Skip to content

Known gaps

This page exists because a security section that lists only strengths is marketing. Each item is something a reviewer would find; finding it here first is the point.

Several secrets the platform must be able to hand back are stored in the control plane database without application-level encryption:

  • TLS private keys for issued certificates
  • Kubernetes cluster PKI and, until first display, kubeconfigs
  • Object storage cluster secrets

The database column names already indicate what they are meant to become; today the value is plaintext. Database-level encryption, if the operator configured it, applies — but the application adds nothing on top.

What this means: an attacker with control-plane database access obtains these secrets. Mitigation available today: encrypt the database at rest and restrict access to it; treat control-plane compromise as requiring certificate and cluster credential rotation.

Audit entries are ordinary rows. There is no hash chain, no signature and no write-once store. Someone with database access can alter history.

Mitigation available today: export entries to a system that provides immutability.

There is no configurable retention or automatic archival. Retention is whatever your database backup policy provides.

Deleting a certificate removes it from the platform and from the load balancers that served it. It does not revoke it at Let’s Encrypt. A compromised private key needs manual revocation.

TLS terminates at the load balancer; traffic to your targets is plain inside your private network. There is no re-encryption option. If your threat model includes an attacker on your own private network, terminate TLS inside the workload instead — use a tcp listener.

Traffic between machines in a private network is not encrypted by the platform. Encrypt at the application layer if you need it.

There is no server backup in the panel. Use Proxmox Backup Server at the infrastructure layer. Snapshots are not backups.

A load balancer is one virtual machine. If it fails, traffic through it stops until it is rebuilt. High availability with a floating address is planned, not shipped. The same is true of a gateway.

Roles separate read from write, but there is no four-eyes approval for destructive operations. The two-phase deletion buffer is the only brake, and it is a time window rather than a second person.

No first-party infrastructure-as-code provider

Section titled “No first-party infrastructure-as-code provider”

Everything is API-driven and scriptable, but there is no Terraform or Pulumi provider. You would write against the OpenAPI document.

No IPv6 anywhere: not for servers, not for private networks, not for load balancers.

The platform provisions machines. It does not patch them, does not scan them, and does not install an agent on them. That is deliberate — see What zone9 is — but it means guest hardening, patching and monitoring are entirely your responsibility.


If a gap here blocks you, it is worth saying so: the list is a roadmap as much as a disclosure.