Pattern
Layered Zero Trust
Status
Tested
TestedResources
About the Layered Zero Trust pattern
The Layered Zero Trust Validated Pattern deploys a complete Zero Trust security architecture on Red Hat OpenShift Container Platform, automatically, via GitOps. It addresses the fundamental shortcoming of traditional perimeter security: the assumption that anything inside a trusted domain (the network, its services, and its actors) can be trusted.
Static defenses don’t stop what’s already inside — Perimeter firewalls and ingress controllers protect the front door, but supply chain attacks, compromised dependencies, and insider threats operate from within. Zero Trust assumes breach and enforces verification at every interaction.
You can’t patch fast enough — Over 40,000 CVEs were published in 2025. AI-powered exploit generation is shrinking the window between disclosure and exploitation. Zero Trust provides defense-in-depth that contains threats even when patches haven’t been applied yet. Read more.
Compliance mandates require evidence, not promises — Federal mandates (EO 14028, OMB M-22-09, CISA Zero Trust Maturity Model) and industry standards (NIST SP 800-207, NIST SP 800-53) require organizations to demonstrate Zero Trust implementation with auditable evidence. The ZTVP generates this evidence automatically through GitOps audit trails, compliance scanning, and runtime monitoring.
About the solution elements
The pattern deploys the following security capabilities automatically:
| Capability | What it does |
|---|---|
Secret Management | Database credentials and API keys are stored in HashiCorp Vault and injected just-in-time. Vault also provides JWT-based authentication for workload identity verification. The External Secrets Operator (ESO) synchronizes secrets from Vault into the cluster, keeping them up to date automatically. |
Workload Identity | Every pod gets a cryptographic identity (SPIFFE/SPIRE) — no shared secrets. |
User Authentication | Centralized SSO via Red Hat build of Keycloak with per-application OIDC clients. |
Network Segmentation | Default-deny NetworkPolicies — every connection must be explicitly allowed. |
Runtime Security | Red Hat Advanced Cluster Security monitors workload behavior and terminates compromised pods in real-time. |
Compliance Scanning | Continuous CIS benchmark scanning with automated remediation via the Compliance Operator. |
Certificate Management | Automated TLS certificate lifecycle with daily CA rotation. |
Supply Chain Security | Keyless artifact signing, SBOM analysis, and tamper-evident transparency logs. |
About the architecture
The ZTVP uses a layered architecture:
Layer 0 (Foundation) deploys the core security baseline automatically: identity, secrets, compliance, certificates, and runtime monitoring.
Layer 1 (Feature Sets) adds optional capabilities like supply chain security and private registries when you need them.
Layer 2 (Use Cases) provides real applications that demonstrate Zero Trust in practice.
For a full technical breakdown, see the Architecture page.
Next steps
Getting started — Deploy the pattern via GUI or CLI
Architecture — Layered model, sidecar pattern, deployment variants
Data Protection — Zero Trust data protection in action
Security Monitoring — ACS as the Zero Trust brain
Blog: Can’t Patch Fast Enough? Zero Trust as a Last Line of Defense
Blog: Lights On! Real-Time Threat Response with Red Hat Advanced Cluster Security
