CCC Kubernetes Capabilities Catalog
This page renders the FINOS Common Cloud Controls Managed Kubernetes capabilities
as a Gemara CapabilityCatalog, including the shared
CCC Core capabilities this service catalog imports. Native K8S entries and
imported Core entries appear together, grouped by capability domain.
For the companion catalogs, see the Threats Catalog and Controls Catalog.
Orchestration
The Orchestration group covers entries related to coordinating and managing workloads across distributed systems. This includes container orchestration, job scheduling, CI/CD pipelines, build automation, and service mesh management.
CCC.K8S.CP01Managed Kubernetes Control Plane
The service supplies a Kubernetes-conformant control plane whose foundational components, health, and availability are automatically maintained by the provider.
CCC.K8S.CP02Managed Worker Pools
The service can organize worker nodes into managed pools that provide Kubernetes with compute capacity for scheduling and running containerized workloads.
CCC.K8S.CP04OCI Container Image Execution
The service always accepts OCI-compatible image references and executes their containerized workloads through a Kubernetes-compatible runtime.
CCC.K8S.CP05Container Registry Integration
The service can authenticate to private or public OCI-compatible registries and retrieve workload images with user-configured identities and credentials.
CCC.K8S.CP06Declarative Workload Orchestration
The service automatically reconciles Kubernetes workload resources toward their user-declared state by scheduling, restarting, and replacing containers as needed.
CCC.K8S.CP14Managed Cluster Extensions
The service can manage the installation and lifecycle of supported extensions for networking, storage, policy, observability, and workload management.
CCC.K8S.CP19Workload Isolation Controls
The service can separate workloads with security contexts, namespace boundaries, scheduling constraints, and runtime isolation settings.
Compute
The Compute group covers entries related to processing, execution, and runtime infrastructure. This includes CPU, memory, storage allocation, network ports, command-line interfaces, and elastic scaling.
CCC.K8S.CP03Abstracted Worker Infrastructure
The service may be configured to abstract worker infrastructure so that provisioning, scaling, patching, and replacement occur without exposing individual nodes to the user.
CCC.K8S.CP20Hardware Accelerator Support
The service may be configured with worker pools equipped with supported hardware accelerators, enabling Kubernetes to schedule workloads that request those devices.
CCC.K8S.CP22Worker Node Integrity Protection
The service may be configured with trusted worker-node images and platform mechanisms that verify node boot integrity before workloads are executed.
CCC.Core.CP14API Accessimported
Imported from CCC.Core.Capabilities
The service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE.
CCC.Core.CP19Child Resource Scalingimported
Imported from CCC.Core.Capabilities
The service may be configured to scale child resources automatically or on-demand.
CCC.Core.CP24Core Processing Unitsimported
Imported from CCC.Core.Capabilities
The service provides users and child resources with access to core processing units (CPUs) for executing instructions and performing computations.
CCC.Core.CP25Random Access Memory Allocationimported
Imported from CCC.Core.Capabilities
The service provides users and child resources with access to random access memory (RAM) for temporary data storage and fast data retrieval during processing tasks.
CCC.Core.CP26Persistent Storageimported
Imported from CCC.Core.Capabilities
The service provides users and child resources with access to persistent storage for saving and retrieving data reliably over time.
CCC.Core.CP27Configurable Network Portsimported
Imported from CCC.Core.Capabilities
The service allows users to configure network ports for communication, enabling flexibility in network management and integration with other services.
CCC.Core.CP28Command-line Interfaceimported
Imported from CCC.Core.Capabilities
The service includes a component that reads and translates text into commands that can be executed by the service.
Networking
The Networking group covers entries related to network infrastructure, connectivity, and traffic management. This includes virtual networks, subnets, load balancing, DNS, routing, peering, and network-level access controls.
CCC.K8S.CP07Cluster Network Integration
The service can attach cluster, node, pod, and service connectivity to a user-configured cloud virtual network.
CCC.K8S.CP08Workload Traffic Routing
The service can expose and route internal or external traffic to Kubernetes workloads through services, load balancers, ingress controllers, and gateway components.
CCC.K8S.CP09Workload Network Policy
The service may be configured with Kubernetes network policies that enforce ingress and egress boundaries between workloads and external systems.
Access Control
The Access Control group covers entries related to authentication, authorization, and trust perimeter enforcement. This includes multi-factor authentication, least privilege access, network access rules, and prevention of unauthorized access or reconnaissance.
