SPHINCS+, the hash-based signature scheme that NIST selected as its conservative, non-lattice alternative during the PQC standardisation process. Its construction chains together several cryptographic primitives: WOTS+ (Winternitz One-Time Signatures Plus) for signing individual messages with disposable key pairs, FORS (Forest of Random Subsets) for signing indices into a hypertree structure, and a hypertree of Merkle trees whose root commits to all possible signing key pairs. The \u0026ldquo;stateless\u0026rdquo; in the name is the critical property that distinguishes SLH-DSA from older hash-based schemes like XMSS: the signer does not need to maintain state about which one-time keys have been used, eliminating the catastrophic key-reuse vulnerability of stateful hash-based schemes. Instead, the one-time key used for each signature is derived deterministically from the private key and a random (or message-derived) index, making SLH-DSA safe to use with standard key management infrastructure and in multi-signer or distributed signing scenarios. NIST defines twelve parameter sets across two security/speed trade-off axes — small (smaller signatures, slower signing) and fast (larger signatures, faster signing) — at security levels 1, 3, and 5. Representative sizes for the recommended level-3 fast variant (SLH-DSA-SHAKE-192f): 48-byte public key, 35,664-byte signature. The tiny public key is SLH-DSA\u0026rsquo;s standout property; the large signature is its primary operational disadvantage.\nSLH-DSA\u0026rsquo;s role in the PQC deployment strategy is as a diversity anchor, not a primary workhorse. ML-DSA is faster to sign, faster to verify, and produces signatures 10–15× smaller; it is the recommended default replacement for ECDSA and RSA signatures. SLH-DSA is the answer to \u0026ldquo;what do we use if a structural weakness in lattice-based cryptography is discovered?\u0026rdquo; — maintaining a parallel SLH-DSA signature on critical, long-lived artifacts (firmware images, root CA certificates, code signing certificates with multi-year validity) ensures that those artifacts remain secure even if the ML-DSA lattice assumption is broken. The deployment pattern for high-assurance signing infrastructure is therefore: sign with ML-DSA-65 as the primary algorithm and SLH-DSA-SHAKE-192s (small, conservative) as the secondary algorithm, and publish both signatures as separate OCI referrers or alongside the ML-DSA signature in the signing envelope. Verifiers can accept either, giving the signed artifact a defence-in-depth property across two independent mathematical foundations. For certificate authorities with decade-long root CA lifetimes, the small SLH-DSA public key (48 bytes) is attractive for root CA self-signatures: the root certificate itself can carry an SLH-DSA self-signature that is quantum-safe and requires no new mathematical trust, at the cost of a larger certificate file (dominated by the SLH-DSA signature, not the key).\n","externalUrl":null,"permalink":"/en/security/slh-dsa/","section":"Index","summary":"SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), standardised as NIST FIPS 205 in August 2024, is the post-quantum signature standard based on hash functions rather than lattice problems. Where ML-DSA and ML-KEM both rest their security on the hardness of Module Learning With Errors — a relatively young mathematical assumption first formulated in 2005 — SLH-DSA’s security rests exclusively on the collision resistance and preimage resistance of an underlying hash function (SHA-256, SHA-512, or SHAKE, depending on parameter set). Hash function security against quantum computers is well-understood: Grover’s algorithm provides at most a quadratic speedup, which is fully mitigated by doubling output size (SHA-256 remains adequate against classical attacks; SHA-512 provides AES-256-equivalent quantum resistance). The decades-long cryptanalytic confidence in SHA-2 and SHA-3 makes SLH-DSA’s security argument the most conservative available: it requires no new mathematical assumption beyond the hash functions already trusted throughout the entire cryptographic stack.\n","title":"SLH-DSA (Stateless Hash-Based Digital Signature Algorithm)","type":"security"},{"content":"SLSA (Supply-chain Levels for Software Artifacts), pronounced \u0026ldquo;salsa\u0026rdquo;, is a security framework published by OpenSSF (originally proposed by Google in 2021, version 1.0 released April 2023) that defines progressively stronger requirements for build integrity and provenance — the verifiable record of where a software artifact came from, what source it was built from, how it was built, and what the build environment looked like. The motivating threat is supply chain attacks like SolarWinds (malicious code injected into the build system) and XZ Utils (malicious code injected into the source repository): in both cases the artifact that reached users was not what the source code claimed, and consumers had no way to verify the discrepancy. SLSA\u0026rsquo;s answer is a provenance attestation: a signed, machine-readable document produced by the build platform that records the source repository and commit, the build instructions, the builder\u0026rsquo;s identity, the build environment\u0026rsquo;s properties, and the digest of the resulting artifact. Signed provenance is the basis on which consumers can make automated trust decisions rather than relying on reputation or manual inspection.\nSLSA is organised into tracks; the most commonly cited is the Build track, which in the latest published SLSA specification (v1.2) defines Build Levels 1–3 with progressively stronger guarantees. SLSA Build Level 1 requires that the build process be fully scripted (no manual steps) and that provenance be generated and available, but it does not require strong authenticity guarantees — its value is documentation and process hygiene, not tamper evidence. SLSA Build Level 2 requires provenance to be authenticated by the build platform (not the developer), produced automatically as a non-forgeable output of a hosted build service rather than a developer\u0026rsquo;s local environment; this prevents a developer from falsely claiming a package was built from a specific commit when it was not, but the build platform itself could still be compromised. SLSA Build Level 3 adds stronger protections around the build environment and provenance generation (isolation and hardening expectations for the build platform), making it the practical target for many production systems. Some earlier descriptions of SLSA mention “Build Level 4” requirements (two-person review, reproducible builds, dependency completeness); in current SLSA v1.x those are not part of the released Build-level requirements and are discussed as future work in the SLSA community.\nSLSA provenance documents use the in-toto Attestation Framework (ITE-6) format: a JSON envelope with a statement (subject identifying the artifact by digest, predicateType identifying the predicate schema, and predicate containing the provenance details) wrapped in a DSSE (Dead Simple Signing Envelope) that carries the signature and the signer\u0026rsquo;s key identity. For OCI artifacts, provenance attestations are stored as OCI referrers alongside the image they describe, signed with Sigstore cosign, and discoverable via the referrers API — so a verifier that fetches a container image can also fetch and verify its SLSA provenance in a single registry interaction. Native SLSA provenance generation is built into GitHub Actions (via the slsa-framework/slsa-github-generator reusable workflow, which generates Level 3 provenance signed by GitHub\u0026rsquo;s OIDC identity), Google Cloud Build, and Tekton Chains. Kubernetes admission controllers and policy engines (Kyverno, OPA Gatekeeper, Sigstore Policy Controller) can enforce SLSA level requirements as deployment gates: a policy might require that all production images carry a valid Level 3 provenance attestation from a CI system in the organisation\u0026rsquo;s GitHub organisation, with the source repository and build workflow matching an allowlist. The combination of SBOM (what is in the artifact), VEX (which vulnerabilities in the SBOM are exploitable), and SLSA provenance (how and where the artifact was built) forms the complete supply chain metadata set that ORAS manages and OCI referrers distributes — collectively providing the evidence base for automated, policy-driven software supply chain governance at scale.\n","externalUrl":null,"permalink":"/en/security/slsa/","section":"Index","summary":"SLSA (Supply-chain Levels for Software Artifacts), pronounced “salsa”, is a security framework published by OpenSSF (originally proposed by Google in 2021, version 1.0 released April 2023) that defines progressively stronger requirements for build integrity and provenance — the verifiable record of where a software artifact came from, what source it was built from, how it was built, and what the build environment looked like. The motivating threat is supply chain attacks like SolarWinds (malicious code injected into the build system) and XZ Utils (malicious code injected into the source repository): in both cases the artifact that reached users was not what the source code claimed, and consumers had no way to verify the discrepancy. SLSA’s answer is a provenance attestation: a signed, machine-readable document produced by the build platform that records the source repository and commit, the build instructions, the builder’s identity, the build environment’s properties, and the digest of the resulting artifact. Signed provenance is the basis on which consumers can make automated trust decisions rather than relying on reputation or manual inspection.\n","title":"SLSA (Supply-chain Levels for Software Artifacts)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/smartnic/","section":"Tags","summary":"","title":"Smartnic","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/smf/","section":"Tags","summary":"","title":"Smf","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/smo/","section":"Tags","summary":"","title":"Smo","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/snpn/","section":"Tags","summary":"","title":"Snpn","type":"tags"},{"content":"SOAR (Security Orchestration, Automation and Response) is the actuation complement to a SIEM: where the SIEM detects and alerts, SOAR responds and acts. It receives alerts — primarily from the SIEM, but also directly from EDR platforms, vulnerability scanners, cloud security posture tools, and CNI/container security platforms — and executes structured response playbooks: predefined, branching workflows that enrich the alert with additional context from connected systems, make automated or human-gated decisions based on that context, and issue remediation actions across the organisation\u0026rsquo;s security tooling. The three pillars of SOAR are orchestration (connecting disparate security tools into a unified, API-driven workflow so they exchange data and coordinate actions without human clipboard-copying), automation (executing repeatable investigation and containment steps at machine speed, consistently and without analyst fatigue), and case management (tracking the full lifecycle of a security incident — detection, triage, investigation, containment, eradication, recovery, and post-incident review — in a structured, auditable record). Leading platforms include Splunk SOAR (formerly Phantom), IBM QRadar SOAR (formerly Resilient), Palo Alto XSOAR (formerly Demisto), Microsoft Sentinel with Playbooks (Logic Apps), and open-source options such as TheHive with Cortex.\nInputs and enrichment. A SOAR platform\u0026rsquo;s primary input is a structured alert from the SIEM — a normalised, correlated event with severity, source entities (IP, user, pod, namespace, container image), and the raw evidence that triggered it. On top of this, SOAR orchestrates enrichment queries to a constellation of connected systems before the playbook makes any response decision: threat intelligence platforms (MISP, VirusTotal, Recorded Future) for IOC reputation; asset databases and CMDBs for context on the affected host or workload; LDAP/AD and SSSD for user identity and group membership of the authenticating principal; vulnerability scanners for CVE data on the affected image; and the Kubernetes/OpenShift API directly for the current state of the pod, namespace, service account, RBAC bindings, and NetworkPolicy associated with the affected workload. This enrichment transforms a raw \u0026ldquo;suspicious process execution in pod X\u0026rdquo; alert into a fully contextualised case: the pod is in the payments namespace, owned by service account payments-processor, which has a ClusterRoleBinding granting it cluster-admin (unexpected and policy-violating), the node it runs on is a worker with no other high-risk workloads, and the image has a KEV-listed CVE in the process that executed. With that context, the playbook can make a proportionate automated decision rather than binary block-or-ignore.\nFeedback to Kubernetes/OpenShift — the critical difference from SIEM. Unlike a SIEM, a SOAR platform has bidirectional integration with connected platforms: it does not just receive telemetry, it issues commands. For Kubernetes and OpenShift, SOAR playbooks can execute the following response actions via the Kubernetes API or platform-specific APIs: Network isolation — applying a deny-all NetworkPolicy to the affected namespace or a specific pod label selector, cutting the workload\u0026rsquo;s network access while leaving it running for forensic evidence collection; Pod quarantine or deletion — calling kubectl delete pod or annotating the pod with a quarantine label that a custom controller or RHACS policy enforces; RBAC revocation — deleting or patching the offending RoleBinding or ClusterRoleBinding that granted excessive permissions to the compromised service account; Node cordoning — issuing kubectl cordon \u0026lt;node\u0026gt; to prevent new pod scheduling on a potentially compromised node, followed by kubectl drain if evacuation is safe; Image admission blocking — calling the RHACS API to add the compromised image digest to a denylist policy, preventing it from being scheduled anywhere else in the cluster; Secret rotation trigger — calling Vault or ESO APIs to revoke and re-issue credentials associated with the compromised service account; and MachineConfig escalation — creating a support ticket or paging the node team to apply a remediation MachineConfig to affected RHCOS nodes, since direct node modification is not done through SOAR but through the MCO. The key operational discipline is playbook blast-radius calibration: automated actuation against a production cluster without a human approval gate carries the risk that a false positive detection triggers an automated network isolation of a critical payment processing pod during peak traffic. SOAR playbooks in Kubernetes contexts typically use a tiered automation model: low-risk enrichment and notification steps execute fully automatically; medium-risk actions (applying a NetworkPolicy) execute automatically but with immediate SOC notification and a rollback playbook on standby; high-risk or irreversible actions (pod deletion, ClusterRoleBinding revocation) require explicit analyst approval via a Teams/Slack approval button or a case management approval gate before execution. SOAR\u0026rsquo;s feedback to the SIEM closes the loop: once response actions are taken, the SOAR platform updates the SIEM incident record (closing the QRadar offense, updating the Splunk notable event, or annotating the Sentinel incident) with the actions taken, the timeline, and the analyst decisions — creating a complete, auditable chain from detection to containment in a single record.\n","externalUrl":null,"permalink":"/en/security/soar/","section":"Index","summary":"SOAR (Security Orchestration, Automation and Response) is the actuation complement to a SIEM: where the SIEM detects and alerts, SOAR responds and acts. It receives alerts — primarily from the SIEM, but also directly from EDR platforms, vulnerability scanners, cloud security posture tools, and CNI/container security platforms — and executes structured response playbooks: predefined, branching workflows that enrich the alert with additional context from connected systems, make automated or human-gated decisions based on that context, and issue remediation actions across the organisation’s security tooling. The three pillars of SOAR are orchestration (connecting disparate security tools into a unified, API-driven workflow so they exchange data and coordinate actions without human clipboard-copying), automation (executing repeatable investigation and containment steps at machine speed, consistently and without analyst fatigue), and case management (tracking the full lifecycle of a security incident — detection, triage, investigation, containment, eradication, recovery, and post-incident review — in a structured, auditable record). Leading platforms include Splunk SOAR (formerly Phantom), IBM QRadar SOAR (formerly Resilient), Palo Alto XSOAR (formerly Demisto), Microsoft Sentinel with Playbooks (Logic Apps), and open-source options such as TheHive with Cortex.