Firewall & Security

Restrict access to the control plane

Two ports give control of the server and should only be reachable from Zenavo:

• SSH (22): used during setup and for maintenance.
• Kubernetes API (6443): used for every deployment. It requires a client certificate that only Zenavo holds, but it should still not be open to the internet.

Allow both only from the Zenavo control plane's address, and keep 80, 443 and (if you publish ports) 30000–32767 open to everyone. The server's Firewall tab checks each port from the control plane and shows whether it is reachable.

What Zenavo stores

• The SSH private key Zenavo uses for the server, encrypted. If you connected with a password, the password was used once and never stored.
• The cluster's admin credentials (kubeconfig), encrypted.
• A pull credential for the image registry that can read only your team's images.

When you remove a server, Zenavo deletes these. K3s and your data stay on the machine: remove Zenavo's key from ~/.ssh/authorized_keys and run /usr/local/bin/k3s-uninstall.sh there if you no longer need them.

Builds never run on your server

Git builds run on Zenavo's build machines, which have no access to the control plane, other customers or cloud credentials. Your server only pulls finished images, pinned to their digest.