– Security

KMS External Key Store (XKS) is now in private preview

Tue, 03 Nov 2026 06:00:00 +0000

Exoscale Key Management Service (KMS) now supports External Key Store (XKS) in private preview. XKS connects Exoscale KMS to a key manager or Hardware Security Module (HSM) that you operate through an XKS proxy that you host. Your external key material remains under your control and is never stored or seen by Exoscale.

Key benefits

Keep control of your root of trust. Hold key material in infrastructure you operate to meet demanding security, sovereignty and regulatory requirements.
Protect data with two encryption layers. Exoscale KMS and your external key manager encrypt data independently, so neither party can decrypt it alone.
Reuse compatible infrastructure. Exoscale implements version 1 of the AWS KMS External Key Store Proxy API, allowing compatible proxies to connect without modification.
Add your own authorization and audit layer. Every request to your proxy carries metadata, including the operation and a request ID, so you can enforce your own policies and keep an independent record of each use of your key, on top of the controls Exoscale KMS already provides.

Because the external key stays under your control, so do its availability and durability: cryptographic operations require your proxy and external key manager to be reachable, and data cannot be recovered if the external key is permanently lost.

XKS is currently in private preview. Its API operations are marked [BETA] and may change.

Check the XKS documentation

KMS now supports asymmetric encryption and digital signatures

Wed, 07 Oct 2026 05:00:00 +0000

Exoscale Key Management Service (KMS) now supports asymmetric keys for encryption and digital signatures. They’re available through the API, CLI, Portal and SDKs.

What’s new

RSA encryption: Create RSA-3072 or RSA-4096 key pairs and export the public key to whoever needs to send you data. They can encrypt without a KMS account, and decryption happens only inside KMS, with the private key never leaving it.
Digital signatures: Sign data with RSA-PSS, ECDSA, Ed25519 or ML-DSA keys. Signing always happens in KMS. You can verify signatures in KMS as well, or export the public key and verify with your own tools, offline if needed.
Post-quantum signatures: ML-DSA-65 and ML-DSA-87 implement FIPS 204, the Module-Lattice-Based Digital Signature standard NIST published in 2024. Unlike RSA and ECDSA, ML-DSA is designed to resist forgery by future quantum computers. That makes it a fit for signatures that must remain verifiable for many years. ML-DSA-65 targets NIST security category 3, and ML-DSA-87 targets category 5.

These additions let you use KMS for application encryption, signing workflows, and integrations that require public-key cryptography, without exposing private key material.

See how to sign and verify data with KMS →

New Works with Exoscale Partner: Airlock Microgateway

Thu, 17 Sep 2026 08:00:00 +0000

Airlock Microgateway by Ergon Informatik AG is now certified as Works with Exoscale, bringing Kubernetes-native application and API protection to workloads running on Exoscale SKS.

Built on open standards, Airlock Microgateway runs directly inside the Kubernetes cluster and combines the Kubernetes Gateway API with Web Application and API Protection (WAAP), identity-aware access control, reporting and monitoring. Routing rules and security policies are managed as code, allowing teams to integrate security directly into existing GitOps and DevSecOps workflows.

Security that fits into Kubernetes

Airlock Microgateway gives platform and application teams a consistent way to manage routing and security without adding a separate security layer outside the cluster:

Kubernetes-native protection: Protect web applications and APIs directly at the cluster entry point.
Security as code: Define routing and security policies declaratively and manage them through existing GitOps workflows.
Identity-aware access: Control access using standards including OIDC, JWT, OAuth 2.0 Token Exchange and mTLS.
Application and API protection: Protect workloads against common web attacks and enforce API specifications with OpenAPI and GraphQL schema validation.
Built on open standards: Use a conformant implementation of the Kubernetes Gateway API together with established technologies including Istio and Cilium.
A path beyond Ingress NGINX: Migrate existing Ingress NGINX resources to Gateway API using the Kubernetes ingress2gateway tool, including its Airlock Microgateway emitter.

Airlock Microgateway can be deployed directly on Exoscale SKS. Its Community Edition provides Kubernetes Gateway API capabilities and reverse proxy capabilities without a license or throughput limit, while advanced security capabilities are available with the Premium Edition.

Protect your Kubernetes workloads →

New on the Marketplace: BunkerWeb Community

Tue, 18 Aug 2026 08:00:00 +0000

BunkerWeb Community is now available on the Exoscale Marketplace. It is an open-source, cloud-native Web Application Firewall (WAF) and reverse proxy from Bunkerity that you put in front of your websites, applications and APIs.