\n","title":"SOAR (Security Orchestration, Automation and Response)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/soc/","section":"Tags","summary":"","title":"Soc","type":"tags"},{"content":"A SOC (Security Operations Centre) is the organisational function responsible for defending an infrastructure against security threats through continuous monitoring, alert triage, incident investigation, and coordinated response. It is not a single product: it is the combination of people (security analysts operating in tiered roles), processes (runbooks, escalation paths, incident classification, post-incident review), and technology (primarily a SIEM for detection and visibility, a SOAR platform for orchestration and actuation, EDR agents, vulnerability scanners, threat intelligence feeds, and ticketing or case management systems). The SOC\u0026rsquo;s purpose is to close the loop between something going wrong in the infrastructure and someone doing something about it — with enough structure that the response is consistent, attributable, and auditable regardless of which analyst is on shift. Operating models range from a fully internal 24×7 team, through a virtual SOC (vSOC) sharing analysts across business units, to an outsourced MDR (Managed Detection and Response) or MSSP engagement where a third party operates the SIEM and initial triage on the organisation\u0026rsquo;s behalf; the technology stack is largely the same across models, but the boundary of who performs each tier of work changes. Analyst tiers are conventionally structured as L1 (alert triage, false-positive filtering, initial enrichment, escalation decisions), L2 (deeper investigation, correlation across data sources, containment recommendations), and L3 (threat hunting, malware reverse engineering, incident lead, playbook authoring, purple-team exercises) — with escalation governed by severity classification (P1–P4 or equivalent), SLA targets for MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond), and documented runbooks that define what each tier may do autonomously versus what requires approval.\nThe SOC\u0026rsquo;s technology architecture follows a clear division of labour that maps directly to the glossary entries for its component platforms. The SIEM is the SOC\u0026rsquo;s eyes: it ingests logs and events from across the estate, correlates them, and produces alerts — but, as established in the SIEM entry, it has no actuation capability and no feedback path to the infrastructure it monitors. The SOAR platform is the SOC\u0026rsquo;s hands: it receives enriched alerts from the SIEM (or directly from EDR, CSPM, or container security tools), executes investigation and containment playbooks, and issues remediation commands to connected systems. Between them sits the analyst workflow: an alert fires in the SIEM, an L1 analyst validates it is not a false positive, a case is opened in the SOAR or case management system, enrichment queries pull context from threat intelligence (IOC reputation, KEV status of any CVEs in the affected asset), asset inventory, and identity systems (LDAP/AD, SSSD), and the playbook or analyst decides on containment. Break-glass account activations, bastion session anomalies, and privileged access events are high-priority SOC alert categories because they represent direct access to the administrative plane. Threat intelligence integration is not optional at SOC scale: correlating an alert against the KEV catalog, STIX/TAXII feeds, and ISAC sharing communities transforms a generic \u0026ldquo;suspicious outbound connection\u0026rdquo; into a prioritised incident with known actor attribution and documented remediation guidance. Compliance reporting — PCI DSS log review, NIST SP 800-53 AU controls, ISO 27001 incident management — is a secondary but operationally significant SOC output, typically generated from SIEM retention and reporting modules rather than from analyst manual effort.\nIn a Kubernetes or OpenShift environment, the SOC inherits a telemetry landscape that is both richer and more complex than a traditional VM estate. The primary detection inputs are the same streams described in the SIEM entry: OpenShift API audit logs (every kubectl and API server call), node-level authentication events via journald (SSSD, PAM), container runtime logs, RHACS/StackRox policy violations, Falco syscall alerts, OPA Gatekeeper admission denials, image vulnerability findings correlated against KEV and SBOM data, and NetworkPolicy or CNI flow anomalies. The SOC analyst\u0026rsquo;s investigation workflow for a Kubernetes alert differs from a host-based alert in one critical respect: the unit of compromise is often a pod or service account, not a host — containment means namespace isolation via NetworkPolicy, RBAC revocation of an over-privileged RoleBinding, pod quarantine or deletion, node cordoning, and image digest blocklisting via RHACS, not simply isolating an IP on a firewall. These actuation steps are executed by SOAR playbooks against the Kubernetes API, with the tiered automation model described in the SOAR entry: low-risk enrichment runs automatically, medium-risk network isolation runs automatically with analyst notification, and high-risk actions (ClusterRoleBinding deletion, node drain) require explicit human approval. The SOC\u0026rsquo;s relationship to platform-side log filtering is also worth stating explicitly: the OpenShift Logging Operator\u0026rsquo;s ClusterLogForwarder CRD is configured by platform engineers to route security-relevant streams to the SIEM endpoint, but the SOC defines which streams are security-relevant, at what volume, and with what retention — making the SOC a stakeholder in platform logging architecture, not merely a consumer of whatever the platform team happens to forward. A mature Kubernetes SOC also maintains runbooks for platform-specific scenarios: a compromised service account with cluster-admin, a privileged container breakout detected by Falco, a KEV-listed CVE in a running image on a production namespace, and a break-glass kubeconfig activation — each with defined escalation paths, pre-approved SOAR playbook triggers, and post-incident review requirements.\n","externalUrl":null,"permalink":"/en/security/soc/","section":"Index","summary":"A SOC (Security Operations Centre) is the organisational function responsible for defending an infrastructure against security threats through continuous monitoring, alert triage, incident investigation, and coordinated response. It is not a single product: it is the combination of people (security analysts operating in tiered roles), processes (runbooks, escalation paths, incident classification, post-incident review), and technology (primarily a SIEM for detection and visibility, a SOAR platform for orchestration and actuation, EDR agents, vulnerability scanners, threat intelligence feeds, and ticketing or case management systems). The SOC’s purpose is to close the loop between something going wrong in the infrastructure and someone doing something about it — with enough structure that the response is consistent, attributable, and auditable regardless of which analyst is on shift. Operating models range from a fully internal 24×7 team, through a virtual SOC (vSOC) sharing analysts across business units, to an outsourced MDR (Managed Detection and Response) or MSSP engagement where a third party operates the SIEM and initial triage on the organisation’s behalf; the technology stack is largely the same across models, but the boundary of who performs each tier of work changes. Analyst tiers are conventionally structured as L1 (alert triage, false-positive filtering, initial enrichment, escalation decisions), L2 (deeper investigation, correlation across data sources, containment recommendations), and L3 (threat hunting, malware reverse engineering, incident lead, playbook authoring, purple-team exercises) — with escalation governed by severity classification (P1–P4 or equivalent), SLA targets for MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond), and documented runbooks that define what each tier may do autonomously versus what requires approval.\n","title":"SOC (Security Operations Centre)","type":"security"},{"content":"SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA (American Institute of Certified Public Accountants). It is not government legislation or a certification scheme but a voluntary attestation standard — however, it has become a de facto market requirement for any technology company, cloud service provider, or SaaS vendor serving enterprise customers, particularly in the US. A SOC 2 report is produced by an independent CPA firm that evaluates an organization\u0026rsquo;s controls against the AICPA\u0026rsquo;s Trust Services Criteria (TSC), organized in five categories: Security (mandatory for all SOC 2 reports, covering Common Criteria CC1–CC9), Availability, Processing Integrity, Confidentiality, and Privacy (each optional depending on the organization\u0026rsquo;s services and customer commitments). The Common Criteria (CC1–CC9) are derived from the COSO Internal Control Framework and cover control environment, risk assessment, monitoring, logical/physical access, system operations, change management, and risk mitigation. There are two report types: Type I (evaluates control design at a point in time) and Type II (evaluates both design and operating effectiveness over 6–12 months — the standard enterprise customers demand). SOC 2 reports are restricted-use documents shared with customers under NDA. While not legally mandatory, major enterprises, financial institutions, and regulated industries routinely require SOC 2 Type II reports from their vendors before signing contracts, making it an essential market-access requirement for technology service providers.\nRed Hat holds SOC 2 Type II attestation for its cloud-hosted services, demonstrating that the controls governing Red Hat\u0026rsquo;s managed offerings (including Red Hat OpenShift Dedicated, ROSA, and Red Hat Insights) operate effectively over sustained periods. For Red Hat\u0026rsquo;s customers who must produce their own SOC 2 reports, the Red Hat platform provides the technical controls that map to Trust Services Criteria across all nine Common Criteria series. For CC6 (Logical and Physical Access): OpenShift RBAC, namespace isolation, network policies, and integration with enterprise identity providers enforce least-privilege access; RHEL\u0026rsquo;s PAM, SELinux, and audit subsystems provide OS-level access control evidence. For CC7 (System Operations): Red Hat Advanced Cluster Security delivers continuous monitoring, vulnerability detection, and runtime anomaly alerting; Red Hat Insights provides predictive analytics and drift detection. For CC8 (Change Management): OpenShift\u0026rsquo;s GitOps-based deployment model, Ansible\u0026rsquo;s idempotent playbooks, and the Operator lifecycle provide the auditable, version-controlled change management SOC 2 auditors verify. For Availability criteria: OpenShift\u0026rsquo;s self-healing operators, multi-cluster management, and Ansible-driven DR orchestration demonstrate the resilience controls auditors test. Red Hat\u0026rsquo;s shared responsibility documentation clearly delineates which SOC 2 controls are inherited from Red Hat\u0026rsquo;s managed services versus those customers must implement themselves — critical for scoping a customer\u0026rsquo;s own SOC 2 audit boundary.\nAdditional Information # AICPA SOC 2 Overview Trust Services Criteria 2017 (Revised 2022) - AICPA Red Hat SOC 2 compliance ","externalUrl":null,"permalink":"/en/compliance/soc2/","section":"Index","summary":"SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA (American Institute of Certified Public Accountants). It is not government legislation or a certification scheme but a voluntary attestation standard — however, it has become a de facto market requirement for any technology company, cloud service provider, or SaaS vendor serving enterprise customers, particularly in the US. A SOC 2 report is produced by an independent CPA firm that evaluates an organization’s controls against the AICPA’s Trust Services Criteria (TSC), organized in five categories: Security (mandatory for all SOC 2 reports, covering Common Criteria CC1–CC9), Availability, Processing Integrity, Confidentiality, and Privacy (each optional depending on the organization’s services and customer commitments). The Common Criteria (CC1–CC9) are derived from the COSO Internal Control Framework and cover control environment, risk assessment, monitoring, logical/physical access, system operations, change management, and risk mitigation. There are two report types: Type I (evaluates control design at a point in time) and Type II (evaluates both design and operating effectiveness over 6–12 months — the standard enterprise customers demand). SOC 2 reports are restricted-use documents shared with customers under NDA. While not legally mandatory, major enterprises, financial institutions, and regulated industries routinely require SOC 2 Type II reports from their vendors before signing contracts, making it an essential market-access requirement for technology service providers.\n","title":"SOC 2","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/sovereignty/","section":"Tags","summary":"","title":"Sovereignty","type":"tags"},{"content":"SPIFFE (Secure Production Identity Framework for Everyone) is a CNCF graduated specification that defines a standard for workload identity: a universal answer to the question \u0026ldquo;how does a service prove who it is to another service, without a human provisioning a secret?\u0026rdquo; The core primitives are simple. A SPIFFE ID is a URI of the form spiffe://trust-domain/path that unambiguously names a workload within a trust domain — for example spiffe://prod.example.com/payments/api. A SVID (SPIFFE Verifiable Identity Document) is a cryptographically signed document asserting that SPIFFE ID, in one of two forms: an X.509-SVID, which is a standard X.509 certificate with the SPIFFE ID encoded in the Subject Alternative Name field (used for mTLS), or a JWT-SVID, which is a short-lived JWT bearing the SPIFFE ID as the sub claim (used for service-to-service authentication where TLS termination is handled elsewhere). A trust bundle is the set of CA certificates for a trust domain that relying parties use to validate SVIDs — analogous to a root CA store, but scoped to a SPIFFE trust domain. The Workload API is the local gRPC API through which a workload retrieves its SVID and the trust bundles of domains it needs to communicate with, with automatic rotation before expiry.\nSPIRE (SPIFFE Runtime Environment) is the CNCF reference implementation of the SPIFFE specification and the component operators actually deploy. A SPIRE deployment has two tiers. The SPIRE Server is the trust anchor for its domain: it maintains a registry of registration entries — policy rules mapping platform attestation attributes (a Kubernetes pod\u0026rsquo;s service account and namespace, an EC2 instance\u0026rsquo;s AMI ID, a process\u0026rsquo;s Unix UID) to SPIFFE IDs — and operates as, or delegates to, a Certificate Authority that signs X.509-SVIDs. In production, the Server runs in HA configuration behind a load balancer with its CA private key protected by an HSM or cloud KMS. The SPIRE Agent runs as a DaemonSet on every Kubernetes node or as a daemon on every VM and bare-metal host. On startup, the Agent attests itself to the Server using node-level platform evidence that cannot be spoofed: an AWS EC2 Instance Identity Document signed by the IMDS, a GCP instance identity token, a Kubernetes projected service account token, or a TPM quote — the Server verifies this evidence before issuing the Agent its own SVID and trusting it to vouch for workloads on that node. At runtime, when a workload calls the Workload API, the Agent identifies it by inspecting kernel-level metadata (Unix socket peer credentials, cgroup membership, Kubernetes pod metadata) without the workload presenting any pre-provisioned secret — the attestation is entirely based on observed platform state. The Agent then checks whether any registration entry matches, and if so, calls the Server to obtain or renew a short-lived SVID for that workload, typically with a TTL of one hour or less.\nSPIFFE/SPIRE is the zero-standing-credentials answer to the same class of problem that Vault and ESO address through secrets management. Where Vault issues database credentials and API tokens, SPIRE issues the cryptographic identity that other services use to authenticate the caller in the first place — the identity layer beneath the secrets layer. The practical payoff is mTLS with zero static secrets: every service in a cluster gets a SVID automatically, rotated continuously, and can present it to any other SPIRE-identified service without any human provisioning of certificates or passwords. Integration with cloud IAM is via SPIRE\u0026rsquo;s OIDC Federation capability: SPIRE exposes a standard OIDC discovery endpoint, allowing cloud providers (AWS STS, GCP Workload Identity Federation, Azure AD) to trust JWT-SVIDs as federated identity tokens and exchange them for short-lived cloud credentials — so a workload that needs to read from S3 presents its JWT-SVID to STS and receives a temporary IAM credential, with no access key ever stored anywhere. Cross-organisational identity is handled through SPIFFE Federation: two SPIRE Servers exchange trust bundles via a mutually authenticated federation endpoint, after which workloads in either domain can validate SVIDs from the other and establish mTLS across the trust boundary. In confidential computing environments, SPIRE\u0026rsquo;s TPM-based node attestation plugin integrates directly with the measured boot stack: the SPIRE Agent can present a TPM quote over PCR values as its node attestation evidence, meaning the SPIRE Server will only issue SVIDs to agents running on nodes that booted a verified, policy-compliant software stack.