Production checklist

A checkable list of everything a MAQPNA installation needs before agents act on production systems, grouped by area, with the command that verifies each item.

Go through this list before you let agents act on real systems, and again after every upgrade. Each item has the command that proves it. Most items are posture checks that maqpna doctor runs; the rest are release, operations and process checks that doctor cannot see.

For what each posture check protects against and the value that fixes it, see Security hardening checklist. This page is the run sheet.

flowchart LR
  A["Collect posture<br/>doctor -o json"] --> B["Tick items<br/>by area"]
  B -->|"fail or warn"| C["Fix values"]
  C --> D["values validate<br/>+ maqpna upgrade"]
  D --> A
  B -->|"all ticked"| E["Record accepted risks<br/>and sign off"]

Before you start#

Set up a terminal with an access token that has the auditor or admin role, and collect the posture report once. Every st call below reads from that file.

export GW=http://127.0.0.1:9090          # the admin listener (gateway.config.adminListen)
kubectl -n maqpna-system port-forward svc/maqpna-gateway 9090:9090 &

maqpna doctor -n maqpna-system --gateway "$GW" --oidc-token-file admin.tok -o json > posture.json

# st ID: print the status of one posture check (pass, warn, fail, info, skip or accepted)
st() { jq -r --arg id "$1" '.checks[] | select(.id==$id) | "\(.status)\t\(.id)\t\(.detail // "")"' posture.json; }

Each posture item below is done when st prints pass, or accepted with a written reason. Re-run the maqpna doctor line after each fix. maqpna doctor --strict exits 0 only when nothing is warn or fail.

Release and images#

• The release you install is signed by the MAQPNA release workflow. maqpna verify release 2.1.0 --registry "$REGISTRY"
• Every image is pinned by digest (image.digests). kubectl -n maqpna-system get pods -o jsonpath='{range .items[*].spec.containers[*]}{.image}{"\n"}{end}' | grep -v @sha256 || echo "all pinned"
• The CLI and every component are on supported versions, and the CRDs match. maqpna version --check
• The installed CRDs are served and match this release. st crd-installed; st crd-schema-current
• Images come from an allowed registry (sovereign installations). maqpna preflight --chart ./maqpna -f my-values.yaml shows PASS image-registry-allowed.

See Verify releases.

Values#

• The values pass the schema, the chart guards and the production rules. maqpna values validate --chart ./maqpna -f maqpna/values-production.yaml -f my-values.yaml --profile production --strict
• Every CHANGE-ME value of the profile points at your systems (the markers are comments, so check the placeholder hosts are gone). helm get values maqpna -n maqpna-system --all | grep -c 'example\.internal' prints 0.
• The echo demo MCP server is off. helm get values maqpna -n maqpna-system --all -o json | jq .examples.mcpEcho.enabled prints false.
• No deprecated static upstreams; MCP servers are MCPServer objects. st static-upstreams

Admin access and approvals#

• The admin API authenticates with OIDC. st admin-auth-mode
• The static admin token is off, or kept only as audited break-glass. st admin-break-glass-token
• The admin API is on its own listener, reachable only by operators. st admin-listen
• Your identity provider's groups map to the roles you expect. maqpna login && maqpna whoami
• Approval previews show approvers no more than they need (redacted, hash or none). helm get values maqpna -n maqpna-system --all -o json | jq -r .approvals.preview.mode
• Session principals are bound to the Kubernetes user who created the session. helm get values maqpna -n maqpna-system --all -o json | jq -r .principalBinding.mode prints requester.

Audit ledger#

• Calls are refused when their audit record cannot be written. st audit-failure-policy
• Checkpoints are signed with a key you hold. st audit-signed-checkpoints
• The ledger is shipped to write-once storage (WORM). st audit-worm-sink
• The ledger verifies end to end. maqpna audit verify --gateway "$GW" --oidc-token-file admin.tok
• Every SIEM and WORM sink keeps up. maqpna audit sinks --gateway "$GW" --oidc-token-file admin.tok --max-lag 1000
• Retention meets your regulation (CERT-In, DPDP, EU AI Act). maqpna values validate --chart ./maqpna -f my-values.yaml --profile eu-ai-act (or cert-in, dpdp)

See Audit ledger and Cloud profiles.

