---
title: Zero Trust Workload
description: Apply workload identity, runtime hardening, and policy enforcement close to compute and platform services across VM and Kubernetes run environments.
sidebar:
  label: Zero Trust Workload
  order: 19
source_url: "https://framework.stackit.cloud/migration/design-and-mobilize/security-and-compliance/zero-trust-workload/"
source_file: "docs/migration/design-and-mobilize/security-and-compliance/zero-trust-workload.mdx"
---

## Purpose

Zero Trust Workload protects applications and runtime components through explicit identity, hardened run environments, and policy checks at runtime.

## Control objectives

- **Workload identity integrity**: Services use distinct machine identities with clear trust boundaries.
- **Runtime hardening baseline**: Compute configurations, images, and run settings follow minimum security standards.
- **Controlled workload-to-workload access**: Service communication is explicitly authorized.
- **Continuous runtime assurance**: Drift, vulnerabilities, and policy violations are detected and remediated.

## Design recommendations

- **Separate human and machine identity**: Keep workload credentials independent from user identities.
- **Harden runtime templates**: Define secure defaults for VM images, container settings, and management access.
- **Minimize privilege in runtime context**: Restrict run permissions, network reachability, and secret exposure.
- **Integrate policy checks into delivery flow**: Validate workload controls before and after deployment.

## Implementation checkpoints

- **Workload hardening standard**: Baseline for patching, image provenance, and runtime configuration controls.
- **Service identity pattern**: Consistent model for issuing, rotating, and revoking machine credentials.
- **Deployment policy gates**: Mandatory checks for critical workloads and high-impact changes.
- **Runtime telemetry model**: Coverage for workload health, security signals, and policy deviations.

## STACKIT references

- **Security in Compute Engine**: <LinkChip href="https://docs.stackit.cloud/products/security/security-hardening/security-in-compute-engine/">Documentation</LinkChip>
- **Container Registry**: <LinkChip href="https://docs.stackit.cloud/products/developer-platform/container-registry/basics/introduction-to-container-registry/">Documentation</LinkChip>

## Anti-patterns to avoid

- **Shared workload credentials**: Multiple services rely on one technical identity.
- **Runtime hardening as optional**: Security controls are deferred until after go-live.
- **Policy drift tolerance**: Known workload deviations remain unresolved over time.