\nAdditional Information # SPIFFE / SPIRE Documentation ","externalUrl":null,"permalink":"/en/security/spiffe-spire/","section":"Index","summary":"SPIFFE (Secure Production Identity Framework for Everyone) is a CNCF graduated specification that defines a standard for workload identity: a universal answer to the question “how does a service prove who it is to another service, without a human provisioning a secret?” The core primitives are simple. A SPIFFE ID is a URI of the form spiffe://trust-domain/path that unambiguously names a workload within a trust domain — for example spiffe://prod.example.com/payments/api. A SVID (SPIFFE Verifiable Identity Document) is a cryptographically signed document asserting that SPIFFE ID, in one of two forms: an X.509-SVID, which is a standard X.509 certificate with the SPIFFE ID encoded in the Subject Alternative Name field (used for mTLS), or a JWT-SVID, which is a short-lived JWT bearing the SPIFFE ID as the sub claim (used for service-to-service authentication where TLS termination is handled elsewhere). A trust bundle is the set of CA certificates for a trust domain that relying parties use to validate SVIDs — analogous to a root CA store, but scoped to a SPIFFE trust domain. The Workload API is the local gRPC API through which a workload retrieves its SVID and the trust bundles of domains it needs to communicate with, with automatic rotation before expiry.\n","title":"SPIFFE / SPIRE","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/sr-iov/","section":"Tags","summary":"","title":"Sr-Iov","type":"tags"},{"content":"SR-IOV (Single Root I/O Virtualisation) is a PCI-SIG specification that lets one physical PCIe device (typically a NIC or accelerator) expose multiple lightweight Virtual Functions (VFs) — each assignable directly to a VM or container — while a Physical Function (PF) remains for management and global configuration. VFs bypass much of the hypervisor’s software switching path, delivering lower latency, higher throughput, and more deterministic behaviour than paravirtualised virtio alone — properties valued in telco NFV (vEPC, vRAN CU/DU, firewall, DPI) and in cloud-native packet workloads on Kubernetes.\nArchitecture: the NIC firmware schedules DMA and queues per VF; the hypervisor (KVM, ESXi) or container runtime maps VFs via VFIO or vendor plugins into guests. SR-IOV Network Virtualisation (SR-IOV NV) extensions address VEPA, hairpin, and overlay interactions with Open vSwitch or hardware offload. In Kubernetes, Multus, SR-IOV Network Operator, and device plugins attach VFs to Pods as secondary interfaces — often the data plane while a management interface stays on the CNI overlay.\nApproach Typical latency / CPU Use case virtio Higher software cost General workloads, flexibility SR-IOV VF Near bare-metal NIC UPF, vDU, high PPS VNFs DPDK on VF Userspace poll-mode on dedicated queues Telco packet pipelines Trade-offs include reduced mobility (VF pinning to host/NIC), finite VF counts per port, operational complexity (driver, firmware, NUMA alignment), and security boundaries (VF isolation depends on NIC and IOMMU). DPDK commonly runs atop SR-IOV VFs; PTP hardware timestamping may require specific NIC families. SmartNICs / DPUs (BlueField, IPU) extend the model with programmable pipelines and ARM control cores, blurring the line between SR-IOV and inline acceleration.\nAdditional Information # PCI-SIG SR-IOV Linux VFIO documentation Kubernetes SR-IOV Network Operator ","externalUrl":null,"permalink":"/en/telco/sr-iov/","section":"Index","summary":"SR-IOV (Single Root I/O Virtualisation) is a PCI-SIG specification that lets one physical PCIe device (typically a NIC or accelerator) expose multiple lightweight Virtual Functions (VFs) — each assignable directly to a VM or container — while a Physical Function (PF) remains for management and global configuration. VFs bypass much of the hypervisor’s software switching path, delivering lower latency, higher throughput, and more deterministic behaviour than paravirtualised virtio alone — properties valued in telco NFV (vEPC, vRAN CU/DU, firewall, DPI) and in cloud-native packet workloads on Kubernetes.\n","title":"SR-IOV","type":"telco"},{"content":"","externalUrl":null,"permalink":"/en/tags/ssh/","section":"Tags","summary":"","title":"Ssh","type":"tags"},{"content":"SSH (Secure Shell) is a cryptographic protocol, standardised in RFC 4251–4254, that provides a secure channel over an unsecured network for remote login, remote command execution, file transfer (via SFTP and SCP), and general TCP port forwarding. It replaced the plaintext protocols it was designed to obsolete — Telnet, rlogin, rsh, rcp — by providing mutual authentication and full session encryption. SSH is the universal administrative access mechanism for Linux servers, network devices, and embedded systems, and the transport layer for Git over SSH, Ansible, Fabric, and most configuration management tooling. The protocol stack has three layers: SSH-TRANS (the transport layer — handles the initial key exchange, server authentication, and establishes the encrypted channel), SSH-AUTH (the authentication protocol — authenticates the client to the server using one of several methods), and SSH-CONN (the connection protocol — multiplexes the encrypted channel into multiple logical channels for sessions, port forwards, and X11 forwarding).\nThe handshake establishes the session\u0026rsquo;s cryptographic parameters through a key exchange that provides forward secrecy: both sides negotiate an algorithm (curve25519-sha256 is the modern default, using X25519 ECDH), exchange key shares, and derive session keys without those keys ever being transmitted. The server then authenticates itself to the client by signing the session identifier with its host key — the long-term identity key that the server administrator generates (ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key) and that clients record in ~/.ssh/known_hosts on first connection. The known_hosts model is Trust On First Use (TOFU): the first connection to a host records the host key fingerprint, and subsequent connections verify it matches — preventing impersonation after the first contact but not during it. The alternative — SSH certificates — replaces TOFU with a proper PKI: a CA signs host keys with ssh-keygen -s ca_key -I host_id -h host_key.pub, producing a ssh_host_ed25519_key-cert.pub that clients verify against the CA\u0026rsquo;s public key configured in known_hosts as @cert-authority * ssh-ed25519 AAAA.... Clients no longer need per-host entries; the CA signature is the trust anchor. The same CA mechanism works for client authentication: ssh-keygen -s ca_key -I user_id -n username user_key.pub issues a user certificate that the server trusts via TrustedUserCAKeys /etc/ssh/trusted_cas in sshd_config, with validity periods, source IP restrictions, and permitted command restrictions (-O options) embedded in the certificate itself — the basis for short-lived SSH certificate issuance used by Vault (vault ssh -mode=ca) and SPIFFE-adjacent tooling.\nClient authentication methods are the operational centre of SSH security in this glossary\u0026rsquo;s context. Public key authentication — the dominant secure method — requires the client to prove possession of the private key corresponding to a public key listed in the server\u0026rsquo;s ~/.ssh/authorized_keys; the proof is a signature over the session identifier, so the private key never leaves the client. Private keys should always be passphrase-protected at rest and stored in an SSH agent (ssh-agent, gpg-agent, or a hardware token\u0026rsquo;s agent interface) so the passphrase is entered once per session rather than per connection. Certificate authentication (described above) is preferable at scale because it eliminates authorized_keys management across a fleet — adding or revoking access is a CA operation rather than an authorized_keys edit on every server. FIDO2/hardware token authentication (sk key types: ecdsa-sk, ed25519-sk) binds the private key to a hardware security key (YubiKey, SoloKey) so that authentication requires both the key file and physical presence of the hardware token — providing a second factor without a separate OTP step, since the token\u0026rsquo;s resident credential never leaves its hardware. Password authentication should be disabled in sshd_config (PasswordAuthentication no) on any Internet-facing host; it is vulnerable to brute force and credential stuffing even with fail2ban mitigation. In the PAM and bastion context, SSH is the transport that PAM platforms record, gate, and inject credentials into; the bastion host model is fundamentally an SSH jump host (ProxyJump bastion.example.com in the client\u0026rsquo;s ~/.ssh/config, or ssh -J bastion target), and modern PAM platforms replace raw SSH access with a brokered session that records the full terminal transcript. The PQC transition affects SSH at two points: key exchange (the mlkem768x25519-sha256 hybrid group is available in OpenSSH 9.9+) and host/user key algorithms (ML-DSA host keys and user keys are under active IETF standardisation as the post-quantum replacement for Ed25519 and ECDSA in SSH certificates and authorized_keys).\n","externalUrl":null,"permalink":"/en/security/ssh/","section":"Index","summary":"SSH (Secure Shell) is a cryptographic protocol, standardised in RFC 4251–4254, that provides a secure channel over an unsecured network for remote login, remote command execution, file transfer (via SFTP and SCP), and general TCP port forwarding. It replaced the plaintext protocols it was designed to obsolete — Telnet, rlogin, rsh, rcp — by providing mutual authentication and full session encryption. SSH is the universal administrative access mechanism for Linux servers, network devices, and embedded systems, and the transport layer for Git over SSH, Ansible, Fabric, and most configuration management tooling. The protocol stack has three layers: SSH-TRANS (the transport layer — handles the initial key exchange, server authentication, and establishes the encrypted channel), SSH-AUTH (the authentication protocol — authenticates the client to the server using one of several methods), and SSH-CONN (the connection protocol — multiplexes the encrypted channel into multiple logical channels for sessions, port forwards, and X11 forwarding).\n","title":"SSH (Secure Shell)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/sso/","section":"Tags","summary":"","title":"Sso","type":"tags"},{"content":"SSSD (System Security Services Daemon) is a multi-daemon suite that connects Linux systems to remote identity and authentication providers, presenting their data through the standard Linux identity interfaces — NSS (Name Service Switch) for identity lookups (user names, UIDs, GIDs, group membership) and PAM (Pluggable Authentication Modules) for authentication and session management — without creating local user accounts. It was originally developed as a component of the FreeIPA project at Red Hat, introduced in Fedora 11 (2009), and quickly became the standard identity integration layer across RHEL, Fedora, Ubuntu, Debian, and most enterprise Linux distributions. Before SSSD, integrating a Linux host with LDAP or AD required configuring nss_ldap, pam_ldap, pam_krb5, and pam_winbind independently — each with its own caching (or lack thereof), its own reconnection logic, and its own configuration syntax. SSSD replaced this collection with a single, unified daemon providing caching, offline authentication, multi-domain support, and access control in one place.\nSSSD\u0026rsquo;s architecture is built around providers — loadable modules that implement the connection to a specific backend type — and responders — protocol-specific daemons that answer NSS and PAM queries from the system. The providers supported include: ad (native Active Directory integration using LDAP for identity data and Kerberos 5 for authentication, with SID-to-UID mapping, PAC validation from Kerberos tickets, and automatic detection of AD sites and domain controllers via DNS SRV records — the recommended provider for AD-joined hosts); ldap (generic LDAP integration for OpenLDAP, 389 Directory Server, and other RFC 2307-compliant directories, with Kerberos or simple bind authentication); ipa (FreeIPA/Red Hat Identity Management integration, using the IPA-extended LDAP schema for HBAC rules, sudo rules, SSH key distribution, and certificate-based authentication); krb5 (standalone Kerberos authentication without LDAP identity lookup, for environments where identity comes from a separate source); and idp (OIDC/OAuth 2.0 integration for cloud identity providers supporting the device authorisation grant, available since SSSD 2.7). The sss NSS module (registered in /etc/nsswitch.conf as passwd: sss files, group: sss files) intercepts getpwnam(), getgrnam(), and related libc calls and forwards them to the SSSD responder, which either serves them from its local lmdb cache (sub-millisecond) or fetches them from the backend provider. The cache stores complete user entries, group memberships, and — when cache_credentials = true — Kerberos or password credentials, enabling offline authentication: a user who has logged in at least once can continue to authenticate while the network or identity provider is unavailable, using the cached credential hash.\nSSSD\u0026rsquo;s access control and security features make it the correct integration point for several security patterns in this glossary. HBAC (Host-Based Access Control) rules — defined centrally in FreeIPA or emulated via LDAP group membership in the simple_allow_groups SSSD option — restrict which users and groups may log in to which hosts, enforced in the PAM stack before the session is opened. sudo rule distribution (via sudo_provider = sssd) fetches sudo rules from the LDAP/IPA directory, enabling centralised privilege management without distributing /etc/sudoers files across a fleet — changes to sudo rules in the directory propagate to all hosts at the next SSSD cache refresh. SSH public key distribution (ssh_authorised_keys_command /usr/bin/sss_ssh_authorizedkeys) retrieves public keys from the sshPublicKey LDAP attribute or IPA user record, allowing central SSH key management without authorized_keys files on individual hosts. Certificate-based authentication (pam_cert_auth = true with certificate_verification) allows users to authenticate with a smartcard or FIDO2 token presenting an X.509 certificate whose subject matches their LDAP entry, verified against the CA configured in SSSD — tying PKI, FIDO2, and LDAP-based identity into a single authentication flow. SSSD integrates with realmd (realm join, realm permit) for automated AD and IPA domain joining, and with SELinux via the selinux_provider which fetches per-user SELinux context mappings from the IPA server, enabling domain users to receive different SELinux user mappings than local accounts. Diagnostics are via sssctl (sssctl user-checks, sssctl cache-expire, sssctl domain-status) and journalctl -u sssd with debug_level = 7 in sssd.conf for verbose provider tracing.\n","externalUrl":null,"permalink":"/en/security/sssd/","section":"Index","summary":"SSSD (System Security Services Daemon) is a multi-daemon suite that connects Linux systems to remote identity and authentication providers, presenting their data through the standard Linux identity interfaces — NSS (Name Service Switch) for identity lookups (user names, UIDs, GIDs, group membership) and PAM (Pluggable Authentication Modules) for authentication and session management — without creating local user accounts. It was originally developed as a component of the FreeIPA project at Red Hat, introduced in Fedora 11 (2009), and quickly became the standard identity integration layer across RHEL, Fedora, Ubuntu, Debian, and most enterprise Linux distributions. Before SSSD, integrating a Linux host with LDAP or AD required configuring nss_ldap, pam_ldap, pam_krb5, and pam_winbind independently — each with its own caching (or lack thereof), its own reconnection logic, and its own configuration syntax. SSSD replaced this collection with a single, unified daemon providing caching, offline authentication, multi-domain support, and access control in one place.