CCC.K8S.CP10Cloud Identity Integration
The service can authenticate cloud identities and authorize their access to cluster resources through Kubernetes and provider-native access controls.
CCC.K8S.CP11Workload Identity Federation
The service may be configured to exchange Kubernetes service-account identity for short-lived cloud credentials without placing long-lived credentials in workloads.
CCC.K8S.CP12Secrets Service Integration
The service can present secrets, keys, and certificates from a cloud secrets service to authorized Kubernetes workloads without embedding them in workload definitions.
CCC.K8S.CP18Admission Policy Enforcement
The service may be configured with policies, admission controllers, and webhooks that validate, mutate, or reject Kubernetes API requests before persistence.
CCC.K8S.CP21Cluster Infrastructure Identity
The service may be configured with distinct cloud identities for control-plane, worker-node, and supporting components so their access to cloud resources can be independently authorized.
CCC.Core.CP06Access Controlimported
Imported from CCC.Core.Capabilities
The service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes.
CCC.Core.CP23Network Access Rulesimported
Imported from CCC.Core.Capabilities
The service restricts access to child or networked resources based on user-defined network parameters such as IP address, protocol, port, or source.
Data Resilience
The Data Resilience group covers entries related to ensuring data availability, integrity, and sovereignty across its lifecycle. This includes replication, backup, recovery, region restrictions, and protection against data loss or corruption.
CCC.K8S.CP13Kubernetes Storage Provisioning
The service can dynamically provision ephemeral and persistent workload storage through Kubernetes container storage interface integrations.
CCC.Core.CP22Location Lock-Inimported
Imported from CCC.Core.Capabilities
The service may be configured to restrict the deployment of child resources to specific geographic locations.
Resource Management
The Resource Management group covers entries related to the lifecycle, configuration, and operational integrity of cloud resources. This includes resource exhaustion, tag manipulation, version rollback, scaling, and cost management.
CCC.K8S.CP15Cluster Version Management
The service may be configured with upgrade channels and maintenance settings that keep control-plane and worker components within provider-defined compatibility and support periods.
CCC.Core.CP20Resource Taggingimported
Imported from CCC.Core.Capabilities
The service provides users with the ability to tag a child resource with metadata that can be reviewed or queried.
Observability
The Observability group covers entries related to logging, monitoring, metrics, alerting, and event publication. This includes audit trail integrity, enumeration detection, and protection against tampering or unauthorized access to operational telemetry.
CCC.K8S.CP16Kubernetes Audit Logging
The service may be configured to emit Kubernetes API audit and control-plane records to a cloud logging destination for monitoring and investigation.
CCC.K8S.CP17Cluster Monitoring Integration
The service can send cluster, node, workload, and network activity telemetry to cloud-native or Kubernetes-compatible monitoring components.
CCC.Core.CP07Event Publicationimported
Imported from CCC.Core.Capabilities
The service automatically publishes a structured state-change record upon creation, deletion, or modification of data, configuration, components, or child resources.
CCC.Core.CP17Alertingimported
Imported from CCC.Core.Capabilities
The service may be configured to emit a notification based on a user-defined condition related to the data published by a child or networked resource.
Encryption
The Encryption group covers entries related to protecting data confidentiality and integrity through cryptographic mechanisms. This includes encryption in transit and at rest, key management, and certificate lifecycle management.
CCC.Core.CP01Encryption in Transit Enabled by Defaultimported
Imported from CCC.Core.Capabilities
The service automatically encrypts all data using industry-standard cryptographic protocols prior to transmission via a network interface.
CCC.Core.CP02Encryption at Rest Enabled by Defaultimported
Imported from CCC.Core.Capabilities
The service automatically encrypts all data using industry-standard cryptographic protocols prior to being written to a storage medium.
Ingestion
The Ingestion group covers entries related to how a service receives or retrieves data, inputs, or commands for processing. This includes both active (pull-based) and passive (push-based) ingestion patterns.
CCC.Core.CP29Active Ingestionimported
Imported from CCC.Core.Capabilities
While running, the service itself can fetch or reach out to some other service or external source to get data, inputs or commands for the service to process or operate on.
CCC.Core.CP30Passive Ingestionimported
Imported from CCC.Core.Capabilities
While running, the service can pause, idle or wait to receive inputs, commands, or data from some other service or external source for the service to process or operate on.