Security hardening guide¶
This document provides an overview of security features and guidance for hardening the security of Valkey deployments, including setting up and managing a secure environment.
Environment¶
The environment where Charmed Valkey operates can be divided into two components:
Cloud
Juju
Cloud¶
Charmed Valkey can be deployed on top of several clouds and virtualisation layers:
Cloud |
Security guides |
|---|---|
OpenStack |
|
AWS |
Best Practices for Security, Identity and Compliance, AWS security credentials |
Azure |
Azure security best practices and patterns, Managed identities for Azure resource |
GCP |
Juju¶
Juju is the component responsible for orchestrating the entire life cycle, from deployment to Day 2 operations. For more information on Juju security hardening, see the Juju security page and the How to harden your deployment guide.
Cloud credentials¶
When configuring cloud credentials to be used with Juju, ensure that users have the correct permissions to operate at the required level. Juju superusers responsible for bootstrapping and managing controllers require elevated permissions to manage several kinds of resources, such as virtual machines, networks, storage, etc. Please refer to the links below for more information on the policies required to be used depending on the cloud.
Cloud |
Cloud user policies |
|---|---|
OpenStack |
|
AWS |
|
Azure |
|
GCP |
Juju users¶
It is very important that Juju users are set up with minimal permissions depending on the scope of their operations. Please refer to the User access levels documentation for more information on the access levels and corresponding abilities.
Juju user credentials must be stored securely and rotated regularly to limit the chances of unauthorised access due to credentials leakage.
Applications¶
In the following, we provide guidance on how to harden your deployment using:
Operating system
Security upgrades
Encryption
Authentication
Authorisation
Monitoring and auditing
Operating system¶
Valkey runs on top of Ubuntu 26.04 LTS (Resolute Raccoon). Deploy a Landscape Client Charm to connect the underlying VM to a Landscape User Account to manage security upgrades and integrate Ubuntu Pro subscriptions.
Security upgrades¶
Charmed Valkey installs a pinned revision of the valkey-snap, where each revision of the charm pins
a revision of the snap to provide reproducible environments.
New versions of the Valkey operator may be released to provide patching of vulnerabilities (CVEs). It is important to refresh the charm regularly to make sure the workload is as secure as possible.
Encryption¶
For internal communication between Valkey peers, Charmed Valkey always enables TLS by default. The TLS certificates for this purpose are managed by the charm itself.
For most production settings, Valkey should be deployed with encryption for external connections, too. To do that, you need to relate Charmed Valkey to one of the TLS certificate operator charms. Please refer to the Certificate Management documentation for more information on how to select the right certificate provider for your use case.
Encryption in transit for backups is provided by the storage provider. S3-compatible object storage, Azure Blob storage and Google Cloud Storage are supported.
For more information on encryption, see the Cryptography explanation page and How to enable TLS guide.
Monitoring and auditing¶
Charmed Valkey provides native integration with the Canonical Observability Stack (COS). To reduce the blast radius of infrastructure disruptions, the general recommendation is to deploy COS and the observed application into separate environments, isolated from one another. Refer to the COS production deployments best practices for more information.
Logging is enabled by default. The logs are stored in the /var/snap/valkey-charmed/common/var/log/valkey
directory of the Valkey container.
Logging is enabled by default. The logs are stored in the /var/log/valkey directory of the Valkey container.
It is recommended to integrate the charm with COS, from where the logs can be easily persisted and queried using Loki/Grafana.
Additional Resources¶
For details on the cryptography used by Charmed Valkey, see the Cryptography explanation page.