\n","title":"SSSD (System Security Services Daemon)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/standards/","section":"Tags","summary":"","title":"Standards","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/storage/","section":"Tags","summary":"","title":"Storage","type":"tags"},{"content":"Storage encryption is not a single feature but a four-layer decision that must be made independently, because each layer addresses a different adversary and a different failure mode. Layer 1 — disk/OSD at-rest encryption protects against physical media theft: a decommissioned OSD or stolen drive is unreadable without the key. Layer 2 — cluster-internal wire encryption protects against a network-layer attacker who can observe traffic between storage nodes: OSDs, monitors, and clients on the cluster network. Layer 3 — PV/volume-level encryption protects against a storage operator or another tenant reading a workload\u0026rsquo;s data through the storage system itself — the threat model where the storage cluster is itself potentially untrusted or multi-tenant. Layer 4 — object storage server-side encryption provides per-object key management for S3-compatible workloads, enabling customer-managed keys (CMK) and per-tenant key isolation in object stores. These layers are independent and composable: enabling Layer 1 without Layer 2 protects against physical theft but not a network interceptor; enabling Layer 3 without Layer 1 protects against the storage operator but not physical media extraction. A complete encryption posture addresses all four explicitly, even if some layers are deliberately left disabled with a documented rationale.\nLayer 1 — disk/OSD at-rest encryption. In Ceph and Red Hat ODF, OSD-level encryption wraps each OSD\u0026rsquo;s underlying block device with dm-crypt/LUKS (currently LUKS v1 in Ceph, for broadest compatibility). When OSD provisioning runs, the OSD service generates a unique per-OSD encryption key, passes it to the Ceph Monitors via an authenticated JSON payload over stdin, and the Monitor stores it in the cluster keyring. Encryption is not enabled by default and must be set explicitly — in ODF via the installation wizard (Security and network step → \u0026ldquo;Encryption at rest\u0026rdquo;) or in rook-ceph via spec.encryption.enable: true in the CephCluster CR; in Ceph directly via the OSD service spec with encryption: true. Keys can be managed internally (stored in the Monitor keyring) or externally via a KMS (HashiCorp Vault, Thales CipherTrust, IBM HPCS, AWS KMS) configured in rook-ceph\u0026rsquo;s ConfigMap and referenced in the cluster spec. With external KMS, OSD keys are wrapped by a Vault-managed master key and only accessible to the Ceph cluster\u0026rsquo;s service identity — the KMS becomes the trust anchor for all OSD data. The equivalent in other systems: LVM/LUKS on individual disks for traditional Linux servers; AWS EBS volume encryption with KMS; Azure Disk Encryption; GCP CMEK-encrypted Persistent Disks; Pure Storage and NetApp hardware arrays with self-encrypting drives (SEDs) managed by the controller. Important caveat: OSD encryption protects the physical media; data in DRAM on the OSD host, in OSD buffer caches, and in transit between OSDs is not covered by this layer.\nLayer 2 — cluster-internal wire encryption. Ceph\u0026rsquo;s messenger v2 (msgr2) protocol, the default since RHCS 4 and ODF 4.x, supports three connection modes: crc (integrity checking, no confidentiality), secure (authenticated encryption using AES-GCM), and prefer-secure (negotiate secure if the peer supports it, fall back to crc). Enabling secure mode encrypts all Ceph protocol traffic between clients, OSDs, Monitors, and the MDS — the full cluster fabric — with AES-128-GCM. In ODF, this is enabled via rook-ceph by setting network.encryption.enabled: true in the CephCluster CR, which sets ms_cluster_mode = secure and ms_service_mode = secure in the Ceph configuration. The Ceph Object Gateway (RGW) and ODF\u0026rsquo;s S3 endpoint terminate TLS at the RGW or at the Ingress/Route in front of it; the connection from the RGW to the OSDs is protected by msgr2 secure mode. For NFS exports from Ceph (via NFS-Ganesha backed by CephFS), NFS v4.1+ Kerberos (krb5p security flavour) provides wire encryption; without Kerberos, NFS traffic is unencrypted and should be protected by IPsec or MACsec at the network layer if traversing untrusted segments. For iSCSI (via Ceph\u0026rsquo;s tcmu-runner iSCSI gateway), iSCSI over TLS or IPsec is required for wire encryption. Other storage systems: NetApp ONTAP uses CIFS/SMB3 encryption and NFS Kerberos; Pure FlashArray offers Replication Encryption over TLS; AWS EFS uses TLS for in-transit encryption enabled by mount option (-o tls).\nLayer 3 — PV/volume-level encryption. This layer encrypts individual Persistent Volumes with per-PV keys, so that even the storage operator (who controls the OSD layer) cannot read a specific workload\u0026rsquo;s data without the KMS credential bound to that workload\u0026rsquo;s namespace or PVC. In ODF, this is provided by the ocs-storagecluster-ceph-rbd-encrypted StorageClass (created automatically when StorageClass encryption is enabled in the ODF wizard). When a PVC is created against this StorageClass, the Ceph CSI driver requests a new encryption key from Vault (or another configured KMS) under a path namespaced to the PVC UID, wraps the key using Vault\u0026rsquo;s transit engine, stores the wrapped key in the PVC\u0026rsquo;s volume attributes, and passes the unwrapped key to dm-crypt on the node where the PV is attached — the data on the OSD is encrypted by both the OSD-level LUKS key (Layer 1) and the PV-level key (Layer 3), in independent layers. Revoking the Vault path for a specific PVC makes that volume\u0026rsquo;s data permanently inaccessible without affecting any other PVC. The key hierarchy is visible in Vault: each PVC generates a unique key at odf/\u0026lt;pvc-uid\u0026gt;, and OSD keys appear at rook-ceph-osd-encryption-key-\u0026lt;device-set\u0026gt;. Per-namespace key isolation is achievable by configuring separate Vault namespaces or paths per OpenShift namespace, binding the StorageClass to a specific KMS path prefix. The equivalent in other platforms: AWS EBS with per-volume CMKs; Kubernetes StorageClass with encrypted: true and kmsKeyId for EBS CSI; the secrets-store-csi-driver can serve encryption key material to volume init containers; Portworx PX-Encrypt with per-namespace key management; Rook-Ceph with external KMS applies the same architecture to non-ODF Ceph.\nLayer 4 — object storage server-side encryption. ODF\u0026rsquo;s object storage layer is NooBaa (for multi-cloud gateway object routing) and Ceph RGW (for S3-compatible block object storage). Ceph RGW supports three S3 server-side encryption modes mirroring AWS S3 SSE: SSE-S3 (RGW manages the keys internally, one key per object, transparent to the client — x-amz-server-side-encryption: AES256), SSE-KMS (RGW requests per-object keys from an external KMS such as Vault using the x-amz-server-side-encryption: aws:kms header and the x-amz-server-side-encryption-aws-kms-key-id header specifying the KMS key, enabling customer-managed keys with full KMS audit trails), and SSE-C (the client provides the encryption key per-request in the x-amz-server-side-encryption-customer-key header; RGW uses it to encrypt the object and discards it — the client bears full key management responsibility, and loss of the key means permanent loss of the data). NooBaa encrypts its internal data using a root master key stored in a Secret or optionally in Vault (noobaa-root-master-key-backend in the Vault path listing). AWS S3, Azure Blob Storage, and GCP Cloud Storage all implement equivalent SSE-S3/SSE-KMS/SSE-C (or CMEK) models. The KMS integration pattern is consistent across all layers: a Vault kv or transit secrets engine, an AppRole or Kubernetes auth method for the CSI driver or RGW service identity, and a Vault policy restricting each component to its own key namespace — the same Vault deployment can serve Layer 1 OSD key wrapping, Layer 3 PV key issuance, and Layer 4 SSE-KMS simultaneously, with separate policies isolating each.\n","externalUrl":null,"permalink":"/en/security/storage-encryption/","section":"Index","summary":"Storage encryption is not a single feature but a four-layer decision that must be made independently, because each layer addresses a different adversary and a different failure mode. Layer 1 — disk/OSD at-rest encryption protects against physical media theft: a decommissioned OSD or stolen drive is unreadable without the key. Layer 2 — cluster-internal wire encryption protects against a network-layer attacker who can observe traffic between storage nodes: OSDs, monitors, and clients on the cluster network. Layer 3 — PV/volume-level encryption protects against a storage operator or another tenant reading a workload’s data through the storage system itself — the threat model where the storage cluster is itself potentially untrusted or multi-tenant. Layer 4 — object storage server-side encryption provides per-object key management for S3-compatible workloads, enabling customer-managed keys (CMK) and per-tenant key isolation in object stores. These layers are independent and composable: enabling Layer 1 without Layer 2 protects against physical theft but not a network interceptor; enabling Layer 3 without Layer 1 protects against the storage operator but not physical media extraction. A complete encryption posture addresses all four explicitly, even if some layers are deliberately left disabled with a documented rationale.\n","title":"Storage Encryption","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/supply-chain/","section":"Tags","summary":"","title":"Supply-Chain","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/symmetric/","section":"Tags","summary":"","title":"Symmetric","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/sync/","section":"Tags","summary":"","title":"Sync","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/syscall/","section":"Tags","summary":"","title":"Syscall","type":"tags"},{"content":"A system call (syscall) is the formal interface through which a user-space process asks the kernel to perform a privileged operation on its behalf — opening a file, allocating memory, creating a process, establishing a network connection, sending a signal, or any other action that requires kernel mediation. User-space code runs at CPU privilege level 3 (ring 3) and cannot directly access hardware, manipulate kernel data structures, or perform I/O; the kernel runs at ring 0 with unrestricted access. A syscall is the crossing point: the process places its request in a defined register convention and issues a syscall instruction (on x86-64) that atomically switches the CPU to ring 0 and transfers control to the kernel\u0026rsquo;s syscall dispatch table. The kernel validates the request, performs the operation if permitted by standard Unix permissions and any active LSM hooks, and returns the result. From a security perspective, the syscall boundary is the complete list of what a process can ask the kernel to do — and therefore the complete list of operations that security controls like seccomp and BPF LSM can police.\nLinux currently has roughly 350 syscalls on x86-64 (the exact count varies by architecture and kernel version), ranging from mundane operations (read, write, open, close, mmap) to powerful but narrow ones (ptrace, mount, kexec_load, perf_event_open, bpf) to obsolete or rarely used ones (uselib, sysfs, nfsservctl). Architecture matters: a 64-bit kernel also handles 32-bit compatibility calls through a separate dispatch table, which is why seccomp profiles must account for both x86_64 and x32 or i386 syscall numbers when running on a host that allows 32-bit binaries — a frequent source of container escape bugs when legacy compat syscalls are left unfiltered. Each syscall is identified by a number and a name; the kernel exposes its current syscall table via /proc/kallsyms and ausyscall --dump. The security relevance of the syscall boundary is that it is the only way for a process to interact with the kernel: a container that is denied network access via network namespace isolation but can call socket() and finds a namespace escape vulnerability is still constrained by whether seccomp blocks socket() outright — defence in depth at the syscall layer provides a fallback when higher-level isolation is bypassed.\nSyscalls are the foundation on which the other entries in this section compose. seccomp filters the allowed set of syscalls a process may invoke. cgroups intercept at the scheduling and resource accounting layer triggered by kernel paths that syscalls enter. eBPF programs attach to kprobes and tracepoints at individual syscall entry and exit points, giving observability and policy enforcement with per-argument visibility. LSM hooks fire from within syscall implementation paths — security_file_open() fires from openat(), security_socket_connect() from connect() — allowing MAC decisions based on the full semantic context of the operation rather than just the syscall number. In confidential computing, the guest kernel\u0026rsquo;s syscall interface is what KubeVirt and Kata Containers isolate behind a VM boundary: a kernel exploit that would normally give a container an escape to the host is contained within the guest kernel, because the host\u0026rsquo;s kernel is only reachable through the hypervisor interface, not through the guest syscall table.\n","externalUrl":null,"permalink":"/en/security/syscall/","section":"Index","summary":"A system call (syscall) is the formal interface through which a user-space process asks the kernel to perform a privileged operation on its behalf — opening a file, allocating memory, creating a process, establishing a network connection, sending a signal, or any other action that requires kernel mediation. User-space code runs at CPU privilege level 3 (ring 3) and cannot directly access hardware, manipulate kernel data structures, or perform I/O; the kernel runs at ring 0 with unrestricted access. A syscall is the crossing point: the process places its request in a defined register convention and issues a syscall instruction (on x86-64) that atomically switches the CPU to ring 0 and transfers control to the kernel’s syscall dispatch table. The kernel validates the request, performs the operation if permitted by standard Unix permissions and any active LSM hooks, and returns the result. From a security perspective, the syscall boundary is the complete list of what a process can ask the kernel to do — and therefore the complete list of operations that security controls like seccomp and BPF LSM can police.\n","title":"Syscall (System Call)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/systemd/","section":"Tags","summary":"","title":"Systemd","type":"tags"},{"content":"The Trusted Computing Base (TCB) is everything you must trust for your security guarantees to hold: CPU and firmware, the host kernel, the hypervisor, the container runtime, the kubelet, identity and secrets infrastructure, and any management plane that can change workload configuration. If any component in the TCB is buggy, misconfigured, or controlled by an adversary, the whole security argument fails — regardless of how well the application itself is written. The classic design principle is TCB minimisation: keep this set as small as possible, because every added component is another place where a flaw can void your policy. \u0026ldquo;Trusted\u0026rdquo; here does not mean \u0026ldquo;trustworthy in practice\u0026rdquo;; it means \u0026ldquo;assumed correct by the security model.\u0026rdquo;\nSecurity analysis always starts by drawing the TCB boundary. A process on bare metal trusts the kernel and firmware. A container on Kubernetes additionally trusts the host kernel (shared with every other container on the node), containerd or CRI-O, the kubelet, CNI, and often the cloud hypervisor beneath the VM — a large TCB with a large shared blast radius. A VM via KubeVirt adds QEMU/KVM and libvirt to the host TCB but gives the workload its own kernel. Kata Containers and OpenShift Sandboxed Containers push the isolation boundary to a micro-VM so a container escape must cross a VM boundary first, though the hypervisor remains in the host TCB. Hardening does not remove the TCB but constrains it: SELinux sVirt isolates QEMU processes, seccomp limits syscall exposure, measured boot and Secure Boot make firmware-to-kernel transitions auditable, and RHCOS on OpenShift shrinks mutable host configuration. The residual risk is structural: you are still trusting whoever operates the layers below your workload.\nConfidential computing reframes the problem by shrinking what the workload owner must trust. A TEE — TDX, SEV-SNP, or Arm CCA — encrypts guest memory so the hypervisor and cloud operator fall outside the workload\u0026rsquo;s confidentiality TCB even if they are compromised. CoCo (Confidential Containers) treats the Kubernetes control plane as explicitly untrusted and uses Kata Containers plus Trustee attestation to release secrets only into verified Confidential VMs. A Confidential Cluster goes further by running every node, including the control plane, inside CVMs so the infrastructure operator is excluded from the cluster TCB entirely. Attestation (TPM, Keylime, Trustee) is how you verify the TCB before trusting it: signed evidence that firmware, kernel, and guest images match expected measurements. Together, these technologies do not eliminate trust — they make the trusted set smaller, explicit, and cryptographically checkable.