Known gaps
This page exists because a security section that lists only strengths is marketing. Each item is something a reviewer would find; finding it here first is the point.
Secrets at rest in the control plane
Section titled “Secrets at rest in the control plane”Several secrets the platform must be able to hand back are stored in the control plane database without application-level encryption:
- TLS private keys for issued certificates
- Kubernetes cluster PKI and, until first display, kubeconfigs
- Object storage cluster secrets
The database column names already indicate what they are meant to become; today the value is plaintext. Database-level encryption, if the operator configured it, applies — but the application adds nothing on top.
What this means: an attacker with control-plane database access obtains these secrets. Mitigation available today: encrypt the database at rest and restrict access to it; treat control-plane compromise as requiring certificate and cluster credential rotation.
No tamper-evident audit log
Section titled “No tamper-evident audit log”Audit entries are ordinary rows. There is no hash chain, no signature and no write-once store. Someone with database access can alter history.
Mitigation available today: export entries to a system that provides immutability.
No log retention policy
Section titled “No log retention policy”There is no configurable retention or automatic archival. Retention is whatever your database backup policy provides.
No certificate revocation
Section titled “No certificate revocation”Deleting a certificate removes it from the platform and from the load balancers that served it. It does not revoke it at Let’s Encrypt. A compromised private key needs manual revocation.
TLS is not re-established to backends
Section titled “TLS is not re-established to backends”TLS terminates at the load balancer; traffic to your targets is plain inside your private
network. There is no re-encryption option. If your threat model includes an attacker on
your own private network, terminate TLS inside the workload instead — use a tcp listener.
No east-west encryption
Section titled “No east-west encryption”Traffic between machines in a private network is not encrypted by the platform. Encrypt at the application layer if you need it.
No backup product
Section titled “No backup product”There is no server backup in the panel. Use Proxmox Backup Server at the infrastructure layer. Snapshots are not backups.
Single-instance appliances
Section titled “Single-instance appliances”A load balancer is one virtual machine. If it fails, traffic through it stops until it is rebuilt. High availability with a floating address is planned, not shipped. The same is true of a gateway.
No approval workflow
Section titled “No approval workflow”Roles separate read from write, but there is no four-eyes approval for destructive operations. The two-phase deletion buffer is the only brake, and it is a time window rather than a second person.
No first-party infrastructure-as-code provider
Section titled “No first-party infrastructure-as-code provider”Everything is API-driven and scriptable, but there is no Terraform or Pulumi provider. You would write against the OpenAPI document.
IPv4 only
Section titled “IPv4 only”No IPv6 anywhere: not for servers, not for private networks, not for load balancers.
Guest security is yours
Section titled “Guest security is yours”The platform provisions machines. It does not patch them, does not scan them, and does not install an agent on them. That is deliberate — see What zone9 is — but it means guest hardening, patching and monitoring are entirely your responsibility.
If a gap here blocks you, it is worth saying so: the list is a roadmap as much as a disclosure.