Why should you care?

CloudVerse PCI scope requires TLS everywhere and encrypted disks on every datastore.

See it live — copy this example

Use AWS/Azure/GCP free tier or local Docker/Kind. Sketches and YAML are meant to be typed and adapted.

# Kubernetes TLS ingress (CloudVerse)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-tls
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
  - hosts: [api.cloudverse.io]
    secretName: api-cloudverse-tls
  rules:
  - host: api.cloudverse.io
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service: { name: payments-api, port: { number: 443 } }

What happened?

• TLS in transit; AES at rest on disks and object stores.
• Customer-managed keys add control and ops burden.

Practice next

1. Enable default encryption on storage account.
2. Issue cert via cert-manager.
3. Verify TLS with openssl s_client.
4. Enable CMK on one database.
5. Add HSTS header at ingress.

Remember

Encrypt rest + transit. Automate cert renewal. Know who holds keys.

CloudVerse API TLS

Pen test flags expired cert on staging.

Outcome: cert-manager auto-renew fixes prod class issue.