\nAdditional Information # Confidential Computing Consortium Introduction to confidential virtual machines (Jun 8, 2023) ","externalUrl":null,"permalink":"/en/security/tcb/","section":"Index","summary":"The Trusted Computing Base (TCB) is everything you must trust for your security guarantees to hold: CPU and firmware, the host kernel, the hypervisor, the container runtime, the kubelet, identity and secrets infrastructure, and any management plane that can change workload configuration. If any component in the TCB is buggy, misconfigured, or controlled by an adversary, the whole security argument fails — regardless of how well the application itself is written. The classic design principle is TCB minimisation: keep this set as small as possible, because every added component is another place where a flaw can void your policy. “Trusted” here does not mean “trustworthy in practice”; it means “assumed correct by the security model.”\n","title":"TCB (Trusted Computing Base)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/tdd/","section":"Tags","summary":"","title":"Tdd","type":"tags"},{"content":"Intel Trust Domain Extensions (TDX) is a confidential computing technology built into Intel CPUs that allows entire virtual machines — called Trust Domains (TDs) — to run with hardware-enforced isolation from the host hypervisor, VMM, and any other software on the platform, including privileged system software with administrative access. Unlike SGX, which protects small application-level enclaves, TDX operates at the VM level, making it suitable for lifting existing workloads into a confidential environment without significant code changes.\nTDX achieves this through two key mechanisms. First, a new CPU operation mode called SEAM (Secure Arbitration Mode) hosts the TDX module — a CPU-measured firmware module that sits between the host VMM and the guest TD, managing their separation. The host cannot directly access TD register state or memory; interactions that would normally cause a VMEXIT are instead handled inside the guest via a Virtualization Exception (#VE). Second, all TD private memory is encrypted with a per-TD AES-XTS 128-bit key managed by the CPU, ensuring that even physical memory access yields only ciphertext.\nFor measured boot and attestation, TDX uses RTMR registers (Runtime Measurement Registers) — analogous to TPM PCRs but scoped to the TD — to record hashes of the initial TD state, kernel image, firmware, command line, initrd, and ACPI tables. The TD can produce a TDREPORT: a CPU-signed structure containing those measurements, which can be forwarded to an Intel SGX Quoting Enclave to produce a remotely verifiable Quote for remote attestation. This allows a relying party to verify the exact software stack running inside a TD before sending it sensitive data. TDX is a foundational building block in Confidential Computing stacks and pairs naturally with TPM-based and UKI-based measured boot pipelines in Linux guests.\nAdditional Information # = Intel TDX Demystified: A Top-Down Approach (Apr 2024)\n","externalUrl":null,"permalink":"/en/security/tdx/","section":"Index","summary":"Intel Trust Domain Extensions (TDX) is a confidential computing technology built into Intel CPUs that allows entire virtual machines — called Trust Domains (TDs) — to run with hardware-enforced isolation from the host hypervisor, VMM, and any other software on the platform, including privileged system software with administrative access. Unlike SGX, which protects small application-level enclaves, TDX operates at the VM level, making it suitable for lifting existing workloads into a confidential environment without significant code changes.\n","title":"TDX (Intel Trust Domain Extensions)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/tee/","section":"Tags","summary":"","title":"Tee","type":"tags"},{"content":"A Trusted Execution Environment (TEE) is a hardware-enforced isolated execution context whose confidentiality and integrity are protected by the CPU itself, rather than by software policy. The defining property of a TEE is that its guarantees hold against an adversary with full control of the software stack outside it — the hypervisor, the host operating system, the BIOS firmware, and even a user with physical access to the machine — because the enforcement is implemented in silicon and cannot be overridden by software. Code and data inside a TEE are encrypted in DRAM using a key held within the CPU\u0026rsquo;s memory controller or on-die security processor, CPU register state is isolated from the host at context switch boundaries, and memory integrity protection prevents the host from replaying, remapping, or aliasing TEE memory pages. The threat model TEEs are designed against is therefore the infrastructure provider: a cloud operator, a data centre staff member, or a co-tenant who controls the hypervisor layer — the party that traditional virtualisation, namespaces, and access control cannot protect against because they depend on a trusted host kernel.\nTEEs are not a single technology but a family of implementations that share the same conceptual model at different granularities and from different CPU vendors. At the process level, Intel SGX (Software Guard Extensions) creates small isolated regions called enclaves within a process\u0026rsquo;s address space — the enclave code and data are hardware-encrypted and inaccessible to the OS or hypervisor, but the enclave must be written to run without system calls (or via a shim layer), making it suitable for small, cryptographic, or credential-holding components rather than general workloads. At the virtual machine level, Intel TDX (Trust Domain Extensions) and AMD SEV-SNP (Secure Encrypted Virtualization — Secure Nested Paging) lift the TEE boundary to encompass an entire VM: the guest kernel, all userspace processes, and the full memory of the VM are protected, requiring no application changes and making it practical to run existing workloads in a confidential environment by simply changing the hypervisor configuration. Arm CCA (Confidential Compute Architecture) and its Realm construct provide an analogous VM-level TEE on AArch64 platforms. At the SoC level, Arm TrustZone divides the CPU into a secure world and a normal world at the hardware level, used in embedded and mobile devices (Android\u0026rsquo;s Trusted Execution Environment for key storage, biometric processing, and DRM) rather than in server confidential computing.\nThe two properties that make a TEE actionable beyond mere isolation are attestation and sealing. Attestation is the mechanism by which a TEE proves its identity and configuration to a remote party: the CPU produces a signed evidence document — an SGX Quote, a TDX Quote, or a SEV-SNP attestation report — containing the hash of the code and initial data loaded into the TEE, the platform\u0026rsquo;s firmware version, and security-relevant configuration, all signed by a hardware-rooted key whose certificate chain is published by the CPU vendor (Intel\u0026rsquo;s DCAP infrastructure, AMD\u0026rsquo;s Key Distribution Service). A remote verifier can check this evidence against the vendor certificate chain and against expected reference values to confirm that the TEE is genuine hardware running unmodified, specific software — before sending it any secrets. Sealing is the complementary local operation: the TEE asks the CPU to encrypt a secret (a key, a credential, a policy) bound to the TEE\u0026rsquo;s identity so that only the same TEE configuration on the same hardware can decrypt it, providing persistence across TEE restarts without exposing the secret to the host. Together, attestation and sealing are what transform hardware isolation from a passive containment property into an active trust anchor: Trustee (for CoCo) uses attestation to gate secret delivery; Keylime uses TPM-anchored attestation (TPM being a related but distinct hardware root of trust) for conventional host integrity; LUKS disk encryption can be sealed to platform measurements via TPM PCRs, which is the non-TEE equivalent of TEE sealing. The CCC (Confidential Computing Consortium), hosted by the Linux Foundation, is the industry body that coordinates TEE standards, open-source TEE software stacks, and the definition of confidential computing as a discipline — its members include Intel, AMD, Arm, IBM, Google, Microsoft, and Red Hat.\n","externalUrl":null,"permalink":"/en/security/tee/","section":"Index","summary":"A Trusted Execution Environment (TEE) is a hardware-enforced isolated execution context whose confidentiality and integrity are protected by the CPU itself, rather than by software policy. The defining property of a TEE is that its guarantees hold against an adversary with full control of the software stack outside it — the hypervisor, the host operating system, the BIOS firmware, and even a user with physical access to the machine — because the enforcement is implemented in silicon and cannot be overridden by software. Code and data inside a TEE are encrypted in DRAM using a key held within the CPU’s memory controller or on-die security processor, CPU register state is isolated from the host at context switch boundaries, and memory integrity protection prevents the host from replaying, remapping, or aliasing TEE memory pages. The threat model TEEs are designed against is therefore the infrastructure provider: a cloud operator, a data centre staff member, or a co-tenant who controls the hypervisor layer — the party that traditional virtualisation, namespaces, and access control cannot protect against because they depend on a trusted host kernel.\n","title":"TEE (Trusted Execution Environment)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/telco/","section":"Tags","summary":"","title":"Telco","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/telecom/","section":"Tags","summary":"","title":"Telecom","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/tensor-parallelism/","section":"Tags","summary":"","title":"Tensor-Parallelism","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/tensorrt/","section":"Tags","summary":"","title":"Tensorrt","type":"tags"},{"content":"TensorRT is NVIDIA’s SDK for optimizing and deploying trained neural networks for inference on NVIDIA GPUs. Its objective is minimum latency and maximum throughput: it ingests a model (ONNX, TensorFlow, PyTorch export, or framework-specific parsers), applies graph optimizations (layer fusion, constant folding, kernel autotuning), selects precisions (FP32, FP16, INT8, FP8), and produces a serialized engine executed by a lightweight runtime. For LLMs, TensorRT-LLM extends this with attention-specific fusions, inflight batching, and multi-GPU serving patterns; many NIM microservices bundle TensorRT-LLM–optimized engines rather than raw PyTorch loops.\nArchitecturally, TensorRT shifts work from interpretive framework execution on the CPU orchestrating many small GPU kernels to a compiled plan tuned for specific GPU SKUs and batch shapes. Build time can be minutes (engine compilation is shape- and profile-sensitive); runtime is fast but less flexible than vLLM’s fully dynamic Python path unless built with dynamic shape profiles. Compared with cuDNN alone (operator library), TensorRT owns the whole graph and memory scheduling. Compared with CPU inference, TensorRT still requires GPU VRAM for weights and KV cache; optimizations do not remove LLM memory laws. Rebuilding engines is required when models, GPUs, or precision policies change.\nRed Hat customers deploy TensorRT inside NVIDIA NIM containers and partner images on OpenShift AI and RHEL GPU nodes—Red Hat supports the platform (Kubernetes, drivers, security), while NVIDIA maintains TensorRT releases tied to CUDA versions. Documentation describes running NIM and validated inference stacks on OpenShift with GPU operators and MIG sizing. Teams choosing TensorRT/NIM trade some openness (versus open vLLM) for vendor-tuned performance; Red Hat reference architectures often present both paths on the same OpenShift cluster for different SLAs and compliance needs.\n","externalUrl":null,"permalink":"/en/ai/tensorrt/","section":"Index","summary":"TensorRT is NVIDIA’s SDK for optimizing and deploying trained neural networks for inference on NVIDIA GPUs. Its objective is minimum latency and maximum throughput: it ingests a model (ONNX, TensorFlow, PyTorch export, or framework-specific parsers), applies graph optimizations (layer fusion, constant folding, kernel autotuning), selects precisions (FP32, FP16, INT8, FP8), and produces a serialized engine executed by a lightweight runtime. For LLMs, TensorRT-LLM extends this with attention-specific fusions, inflight batching, and multi-GPU serving patterns; many NIM microservices bundle TensorRT-LLM–optimized engines rather than raw PyTorch loops.\n","title":"TensorRT","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/tensorrt-llm/","section":"Tags","summary":"","title":"Tensorrt-Llm","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/throughput/","section":"Tags","summary":"","title":"Throughput","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/timing/","section":"Tags","summary":"","title":"Timing","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/tls/","section":"Tags","summary":"","title":"Tls","type":"tags"},{"content":"TLS (Transport Layer Security) is the protocol that establishes an encrypted, integrity-protected, and authenticated channel between two parties over an untrusted network. It is the successor to SSL (which is deprecated and broken) and the mechanism behind HTTPS, gRPC, LDAPS, SMTPS, database connections, and most other encrypted transport in modern infrastructure. The current version is TLS 1.3 (RFC 8446, 2018); TLS 1.2 remains in wide use but TLS 1.0 and 1.1 are deprecated by RFC 8996. The fundamental security properties TLS provides are: confidentiality (a passive observer cannot read the session content), integrity (an active attacker cannot modify session content without detection), and server authentication (the client can verify it is talking to the intended server rather than an impersonator). Client authentication is optional in standard TLS and is provided by mTLS.\nA TLS connection begins with a handshake that negotiates session parameters and establishes a shared secret. In TLS 1.3, the handshake is significantly simplified over 1.2: the client sends a ClientHello containing supported cipher suites and a key share (a Diffie-Hellman or ML-KEM public key value in PQC-hybrid deployments); the server responds with a ServerHello selecting the cipher suite, its own key share, and its X.509 certificate; both sides derive the session keys from the combined DH output; the server immediately sends a Finished message authenticated with those keys, and the handshake is complete in one round trip (1-RTT), with session resumption possible at 0-RTT for returning clients. The server\u0026rsquo;s certificate is signed by a CA in the client\u0026rsquo;s trust store, proving server identity; the client checks that the server\u0026rsquo;s hostname matches a SAN in the certificate and that the certificate chain validates to a trusted root and is not expired or revoked. After the handshake, all data is encrypted with AEAD (Authenticated Encryption with Associated Data) ciphers — in TLS 1.3, either AES-256-GCM or ChaCha20-Poly1305 — which simultaneously provide confidentiality and integrity, making separate MAC computation unnecessary. Forward secrecy is mandatory in TLS 1.3: the ephemeral DH key exchange means that even if the server\u0026rsquo;s long-term private key is later compromised, previously recorded sessions cannot be decrypted, since the session key was never persisted.\nTLS is the transport layer on which the rest of the security stack in this glossary is composed. mTLS extends it with client certificates for mutual authentication. SPIFFE/SPIRE uses X.509-SVIDs in TLS handshakes to provide workload-to-workload mTLS with zero static secrets. Vault exposes its API over TLS and issues short-lived TLS certificates via its PKI engine. Trustee and the KBS use attested TLS (aTLS) — a variant where the server\u0026rsquo;s TLS certificate is bound to a TEE attestation report, so the client simultaneously establishes an encrypted channel and verifies it is talking to a genuine TDX or SEV-SNP guest. The PQC transition affects TLS at the key exchange and authentication layers: ML-KEM replaces ECDH for key establishment (already deployed in hybrid form in Chrome and OpenSSL 3.4+), and ML-DSA replaces ECDSA for certificate signatures in the server\u0026rsquo;s X.509 certificate chain — addressing both the HNDL threat to confidentiality (via key exchange) and the long-term threat to server authentication (via certificate signatures).\n","externalUrl":null,"permalink":"/en/security/tls/","section":"Index","summary":"TLS (Transport Layer Security) is the protocol that establishes an encrypted, integrity-protected, and authenticated channel between two parties over an untrusted network. It is the successor to SSL (which is deprecated and broken) and the mechanism behind HTTPS, gRPC, LDAPS, SMTPS, database connections, and most other encrypted transport in modern infrastructure. The current version is TLS 1.3 (RFC 8446, 2018); TLS 1.2 remains in wide use but TLS 1.0 and 1.1 are deprecated by RFC 8996. The fundamental security properties TLS provides are: confidentiality (a passive observer cannot read the session content), integrity (an active attacker cannot modify session content without detection), and server authentication (the client can verify it is talking to the intended server rather than an impersonator). Client authentication is optional in standard TLS and is provided by mTLS.