In our blog post last week we explained exactly what Haven is. In short, Haven is the standard for platform-independent cloud hosting for municipalities. Haven enables municipalities to run applications without modifying their IT infrastructure, regardless of whether they work locally, in the cloud, or in a hybrid setup. This promotes collaboration between municipalities, lowers costs, increases security and scalability, and reduces vendor lock-in through the use of open-source technologies like Kubernetes. As a result, applications can be developed, shared, and managed more efficiently. You can think of Haven as an abstraction layer that provides a common starting point for municipalities.
But how do you ensure that you set up a Haven-compliant environment as a municipality? Haven prescribes a specific Kubernetes configuration that must be implemented on the existing technical infrastructure, for example in the cloud or on an on-premises platform.
This prescribed configuration ensures that every Haven environment is functionally identical, regardless of the underlying technical infrastructure.
Within Common Ground (a Dutch initiative aimed at modernizing the digital infrastructure of government bodies and promoting interoperability and scalability), a tool has been created to scan and validate Kubernetes clusters for compliance with specific security and infrastructure standards prescribed by the Haven standard. This is the Haven Compliancy Checker. Using this checker requires some basic knowledge of Kubernetes and command-line tools. The check currently consists of 16 mandatory and 2 suggested checks. The 16 mandatory checks are divided into 7 main categories: Fundamental, Infrastructure, Cluster, External, Deployment, and Validation. Each category has its own checks and reasons why the Kubernetes cluster must comply with them.
Fundamental
Under Fundamental, the checker requires that the Kubernetes cluster be on the latest major version or a minor version no more than 3 months older than the latest major version. Additionally, the Kubernetes cluster must have cluster-admin privileges for the checker to function correctly.
Infrastructure
Under Infrastructure, the checker requires that the Kubernetes cluster run across multiple availability zones. Furthermore, the Kubernetes cluster must consist of at least 3 master nodes and 3 worker nodes. The Kubernetes cluster must have at least one of the following enabled: SELinux, Grsecurity, AppArmor, LKRG, Talos, or Flatcar. Finally, the Kubernetes cluster must be built within a private network topology.
Cluster
Under Cluster, the checker requires that the Kubernetes cluster, just as in the Fundamental section, be on the latest major version of Kubernetes or a minor version no more than 3 months older than the latest major version. Additionally, Role-Based Access Control must be enabled within the Kubernetes cluster, and basic authentication must be disabled. Finally, the Kubernetes cluster must support ReadWriteMany persistent volumes.
External
Under External, the checker requires that the Kubernetes cluster complies with standard Kubernetes APIs.
Deployment
Under Deployment, the checker requires that an automated HTTPS certificate provision is available, that log aggregation is running on the Kubernetes cluster, and that monitoring is present on the cluster.
Validation
Finally, under Validation, the checker requires that the Kubernetes cluster's CLI interface is validated using Secure Hash Algorithms (SHA).
Once a municipality asks Fundaments for a Haven-compliant environment, we first look at the municipality's specific needs together. This is followed by a technical intake session, and ultimately, a design for the Haven-compliant environment is created. To ensure the environment is truly Haven-compliant, the Haven Compliancy Checker is performed.
Would you like to know more about what Haven can do for your municipality? Please contact us by calling 088 4227 227 or emailing info@fundaments.nl.