State and availability#

• Gateway replicas share one state backend (PostgreSQL). st state-backend; st gateway-replicas-state
• At least two gateway replicas, with a PodDisruptionBudget. kubectl -n maqpna-system get pdb
• Every gateway pod is ready and its backend reachable. kubectl -n maqpna-system get pods -l app.kubernetes.io/name=maqpna-gateway
• The shared audit chain in PostgreSQL verifies. maqpna audit verify --postgres dsn.txt --schema maqpna
• You decided, before an incident, what happens when PostgreSQL is down (auditFailurePolicy), and wrote it in the PostgreSQL outage runbook copy your on-call team uses.

See Scaling and high availability.

Identity and keys#

• The identity signing key is persistent and held by you. st identity-key-mode
• Agent tokens are bound to workload certificates (mTLS with SPIFFE). st tls-svid
• The token vault accepts only verified users of one identity provider. st token-vault-issuers
• The argument-capture key lives in a KMS or HSM. st capture-key-custody
• You know where every key is and how it rotates. maqpna keys inventory --resolve
• A key rotation has been rehearsed. maqpna keys rotate identity --dry-run

See Key rotation runbook and Cloud identity & keys.

Data protection and policies#

• A default DLP profile applies to all traffic. st dlp-default-profile
• Prompt-injection guards fail closed. st guards-fail-mode
• Cedar policies have an engine (release images). st cedar-engine
• Budgets and metering use one currency. st budget-currency
• Your policies pass their tests. maqpna policy test policies/ --require-tests
• Your manifests validate. maqpna validate -f manifests/ --strict
• Tools of your MCP servers are pinned and none has drifted. maqpna mcp tools team-a/<server> --gateway "$GW" --drift-only

See Write policies and Protect data with DLP profiles.

Sovereignty#

• The sovereignty policy is enforced at the gateway. st sovereignty-policy
• The sovereignty policy is enforced at admission. st cluster-sovereignty-policy
• Trace export stays in the jurisdiction. st otel-residency
• Your agents comply with the sovereignty policy before you deploy them. maqpna sovereignty check -f agents/ --policy sovereignty.yaml

Cluster and sandboxes#

• Every trust tier has its RuntimeClass. st runtimeclass-per-tier
• Agent namespaces are default-deny. st networkpolicy-default-deny
• The CNI really enforces NetworkPolicy: a pod in an agent namespace cannot reach the internet. kubectl -n team-a run np-test --rm -it --restart=Never --image=busybox -- wget -T 5 -qO- https://example.com must time out.
• A real session starts, runs and is cleaned up. maqpna smoke --sandbox team-a/<agent> (or helm test maqpna -n maqpna-system)
• Sessions run on the nodes you expect. kubectl get pods -A -o custom-columns=NS:.metadata.namespace,POD:.metadata.name,RC:.spec.runtimeClassName,NODE:.spec.nodeName

Attestation (tier-2 only)#

• Attestation uses a hardware verifier (Trustee). st attest-verifier
• Attestation responses are signed. st attest-response-signing
• Reference values list only reviewed measurements. helm get values maqpna -n maqpna-system --all -o json | jq .attestation.referenceValues

Observability#

• Prometheus scrapes the operator, the gateway and the attestation service. kubectl -n maqpna-system get servicemonitor,prometheusrule
• Alerts reach your on-call rotation. Fire a test alert through your Alertmanager route.
• maqpna status shows the release, workloads, pending approvals and the ledger head. maqpna status --gateway "$GW"

See Monitoring and alerts.

Backup, recovery and incident response#

• A sealed, signed backup exists. maqpna backup verify /backups/latest --verify-key backup-signer.pub
• A restore drill passes. maqpna dr drill --gateway "$GW" --oidc-token-file admin.tok
• The kill switch works and the on-call team has rehearsed it. maqpna kill --gateway "$GW" -n team-a --session <test-session> --reason "drill" --ttl 5m --yes, then maqpna revocations list --gateway "$GW"
• Each runbook is linked from the matching alert: kill switch, compromised agent, ledger divergence, PostgreSQL outage, attestation failure, key rotation.

See Backup, restore and DR drill.

Licence#

• A commercial licence is installed and valid. maqpna license status -n maqpna-system (exit 3 when invalid or expired)
• Billable nodes are within the licence limit. st license-node-limit

A licence never blocks agent traffic.

Sign-off#

• maqpna doctor -n maqpna-system --gateway "$GW" --oidc-token-file admin.tok --strict exits 0.
• Every accepted check is in your change record with a reason and an owner. jq -r '.checks[] | select(.status=="accepted") | .id' posture.json

Next steps#

• Security hardening checklist: what each check means and how to fix it.
• Production install with Helm
• Upgrade and rollback
• Command reference: maqpna doctor, maqpna smoke, maqpna values validate.