\n","title":"TLS (Transport Layer Security)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/tm-forum/","section":"Tags","summary":"","title":"Tm-Forum","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/tokens/","section":"Tags","summary":"","title":"Tokens","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/tooling/","section":"Tags","summary":"","title":"Tooling","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/tools/","section":"Tags","summary":"","title":"Tools","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/topics/","section":"Topics","summary":"","title":"Topics","type":"topics"},{"content":"","externalUrl":null,"permalink":"/en/tags/tpm/","section":"Tags","summary":"","title":"Tpm","type":"tags"},{"content":"A Trusted Platform Module (TPM) is a tamper-resistant security chip — implemented in hardware (dTPM), firmware (fTPM), or software — that acts as a hardware-anchored root of trust for a system. It provides a secure enclave for generating and storing cryptographic keys, performing cryptographic operations, and recording integrity measurements of the boot process.\nThe TPM\u0026rsquo;s most distinctive feature is its set of Platform Configuration Registers (PCRs): a series of hash accumulators that are extended (not overwritten) during the boot sequence. Firmware, bootloader, kernel, and initrd each contribute measurements to specific PCR banks, building a tamper-evident log of everything that ran before userspace. Standard TPMs expose 24 PCRs; PCRs 0–7 are owned by firmware (UEFI), while PCRs 8–15 are available to the OS. On Linux, these are allocated by convention: PCR 11 is used by systemd-stub to measure all UKI components, PCR 12 covers the kernel command line and credentials, PCR 13 covers initrd extension images, and PCR 15 is used for runtime identity measurements like the machine ID and filesystem UUIDs. The authoritative Linux-side allocation is maintained in the UAPI Linux TPM PCR Registry.\nPCR values serve two complementary purposes: forward-looking policy binding, where a secret is sealed against a known-good PCR state and can only be unsealed if the machine boots identically (enabling automatic disk unlocking via systemd-cryptenroll), and backward-looking attestation, where a verifier inspects a signed measurement log to confirm that a remote machine ran a specific software stack before granting it access to sensitive resources. TPMs pair naturally with UKIs and Secure Boot, and are a foundational component in Confidential Computing, measured boot, and zero-trust infrastructure stacks.\n","externalUrl":null,"permalink":"/en/security/tpm/","section":"Index","summary":"A Trusted Platform Module (TPM) is a tamper-resistant security chip — implemented in hardware (dTPM), firmware (fTPM), or software — that acts as a hardware-anchored root of trust for a system. It provides a secure enclave for generating and storing cryptographic keys, performing cryptographic operations, and recording integrity measurements of the boot process.\n","title":"TPM (Trusted Platform Module)","type":"security"},{"content":"Training is the phase of machine learning where model parameters are adjusted to minimize a loss on a dataset. For deep learning, that means repeated forward passes (compute predictions), backward passes (propagate gradients via autodiff), and optimizer steps (update weights)—from scratch pretraining, continued pretraining, or fine-tuning (full, LoRA, or other parameter-efficient methods). The objective is model quality (accuracy, perplexity, task metrics) within a compute and time budget, not millisecond response to end users. Training jobs are batch-oriented: large minibatches, epochs over terabytes of tokens or images, checkpointing to durable storage, and experiment tracking. LLM training at scale uses distributed strategies—data parallel, tensor parallel, pipeline parallel, and expert parallel for MoE—coordinated by frameworks such as PyTorch with FSDP or DeepSpeed.\nArchitecturally, training stresses sustained compute and inter-GPU bandwidth more than single-request latency. A CPU prepares data pipelines and launches kernels, but the heavy work is on GPUs executing matrix multiplications and attention; NCCL (or vendor collectives) synchronizes gradients across devices. Unlike inference, there is no per-user KV cache growing with chat length; memory is dominated by activations (often checkpointed or recomputed to save VRAM), optimizer states (Adam stores two moments per parameter), and sharded weights. Multi-node training depends on InfiniBand or RoCE latency between nodes; a single slow link stalls the whole step. Inference optimizes “many small sessions”; training optimizes “one job uses the whole cluster until convergence.” Mixed precision (BF16/FP8), gradient accumulation, and curriculum learning are training-specific techniques rarely applied to serving paths.\nRed Hat supports training workloads on Red Hat Enterprise Linux AI and OpenShift AI through GPU-enabled RHEL nodes, containerized PyTorch/Jupyter environments, and Kubernetes job scheduling for distributed training. Customers run training clusters or namespaces with GPU quotas, shared storage for datasets and checkpoints (Ceph, NFS, object storage), and MLOps tooling for experiment lineage. Red Hat’s AI portfolio emphasizes a path from curated models and InstructLab-style alignment on RHEL AI to deployment on OpenShift AI for inference; training may run on the same platform or on burst capacity, always under the same SELinux, identity, and subscription model. Partner hardware (NVIDIA, AMD) and reference designs document network topology and driver stacks for multi-GPU nodes so training jobs are supportable in production, not only in ad hoc lab VMs.\n","externalUrl":null,"permalink":"/en/ai/training/","section":"Index","summary":"Training is the phase of machine learning where model parameters are adjusted to minimize a loss on a dataset. For deep learning, that means repeated forward passes (compute predictions), backward passes (propagate gradients via autodiff), and optimizer steps (update weights)—from scratch pretraining, continued pretraining, or fine-tuning (full, LoRA, or other parameter-efficient methods). The objective is model quality (accuracy, perplexity, task metrics) within a compute and time budget, not millisecond response to end users. Training jobs are batch-oriented: large minibatches, epochs over terabytes of tokens or images, checkpointing to durable storage, and experiment tracking. LLM training at scale uses distributed strategies—data parallel, tensor parallel, pipeline parallel, and expert parallel for MoE—coordinated by frameworks such as PyTorch with FSDP or DeepSpeed.\n","title":"Training","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/training/","section":"Tags","summary":"","title":"Training","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/transformer/","section":"Tags","summary":"","title":"Transformer","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/transport/","section":"Tags","summary":"","title":"Transport","type":"tags"},{"content":"Trustee is the server-side attestation infrastructure for the CoCo (Confidential Containers) project, previously known as CoCo-KBS. It implements the relying-party and verifier roles from the IETF RATS (Remote ATtestation procedureS) architecture: it receives hardware attestation evidence from workloads running inside TEEs, verifies that evidence against known-good reference values, evaluates it against policy, and — if the workload passes — releases the secrets it needs to operate. Trustee runs outside the TEE in a separately trusted environment (a dedicated server, a different confidential VM, or a Kubernetes operator deployment) and is by design not accessible to the untrusted host or hypervisor.\nTrustee is composed of three services with distinct responsibilities. The Key Broker Service (KBS) is the front door: it speaks the RCAR (Request-Challenge-Attestation-Response) protocol with the Attestation Agent inside the guest TEE, issues cryptographic challenges, receives the resulting hardware evidence (a TDX Quote or SEV-SNP attestation report), and enforces access control over the secret resources it manages. The KBS maps to the RATS Relying Party. The Attestation Service (AS) is the evidence verifier: it receives raw TEE evidence from the KBS, calls the appropriate hardware-specific verifier (Intel DCAP for TDX, AMD\u0026rsquo;s certificate chain for SEV-SNP, or a third-party service such as Intel Trust Authority), and returns a signed attestation result token indicating whether the evidence is valid and which policy claims it satisfies. The AS maps to the RATS Verifier. The Reference Value Provider Service (RVPS) manages the ground truth: it stores the expected measurement values — the composefs digest of the OS image, the expected firmware version, the approved initrd hash — against which the AS evaluates evidence. An attestation passes only if the TEE\u0026rsquo;s measured values match what the RVPS records as acceptable.\nThe guest-side counterpart to Trustee is the Attestation Agent (AA) and Confidential Data Hub (CDH), which run inside the TEE as part of the CoCo guest components. The AA collects TEE-specific evidence and conducts the RCAR handshake with the KBS; the CDH provides in-guest APIs through which workload processes request secrets without ever seeing the KBS communication directly. Secrets released by the KBS — disk encryption keys, registry pull credentials, TLS certificates, API tokens — are delivered into the CDH inside the encrypted TEE memory and never exposed to the host. Trustee also supports a passport mode borrowed from RATS: a first KBS instance acts as a pure verifier and issues a signed attestation token (the passport); a second KBS instance, which may be operated by a different party, accepts that token without re-verifying the raw hardware evidence, enabling decoupled, multi-party secret provisioning workflows. In the broader glossary context, Trustee is the component that gives CoCo its secret delivery capability and is what distinguishes a confidential container from a merely isolated one: isolation is provided by TDX or SEV-SNP; trust, verified and acted upon, is provided by Trustee.\nRelevant Red Hat blog posts # Understanding the Confidential Containers Attestation Flow (Dec 2, 2022) Introducing Confidential Containers Trustee: Attestation Services Solution Overview and Use Cases (Apr 4, 2024) Deploying Red Hat build of Trustee ","externalUrl":null,"permalink":"/en/security/trustee/","section":"Index","summary":"Trustee is the server-side attestation infrastructure for the CoCo (Confidential Containers) project, previously known as CoCo-KBS. It implements the relying-party and verifier roles from the IETF RATS (Remote ATtestation procedureS) architecture: it receives hardware attestation evidence from workloads running inside TEEs, verifies that evidence against known-good reference values, evaluates it against policy, and — if the workload passes — releases the secrets it needs to operate. Trustee runs outside the TEE in a separately trusted environment (a dedicated server, a different confidential VM, or a Kubernetes operator deployment) and is by design not accessible to the untrusted host or hypervisor.\n","title":"Trustee","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/ubuntu/","section":"Tags","summary":"","title":"Ubuntu","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/uefi/","section":"Tags","summary":"","title":"Uefi","type":"tags"},{"content":"A Unified Kernel Image (UKI) is a single EFI executable that packages together the Linux kernel, the initramfs (initrd), the kernel command line, and optionally other resources like a splash screen or system credentials. Instead of relying on a bootloader to assemble these components at runtime, a UKI bundles them statically into one signed binary.\nThis design makes it a natural fit for Secure Boot: since the entire boot payload is signed as a unit, any tampering with the kernel, initrd, or boot parameters will break the signature and prevent the system from booting. UKIs are generated and managed by tools like ukify (part of systemd) and are central to modern Linux boot security stacks such as those used in Fedora, systemd-boot environments, and projects like bootc or Confidential Computing setups. They pair well with TPM-based measurements (via PCR registers) for remote attestation.\n","externalUrl":null,"permalink":"/en/security/uki/","section":"Index","summary":"A Unified Kernel Image (UKI) is a single EFI executable that packages together the Linux kernel, the initramfs (initrd), the kernel command line, and optionally other resources like a splash screen or system credentials. Instead of relying on a bootloader to assemble these components at runtime, a UKI bundles them statically into one signed binary.\n","title":"UKI (Unified Kernel Image)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/upf/","section":"Tags","summary":"","title":"Upf","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/usa/","section":"Tags","summary":"","title":"Usa","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/usb/","section":"Tags","summary":"","title":"Usb","type":"tags"},{"content":"USBGuard is a security framework for Linux that controls which USB devices are permitted to interact with the system. It sits above the kernel\u0026rsquo;s native USB authorisation subsystem — a per-device authorisation flag in the USB core that determines whether a device can be configured and begin sending data — and enforces a policy defined in a rule file against every device that connects or is present at startup. The threat model USBGuard addresses is both insider threat (unauthorised storage devices, data exfiltration) and hardware attack: BadUSB devices — malicious firmware embedded in devices that present themselves as HID keyboards, network adapters, or other trusted classes — can be blocked by a sufficiently specific USBGuard policy that restricts which USB interface classes are permitted. A USB device that claims to be a keyboard (03:01:01) but was not explicitly authorised cannot send keystrokes; a USB storage device plugged into a workstation with a policy that only allows a specific keyboard and mouse is blocked outright. USBGuard cannot protect against devices present at boot (before the daemon starts), so it is a defence-in-depth control for the running OS rather than a substitute for physical port security.\nThe daemon (usbguard-daemon) watches for USB events via the kernel\u0026rsquo;s uevent subsystem and evaluates each connecting device against an ordered set of rules in /etc/usbguard/rules.conf (or individual files under /etc/usbguard/rules.d/ loaded in alphanumeric order). Each rule specifies a verdict — allow, block, or reject — and a set of match conditions: USB vendor and product ID (id 04f2:0833), serial number, device name, port (via-port \u0026quot;7-2\u0026quot; — the physical port the device is plugged into), and interface classes (with-interface { 03:01:01 03:00:00 } for a composite HID keyboard/mouse device). Interface-class matching is the most security-relevant attribute: it is not forgeable at the USB protocol level, unlike the vendor/product ID and serial number fields which a rogue device\u0026rsquo;s firmware can set to any value. The ImplicitPolicyTarget setting in usbguard-daemon.conf controls what happens to devices that match no rule: block (silently prevent configuration) is the safe default for locked-down servers; allow is appropriate for workstations during initial policy capture. The standard onboarding workflow is usbguard generate-policy --no-hashes \u0026gt; /etc/usbguard/rules.conf with all permitted devices already connected, which snapshots the current device set as the allowed baseline; any subsequently connected device is blocked until an administrator explicitly adds a rule. At runtime, usbguard list-devices shows all connected devices and their current authorisation state, and usbguard allow-device \u0026lt;id\u0026gt; or usbguard block-device \u0026lt;id\u0026gt; makes temporary runtime changes that can be permanently promoted to the rules file.\nThe IPC interface that the usbguard CLI uses to communicate with the daemon is a significant attack surface: any process that can reach the IPC socket can change device authorisation state and modify policy. The access to this interface is limited to the root user only by default on RHEL; the IPCAllowedUsers and IPCAllowedGroups settings in usbguard-daemon.conf must be explicitly configured to restrict this to a minimal set of administrators. Leaving the ACL unconfigured exposes the IPC to all local users. USBGuard integrates with the Linux audit subsystem: policy events (device allowed, blocked, or rejected) are logged to the kernel audit log and queryable with ausearch -m USER_DEVICE, providing an immutable record of every USB device interaction. On RHEL, USBGuard is a CIS Benchmark Level 2 requirement for workstations and servers that handle sensitive data, and pairs naturally with fapolicyd (which controls what software a connected USB device might have introduced) and IMA (which can measure and attest the integrity of files accessed from a USB-backed filesystem). USBGuard itself mitigates its own attack surface by using a seccomp syscall allowlist and dropping unnecessary Linux capabilities at startup.