Compliance on Kubernetes: PCI DSS, GDPR, DORA, CIS on Cozystack

PCI DSS Compliance on Kubernetes with Cozystack

Tue, 18 Aug 2026 00:00:00 +0000

Cozystack provides most of the technical controls a PCI DSS 4.0.1 assessment depends on, and several of them are active on a fresh install. It is an open-source cloud platform built on Kubernetes, KubeVirt and Talos Linux that runs on your own bare metal. Tenant network isolation, privilege restrictions on workloads, automatic TLS for published services and encrypted backups need no configuration at all.

Others are shipped but not switched on, because most clusters do not need them: single sign-on, volume encryption, restricted egress, encrypted east-west traffic, longer audit retention. Each is a configuration option rather than a development project, and this page says which is which, requirement by requirement — along with the parts an assessment leaves to you, so none of them surprise you late.

GDPR Compliance on Kubernetes with Cozystack

Tue, 18 Aug 2026 00:00:00 +0000

Personal data on Cozystack stays where you put it. The platform is open-source software built on Kubernetes, KubeVirt and Talos Linux that runs on your own hardware: no control plane in someone else’s cloud, no vendor account, no service to sign up for. On top of that it brings the measures Article 32 asks about — encryption in transit and for backups, centralized identity, tenant isolation enforced by network policy, audit logging, backup and restore.

CIS Kubernetes Benchmark Results on Cozystack and Talos

Tue, 18 Aug 2026 00:00:00 +0000

Cozystack starts from a hardened position, and the numbers say so: 54 CIS controls pass on a cluster nobody tuned for the test. The node operating system is immutable and has no shell, privileged workloads are refused by admission, every etcd control passes, and tenants come with network isolation already applied.

This page publishes the full run rather than the flattering part of it. A raw kube-bench report also lists two dozen failures, and the useful work is telling them apart: most are the benchmark looking for files an immutable node does not keep, or testing a flag that newer Kubernetes releases replaced. Four are worth your attention, and each is covered below with the reasoning behind it.

DORA on Kubernetes: ICT Third-Party Risk and Resilience

Tue, 18 Aug 2026 00:00:00 +0000

For the chapter of DORA that decides most platform conversations — dependence on a single ICT provider — Cozystack is about as good an answer as infrastructure gets. It is open-source software under Apache 2.0, it runs on your own hardware, and leaving it means moving standard Kubernetes objects and virtual machines rather than unwinding a proprietary format. An exit strategy you can rehearse beats a clause promising cooperation.

The resilience side is solid too: replicated storage across nodes, live migration between them, declared state that the platform continuously restores, multi-datacenter topologies as a normal deployment shape, backups encrypted by default. This page goes through all of it, and marks the handful of places where you need to configure something rather than inherit it.

Kubernetes Conformance Results for Cozystack

Wed, 19 Aug 2026 00:00:00 +0000

Kubernetes clusters created by Cozystack pass the CNCF conformance suite in full. The suite answers one narrow question, and it is the question every evaluation starts with: is this real Kubernetes, or something Kubernetes-shaped? A conformant cluster runs standard manifests, Helm charts and operators without a vendor dialect.

Two independent sets of results are recorded below, from the two shapes the platform is used in — a cluster you run yourself, and a hosted platform built on it. Between them they cover every Kubernetes release the platform offers.