What you can do with it

Add a security layer in front of an existing application without touching its code, by routing traffic through BunkerWeb as a reverse proxy
Block the common attack classes of the OWASP Top 10 before they reach your application
Slow down credential stuffing, scraping and brute-force attempts with rate limiting, bot protection, IP filtering and GeoIP filtering
Serve everything over HTTPS with automated certificate issuance and renewal instead of managing TLS by hand
Protect Linux, Docker, Swarm and Kubernetes workloads with the same tool, configured from a web interface or driven by API
Extend it with plugins and wire it into your existing deployment and automation pipelines

Why it matters

Internet-facing applications need a filtering layer, and the usual choice is between a managed service that routes your traffic through a third party and a WAF you assemble yourself. BunkerWeb Community is a ready-to-run alternative that stays inside your own Exoscale environment, in the zone you choose, with no traffic leaving to an external provider and no per-request pricing.

It is licensed under the AGPLv3, so only the instance it runs on is billed. If you later need tailored SLAs, BunkerWeb PRO is available from Bunkerity via subscription.

To get started, point a DNS A record to the IP address of your instance, then open the setup wizard at your fully qualified domain name.

Explore BunkerWeb Community on the Exoscale Marketplace

Exoscale Key Management Service (KMS) is now available

Thu, 02 Jul 2026 00:00:00 +0000

Exoscale Key Management Service (KMS) is now available, bringing centralized management to encryption keys across cloud workloads, applications, and integrations.

This fully managed service enables organizations to create keys, control their lifecycle, replicate them across zones, and perform cryptographic operations.

What’s new

Create and manage cryptographic keys and use them for your cryptographic workloads.
Control key lifecycle, including **rotation schedules, deletion schedules and key status.
Replicate keys across Exoscale zones for multi-zone deployments.
Benefit from predictable per-key pricing, with all operations included.

What this means in practice

Exoscale KMS gives you greater control over how encryption keys are secured and utilized across sensitive workloads. It helps meet compliance requirements, satisfy internal security policies, and protect regulated workloads through centralized lifecycle management. This also introduces expanded options and flexibility for choosing and managing the exact keys used for Encryption-at-Rest across your Exoscale environment.

Explore Exoscale KMS

New on the Marketplace: Anantis TrapEye

Thu, 18 Jun 2026 00:00:00 +0000

Anantis TrapEye is now available on the Exoscale Marketplace. It adds deception-based threat detection to environments running on Exoscale.

Trapeye works differently from traditional security tools. Instead of hunting for threats hidden in billions of events, it deploys controlled decoys inside your infrastructure. Any interaction with these decoys is malicious by design, resulting in high-fidelity alerts with near-zero false positives.

What does this mean in practice?

Detect attackers at their first interaction and reduce detection time (Mean Time to Detect, MTTD) significantly
High-confidence alerts with almost no false positives
Visibility into lateral movement and attacker behavior
Works across cloud, hybrid, and on-prem environments

Why this matters?

Modern attackers don’t cause immediate visible damage and often remain undetected for months. By the time they are discovered, it’s often too late.

TrapEye shifts the power balance back to the defender by turning your infrastructure into a hostile environment for intruders, exposing them instantly as they move through your network.

Explore deployment details and launch Anantis Trapeye directly from the Marketplace

SKS Node Templates update for Copy Fail and Dirty Frag

Fri, 08 May 2026 14:11:00 +0000

We re-released the SKS Node Operating System images to include mitigations for the recently disclosed Copy Fail and Dirty Frag security vulnerabilities.

The updated images include mitigations for:

Copy Fail (CVE-2026-31431)
Dirty Frag (CVE-2026-43284, CVE-2026-43500)

To ensure your SKS clusters are no longer impacted, worker nodes managed by both SKS NodePools and SKS Karpenter must:

Run Kubernetes 1.33.11, 1.34.7, 1.35.4 or 1.36.0
Have been deployed after May 8, 2026 at 15:55 CEST

Clusters meeting these requirements no longer need the temporary workarounds communicated in the previous security advisory sent on May 1st, 2026.

Existing clusters running older nodes should be upgraded and nodes should be cycled to apply the updated images.

Upgrade your SKS clusters and cycle worker nodes to ensure the updated mitigations are applied.

Check SKS Lifecycle Management Documentation