\n","externalUrl":null,"permalink":"/en/security/usbguard/","section":"Index","summary":"USBGuard is a security framework for Linux that controls which USB devices are permitted to interact with the system. It sits above the kernel’s native USB authorisation subsystem — a per-device authorisation flag in the USB core that determines whether a device can be configured and begin sending data — and enforces a policy defined in a rule file against every device that connects or is present at startup. The threat model USBGuard addresses is both insider threat (unauthorised storage devices, data exfiltration) and hardware attack: BadUSB devices — malicious firmware embedded in devices that present themselves as HID keyboards, network adapters, or other trusted classes — can be blocked by a sufficiently specific USBGuard policy that restricts which USB interface classes are permitted. A USB device that claims to be a keyboard (03:01:01) but was not explicitly authorised cannot send keystrokes; a USB storage device plugged into a workstation with a policy that only allows a specific keyboard and mouse is blocked outright. USBGuard cannot protect against devices present at boot (before the daemon starts), so it is a defence-in-depth control for the running OS rather than a substitute for physical port security.\n","title":"USBGuard","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/userspace/","section":"Tags","summary":"","title":"Userspace","type":"tags"},{"content":"HashiCorp Vault is a secrets management platform designed to replace the pattern of static, long-lived credentials scattered across configuration files, environment variables, and CI pipelines with a centralised, policy-enforced, fully audited secrets API. Its core abstraction is that every secret has an identity (a path), an owner (determined by an auth method), a policy (an HCL HashiCorp Configuration Language document granting access to specific paths), and a lease (a TTL after which the secret expires or must be renewed). Nothing in Vault is persistent by default — every access is authenticated, every secret access is logged to an immutable audit trail, and credentials that are no longer needed expire automatically rather than accumulating indefinitely.\nVault\u0026rsquo;s most architecturally significant feature is its secrets engines: pluggable backends that define how a particular category of secret is generated or stored. The KV engine stores static key-value pairs (API keys, passwords) with optional versioning. The Database engine generates dynamic credentials — short-lived, unique username/password pairs — directly in a target database (PostgreSQL, MySQL, MongoDB), rotated automatically, so no application ever shares a credential or holds one longer than its lease. The PKI engine acts as a certificate authority: it issues X.509 certificates on demand with configurable TTLs (minutes to hours rather than years), eliminating the manual CSR/approval cycle and making certificate rotation a non-event. The Transit engine provides encryption-as-a-service — applications encrypt and decrypt data by calling Vault rather than holding a key themselves, and key rotation happens inside Vault without re-encrypting all data at once. On startup, Vault is sealed: its encrypted storage is inaccessible because the master key is split into shards using Shamir\u0026rsquo;s Secret Sharing, requiring a quorum of key holders to unseal it. In production, auto-unseal via a cloud KMS (AWS KMS, Azure Key Vault) or an HSM (via PKCS#11) replaces the manual quorum, allowing Vault to restart without operator intervention while the master key remains hardware-protected.\nVault integrates with Kubernetes through three complementary patterns, each answering a different question: how to configure Vault for the cluster, how to sync secrets into native Secret objects, and how to deliver secrets as files inside pods. Platform teams often use Vault Config Operator (VCO) or Terraform for the first layer, then VSO or the Agent Injector for workloads. VSO and the Agent Injector are both HashiCorp-supported; VCO is the community redhat-cop/vault-config-operator project (common on OpenShift for GitOps Vault admin).\nVault Config Operator (VCO) Vault Secrets Operator (VSO) Vault Agent Injector Primary role Declaratively configure Vault (auth mounts, K8s roles, secret engines, policies) Sync Vault secrets into native Kubernetes Secret objects Inject Vault secrets as files in annotated pods Vault API use Admin / provisioning Read secrets for workloads Read secrets per pod Typical consumer Platform / security team Application teams, GitOps Apps that read config from disk Pod changes None (cluster-level CRDs) None (standard Secret refs) Annotations + init/sidecar containers Secrets in etcd Only if using VaultSecret CR (overlap with VSO) Yes — materialised Secret objects Usually no — files on a shared volume Relation to ESO Orthogonal (config vs consumption) Vault-only; similar consumption model to ESO Orthogonal; file-based alternative Maintainer Community (Red Hat COP) HashiCorp (supported) HashiCorp (supported) Choose VCO (or Terraform) to set up Kubernetes auth, paths, and roles before apps consume secrets. Choose VSO (or ESO) for standard envFrom / secretKeyRef workflows at the cost of secrets in the control plane datastore. Choose the injector when file-based delivery and keeping secret material out of the Kubernetes API matters.\nIn the confidential computing stack, Vault occupies a different niche from Trustee: Trustee gates secret release on TEE hardware attestation evidence (a TDX Quote or SEV-SNP report) and is purpose-built for the CoCo threat model where the infrastructure is untrusted; Vault gates secret release on identity and policy (Kubernetes service account, AWS IAM role, AppRole) and is purpose-built for the conventional infrastructure threat model where the platform itself is trusted. The two are complementary rather than competing — a CoCo workload might use Trustee to bootstrap a Vault token inside a TEE, then use Vault for all subsequent secret management — and both sit above an HSM when the highest assurance key storage is required.\nAdditional Information # Evolving Kubernetes security with Vault and OpenShift (Oct 15, 2025) Automate Secure Secrets in OpenShift with Vault \u0026amp; VSO (Dec 16, 2025) Security model for Vault Kubernetes KMS Understand available Vault editions ","externalUrl":null,"permalink":"/en/security/vault/","section":"Index","summary":"HashiCorp Vault is a secrets management platform designed to replace the pattern of static, long-lived credentials scattered across configuration files, environment variables, and CI pipelines with a centralised, policy-enforced, fully audited secrets API. Its core abstraction is that every secret has an identity (a path), an owner (determined by an auth method), a policy (an HCL HashiCorp Configuration Language document granting access to specific paths), and a lease (a TTL after which the secret expires or must be renewed). Nothing in Vault is persistent by default — every access is authenticated, every secret access is logged to an immutable audit trail, and credentials that are no longer needed expire automatically rather than accumulating indefinitely.\n","title":"Vault (HashiCorp Vault)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/vector-search/","section":"Tags","summary":"","title":"Vector-Search","type":"tags"},{"content":"VEX (Vulnerability Exploitability eXchange) is a machine-readable assertion format that answers the question an SBOM alone cannot: given that a product contains a component affected by a known CVE, is that vulnerability actually exploitable in this specific product? An SBOM identifies components and versions; a CVE database maps those versions to known vulnerabilities; but the intersection of the two systematically overstates actual risk. A container image built on a minimal base may include a library with a known buffer overflow in a network-parsing function — but if that function is never called by anything in the image, or the affected code path requires a configuration flag that is hardcoded off, the CVE is present but not exploitable. Without VEX, every scanner that ingests the SBOM raises an alert; with VEX, the supplier asserts the non-exploitability with a machine-readable justification that automated tooling can consume to suppress the alert without human triage. VEX originated in the same NTIA multistakeholder process that produced the SBOM minimum elements framework, and was formalised by CISA in 2021–2022.\nA VEX document (or VEX statement embedded in a CycloneDX SBOM) asserts one of four statuses per vulnerability-per-product pair. Not affected means the product contains the vulnerable component but the vulnerability is not exploitable in this product; this is the most common and most useful status, and it requires a mandatory justification from a defined set — including: the vulnerable code is not present (dead code, excluded at compile time), the vulnerable code cannot be reached by the attack vector (requires a code path that doesn\u0026rsquo;t exist in the product), the product has an inline mitigation (input validation upstream of the vulnerable function), or the component is protected by the product\u0026rsquo;s environment (sandboxing, SELinux, seccomp). Affected means the product is impacted and remediation is needed; this may include an action statement (update to version X, apply workaround Y). Fixed means a prior \u0026ldquo;affected\u0026rdquo; status has been resolved in the current product version. Under investigation is a time-bounded transitional status indicating the supplier is actively assessing exploitability. The combination of status and justification is what makes VEX machine-actionable: a scanner can automatically close an alert if it receives a signed not_affected VEX statement with a valid justification from the product\u0026rsquo;s supplier, without requiring a human to read a prose advisory.\nThree formats implement VEX, reflecting the still-evolving standardisation landscape. CSAF VEX (Common Security Advisory Framework, OASIS standard, used by Red Hat, Microsoft, and major enterprise vendors) is a profile of the CSAF 2.0 advisory format and the most widely adopted format for large software suppliers publishing product security advisories. CycloneDX VEX embeds VEX statements directly inside a CycloneDX SBOM using the vulnerabilities section, making the SBOM itself the carrier of exploitability status — convenient for toolchains that already produce CycloneDX SBOMs and want a single document. OpenVEX (originally from Chainguard, now an independent specification) is a minimal, format-agnostic JSON-LD schema designed to be attached to OCI container images as a signed referrer via the OCI Referrers API, with vexctl as its tooling layer. All three share the same four status values and the same justification categories; the differences are in schema, tooling ecosystem, and distribution model. In practice, consumers must handle all three formats, as different suppliers use different ones. VEX documents are most useful when signed — a signed VEX statement attached to a container image as an ORAS-managed referrer, with the signature rooted in Sigstore or a private PKI, allows automated policy engines (Kyverno, OPA Gatekeeper) to verify that the exploitability assessment comes from the software supplier and has not been tampered with, making VEX part of the verifiable supply chain alongside the SBOM and cosign signature.\n","externalUrl":null,"permalink":"/en/security/vex/","section":"Index","summary":"VEX (Vulnerability Exploitability eXchange) is a machine-readable assertion format that answers the question an SBOM alone cannot: given that a product contains a component affected by a known CVE, is that vulnerability actually exploitable in this specific product? An SBOM identifies components and versions; a CVE database maps those versions to known vulnerabilities; but the intersection of the two systematically overstates actual risk. A container image built on a minimal base may include a library with a known buffer overflow in a network-parsing function — but if that function is never called by anything in the image, or the affected code path requires a configuration flag that is hardcoded off, the CVE is present but not exploitable. Without VEX, every scanner that ingests the SBOM raises an alert; with VEX, the supplier asserts the non-exploitability with a machine-readable justification that automated tooling can consume to suppress the alert without human triage. VEX originated in the same NTIA multistakeholder process that produced the SBOM minimum elements framework, and was formalised by CISA in 2021–2022.\n","title":"VEX (Vulnerability Exploitability eXchange)","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/virtualisation/","section":"Tags","summary":"","title":"Virtualisation","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/virtualization/","section":"Tags","summary":"","title":"Virtualization","type":"tags"},{"content":"vLLM is an open-source library and serving stack for large language model (LLM) inference. Its objective is to turn a trained model into a production service that sustains many concurrent users with low latency and high tokens per second per GPU. vLLM targets the inference phase (prefill + decode), not training: it loads weights onto accelerators, batches incoming prompts, schedules decode steps, and streams completions back to clients over HTTP/gRPC (often via an OpenAI-compatible API). It has become a de facto engine behind many private and cloud AI gateways because it ships integrations for Hugging Face models, LoRA adapters, tensor parallelism, pipeline parallelism, speculative decoding, and quantization (GPTQ, AWQ, FP8).\nArchitecturally, vLLM differs from running a model naively on a CPU or a single-threaded GPU script in three ways. First, PagedAttention stores the KV cache in non-contiguous GPU memory pages (like virtual memory), so batch size and sequence length scale without the fragmentation that wastes VRAM on fixed buffers. Second, continuous batching adds and removes sequences from a running batch each iteration instead of waiting for every request in a static batch to finish—critical for chat workloads with uneven lengths. Third, custom CUDA kernels and communication backends (NCCL) keep attention and MLP matmuls on the device while the host CPU only orchestrates scheduling and I/O. A CPU-only path exists for tiny models but is not the design center; vLLM assumes GPU (or supported accelerator) memory bandwidth and parallelism dominate cost and latency.\nRed Hat integrates vLLM into Red Hat OpenShift AI and RHEL AI reference architectures as a supported model-serving option alongside other runtimes. On OpenShift, vLLM runs in containers with GPU device plugins, often behind a route or gateway; Red Hat documents validated GPU nodes, drivers, and partner stacks (including NVIDIA). llm-d, a Kubernetes-native inference project co-led by Red Hat and others, uses vLLM as its default model server and adds cluster-level routing and disaggregation above it. Operators therefore deploy vLLM as the per-pod engine while Red Hat platforms supply Linux, Kubernetes, security (SELinux, SCCs), and MLOps workflows around it.\nAdditional Information # What is vLLM ? Meet vLLM: For faster, more efficient LLM inference and serving (Mar 31, 2025) Accelerate AI inference with vLLM (Sep 19, 2025) How to deploy and benchmark vLLM with GuideLLM on Kubernetes (Dec 24, 2025) 5 steps to triage vLLM performance (Mar 9,2026) ","externalUrl":null,"permalink":"/en/ai/vllm/","section":"Index","summary":"vLLM is an open-source library and serving stack for large language model (LLM) inference. Its objective is to turn a trained model into a production service that sustains many concurrent users with low latency and high tokens per second per GPU. vLLM targets the inference phase (prefill + decode), not training: it loads weights onto accelerators, batches incoming prompts, schedules decode steps, and streams completions back to clients over HTTP/gRPC (often via an OpenAI-compatible API). It has become a de facto engine behind many private and cloud AI gateways because it ships integrations for Hugging Face models, LoRA adapters, tensor parallelism, pipeline parallelism, speculative decoding, and quantization (GPTQ, AWQ, FP8).\n","title":"vLLM","type":"ai"},{"content":"","externalUrl":null,"permalink":"/en/tags/vllm/","section":"Tags","summary":"","title":"Vllm","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/vpn/","section":"Tags","summary":"","title":"Vpn","type":"tags"},{"content":"VS-NfD (Verschlusssache — Nur für den Dienstgebrauch, \u0026ldquo;Classified — For Official Use Only\u0026rdquo;) is the lowest of Germany\u0026rsquo;s four classification levels (VS-NfD, VS-Vertraulich, Geheim, Streng Geheim). The legal and regulatory framework governing its handling consists of the Sicherheitsüberprüfungsgesetz (SÜG) as the legal basis, the Verschlusssachenanweisung (VSA) as the administrative directive for federal agencies (fundamentally revised in 2023), and the VS-NfD-Merkblatt (Annex 4 to the Geheimschutzhandbuch) for private-sector companies handling classified contracts. The framework is administered by the BSI for IT security aspects and the BMWK (Federal Ministry for Economic Affairs) for industrial security (Geheimschutz in der Wirtschaft). Compliance is absolutely mandatory — it is a legal obligation under the SÜG, and failure to comply results in loss of the ability to participate in classified government contracts. Key IT requirements include: using exclusively BSI-approved (zugelassen) IT security products listed in the VS-Produktkatalog (BSI-Schrift 7164) for encryption, VPN, and security-critical functions; implementing an information security concept based on BSI IT-Grundschutz (including risk analysis and Grundschutz-Check); applying the multi-layered security principle (prevention, detection, reaction); and personnel security clearances under the SÜG. Since 1 September 2025, a mandatory self-accreditation (Selbstakkreditierung) obligation entered into force: every three years, the VS-NfD-responsible person must formally confirm to their management (and on request to the BMWK or the contracting authority) that all technical and organizational measures are fully implemented. The BSI\u0026rsquo;s IT-Grundschutz module CON.11.1 specifically addresses VS-NfD requirements that go beyond standard IT-Grundschutz measures.\nRed Hat is not an IT security product requiring BSI Zulassung (approval) — RHEL is an operating system, not a cryptographic appliance or VPN gateway — but it serves as the foundational platform upon which VS-NfD-compliant IT systems are built. The BSI\u0026rsquo;s CON.11.1 building block requires that VS-NfD IT systems implement IT-Grundschutz as a prerequisite, and RHEL provides the technical capabilities to fulfill those baseline requirements: SELinux mandatory access control for compartmentalization, system-wide cryptographic policies aligned with BSI TR-02102 recommendations, comprehensive audit logging via auditd, and OpenSCAP profiles (including the BSI-specific profile xccdf_org.ssgproject.content_profile_bsi) that assess system configuration against BSI hardening requirements. For network-level protection where BSI-approved products are mandatory (e.g., VPN encryption for cross-site VS-NfD networks), RHEL and OpenShift integrate with BSI-approved appliances (such as genuscreen firewalls or SINA VPN gateways from secunet) as the underlying platform hosting workloads behind those approved boundaries. Red Hat\u0026rsquo;s role is enabling the \u0026ldquo;Informationssicherheitskonzept\u0026rdquo; that the VS-NfD-Merkblatt demands: the Compliance Operator continuously validates that systems maintain their hardened state, Ansible Automation Platform enforces the documented security configurations reproducibly across the environment (critical evidence for self-accreditation), and Red Hat\u0026rsquo;s long-term support lifecycle ensures that the specific validated product version remains supported throughout the duration of classified contracts. For defense contractors and public-sector IT service providers subject to the new self-accreditation obligation, Red Hat\u0026rsquo;s compliance automation reduces the every-three-year confirmation from a major audit exercise to a continuous, documented compliance posture.\nAdditional Information # BSI - Geheimschutz BSI CON.11.1 Geheimschutz VS-NfD VS-NfD-Merkblatt FAQ - BMWK Sicherheitsforum Self-accreditation obligation (Sep 2025) - Taylor Wessing ","externalUrl":null,"permalink":"/en/compliance/vs-nfd/","section":"Index","summary":"VS-NfD (Verschlusssache — Nur für den Dienstgebrauch, “Classified — For Official Use Only”) is the lowest of Germany’s four classification levels (VS-NfD, VS-Vertraulich, Geheim, Streng Geheim). The legal and regulatory framework governing its handling consists of the Sicherheitsüberprüfungsgesetz (SÜG) as the legal basis, the Verschlusssachenanweisung (VSA) as the administrative directive for federal agencies (fundamentally revised in 2023), and the VS-NfD-Merkblatt (Annex 4 to the Geheimschutzhandbuch) for private-sector companies handling classified contracts. The framework is administered by the BSI for IT security aspects and the BMWK (Federal Ministry for Economic Affairs) for industrial security (Geheimschutz in der Wirtschaft). Compliance is absolutely mandatory — it is a legal obligation under the SÜG, and failure to comply results in loss of the ability to participate in classified government contracts. Key IT requirements include: using exclusively BSI-approved (zugelassen) IT security products listed in the VS-Produktkatalog (BSI-Schrift 7164) for encryption, VPN, and security-critical functions; implementing an information security concept based on BSI IT-Grundschutz (including risk analysis and Grundschutz-Check); applying the multi-layered security principle (prevention, detection, reaction); and personnel security clearances under the SÜG. Since 1 September 2025, a mandatory self-accreditation (Selbstakkreditierung) obligation entered into force: every three years, the VS-NfD-responsible person must formally confirm to their management (and on request to the BMWK or the contracting authority) that all technical and organizational measures are fully implemented. The BSI’s IT-Grundschutz module CON.11.1 specifically addresses VS-NfD requirements that go beyond standard IT-Grundschutz measures.\n","title":"VSA / VS-NfD (German Classified Information)","type":"compliance"},{"content":"","externalUrl":null,"permalink":"/en/tags/vulnerability/","section":"Tags","summary":"","title":"Vulnerability","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/vulnerability-management/","section":"Tags","summary":"","title":"Vulnerability-Management","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/webauthn/","section":"Tags","summary":"","title":"Webauthn","type":"tags"},{"content":"WireGuard is a VPN protocol and implementation designed by Jason Donenfeld, merged into the Linux kernel in 5.6 (2020) and subsequently ported to Windows, macOS, iOS, Android, and BSD. Its defining characteristic is radical simplicity: the reference Linux kernel implementation is approximately 4,000 lines of code, compared to tens of thousands for IPsec\u0026rsquo;s XFRM subsystem and hundreds of thousands for OpenVPN. This simplicity is a deliberate security property — a smaller codebase has a smaller attack surface, is easier to audit, and is less likely to contain implementation vulnerabilities. WireGuard achieves this by making every design decision that allows optionality to be eliminated: there is no algorithm negotiation, no handshake negotiation, no cipher suite selection. The cryptographic suite is fixed: X25519 for key exchange, ChaCha20-Poly1305 for authenticated encryption, BLAKE2s for hashing and key derivation (via a custom HKDF-like construction), and Curve25519 for the static key pairs that identify peers. Peers are identified exclusively by their 32-byte Curve25519 public key, making WireGuard a public-key routed VPN: there are no usernames, passwords, certificates, or CAs; access control is entirely a function of which public keys are listed in each peer\u0026rsquo;s configuration.\nThe protocol is stateless by design from the perspective of connection tracking. A WireGuard interface has a private key and a list of allowed IPs per peer — the IP ranges that the tunnel will accept from and route toward each peer\u0026rsquo;s public key. When a packet arrives on the WireGuard UDP port (51820 by default, fully configurable), the interface decrypts it using the session key derived from the initiating handshake and checks whether the decrypted source IP falls within the allowed IPs for the peer that sent it; if not, the packet is dropped. There is no persistent connection state beyond the session keys, which are renegotiated every 3 minutes (or after 180 seconds of inactivity) using a 1-RTT Noise protocol handshake (specifically, the Noise_IKpsk2 pattern from the Noise Protocol Framework). The handshake provides mutual authentication (both peers verify each other\u0026rsquo;s static public key against their configuration), forward secrecy (ephemeral X25519 key pairs are generated per session and discarded after use), and identity hiding (the initiator\u0026rsquo;s static public key is encrypted under the responder\u0026rsquo;s static public key before transmission, so a passive observer cannot determine who is connecting). An optional pre-shared symmetric key (PSK) can be added per peer pair as a post-quantum hedge — XOR\u0026rsquo;d into the key derivation — providing a symmetric layer of protection against a CRQC breaking the X25519 key exchange, though this is a manual, non-rotating secret rather than a full PQC solution.\nWireGuard\u0026rsquo;s operational model is intentionally infrastructure-agnostic: a WireGuard interface is a standard Linux network interface (ip link add wg0 type wireguard), configurable via wg and wg-quick or directly via the kernel netlink API, and composable with standard Linux networking — nftables and iptables rules, routing tables, network namespaces, and eBPF programs all apply to WireGuard traffic exactly as to any other interface. This composability makes WireGuard the tunnelling layer for several higher-level systems: Tailscale and Headscale use WireGuard as the data plane for a mesh VPN with a control plane that distributes public keys and coordinates NAT traversal via DERP relay servers; Netbird takes a similar approach; Kubernetes CNI plugins including Kilo and Flannel (in WireGuard mode) use it for encrypted pod-to-pod cross-node traffic. The fixed cryptographic suite creates a PQC migration challenge: unlike TLS 1.3 where the key exchange algorithm is negotiable and X25519MLKEM768 can be deployed as a drop-in hybrid, WireGuard\u0026rsquo;s Noise_IKpsk2 handshake hardcodes X25519 and there is no standardised mechanism for substituting ML-KEM. The PSK option provides a partial mitigation (a pre-shared 256-bit key added to the derivation provides symmetric post-quantum security for the session confidentiality if the PSK itself is securely pre-distributed and rotated), but a full PQC WireGuard would require a protocol revision. The WireGuard project and several research groups are actively exploring Noise_IKpsk2 variants with ML-KEM, but no standardised, widely-deployed solution exists as of 2025.\n","externalUrl":null,"permalink":"/en/security/wireguard/","section":"Index","summary":"WireGuard is a VPN protocol and implementation designed by Jason Donenfeld, merged into the Linux kernel in 5.6 (2020) and subsequently ported to Windows, macOS, iOS, Android, and BSD. Its defining characteristic is radical simplicity: the reference Linux kernel implementation is approximately 4,000 lines of code, compared to tens of thousands for IPsec’s XFRM subsystem and hundreds of thousands for OpenVPN. This simplicity is a deliberate security property — a smaller codebase has a smaller attack surface, is easier to audit, and is less likely to contain implementation vulnerabilities. WireGuard achieves this by making every design decision that allows optionality to be eliminated: there is no algorithm negotiation, no handshake negotiation, no cipher suite selection. The cryptographic suite is fixed: X25519 for key exchange, ChaCha20-Poly1305 for authenticated encryption, BLAKE2s for hashing and key derivation (via a custom HKDF-like construction), and Curve25519 for the static key pairs that identify peers. Peers are identified exclusively by their 32-byte Curve25519 public key, making WireGuard a public-key routed VPN: there are no usernames, passwords, certificates, or CAs; access control is entirely a function of which public keys are listed in each peer’s configuration.\n","title":"WireGuard","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/workload/","section":"Tags","summary":"","title":"Workload","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/workloads/","section":"Tags","summary":"","title":"Workloads","type":"tags"},{"content":"X.509 is the ITU-T standard (first published in 1988, currently at version 3) that defines the structure of a digital certificate: a signed data structure that binds a public key to an identity and a set of constraints, issued by a Certificate Authority whose signature vouches for the binding. It is the near-universal format for certificates in PKI, TLS, code signing, S/MIME encrypted email, SPIFFE X.509-SVIDs, and SSH host certificates. When someone refers to a TLS certificate, a CA certificate, or a code-signing certificate, they are referring to an X.509 certificate. The format is defined using ASN.1 (Abstract Syntax Notation One) and most commonly serialised as DER (Distinguished Encoding Rules, binary) or PEM (base64-wrapped DER with -----BEGIN CERTIFICATE----- headers, the format seen in most configuration files).\nAn X.509 v3 certificate contains a fixed set of fields and an extensible Extensions section that carries the semantically rich parts of modern certificates. The core fields include: the Subject (a Distinguished Name — CN, O, OU, C fields — identifying the certificate holder), the Issuer (the DN of the signing CA), the Validity period (Not Before and Not After timestamps), the Subject Public Key Info (the algorithm and public key being certified), and the Serial Number (unique per issuer, used in revocation). The Extensions section, mandatory in v3, carries: Subject Alternative Names (SANs), which contain the actual hostnames, IP addresses, email addresses, or URIs (including SPIFFE IDs) that the certificate authenticates — the SAN is what TLS implementations check against the server name, not the CN; Key Usage and Extended Key Usage, which constrain the operations the key may be used for (digital signature, key encipherment, TLS server authentication, TLS client authentication, code signing); Basic Constraints, which marks a certificate as a CA certificate and optionally caps the length of certificate chains beneath it; Authority Key Identifier and Subject Key Identifier, which allow relying parties to locate the issuing CA\u0026rsquo;s certificate efficiently; and CRL Distribution Points and Authority Information Access, which provide URLs for revocation checking and OCSP. A certificate is verified by checking the cryptographic signature against the issuer\u0026rsquo;s public key, validating that the current time falls within the validity period, checking that no extension in the chain is violated, and confirming that the certificate has not been revoked.\nX.509 certificate handling is operationally pervasive and a frequent source of outages and security incidents. The most common failures are expired certificates (automated renewal via ACME or Vault\u0026rsquo;s PKI engine is the standard mitigation), hostname mismatches (the requested hostname is not in the certificate\u0026rsquo;s SAN list — a frequent consequence of using the deprecated CN field for hostname validation), missing intermediate CA certificates (the server sends only the leaf certificate, and the client cannot build a chain to a trusted root), and trust store divergence (a certificate chains to a root trusted by some clients but not others, as is common with corporate CAs on managed devices). In the PQC transition, X.509 certificates are directly affected: the signature algorithm field must change from ecdsa-with-SHA256 or sha256WithRSAEncryption to an ML-DSA OID, and the Subject Public Key Info must carry an ML-DSA or ML-KEM public key; both the IETF and CA/Browser Forum are standardising the necessary OIDs and profile constraints for PQC X.509 certificates. Hybrid certificates — carrying both a classical and a PQC key — are under active development but not yet standardised for production use.\n","externalUrl":null,"permalink":"/en/security/x509/","section":"Index","summary":"X.509 is the ITU-T standard (first published in 1988, currently at version 3) that defines the structure of a digital certificate: a signed data structure that binds a public key to an identity and a set of constraints, issued by a Certificate Authority whose signature vouches for the binding. It is the near-universal format for certificates in PKI, TLS, code signing, S/MIME encrypted email, SPIFFE X.509-SVIDs, and SSH host certificates. When someone refers to a TLS certificate, a CA certificate, or a code-signing certificate, they are referring to an X.509 certificate. The format is defined using ASN.1 (Abstract Syntax Notation One) and most commonly serialised as DER (Distinguished Encoding Rules, binary) or PEM (base64-wrapped DER with -----BEGIN CERTIFICATE----- headers, the format seen in most configuration files).\n","title":"X.509","type":"security"},{"content":"","externalUrl":null,"permalink":"/en/tags/x509/","section":"Tags","summary":"","title":"X509","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/zero-touch/","section":"Tags","summary":"","title":"Zero-Touch","type":"tags"},{"content":"","externalUrl":null,"permalink":"/en/tags/zero-trust/","section":"Tags","summary":"","title":"Zero-Trust","type":"tags"}]