Production checklist
- Complete the legal, privacy, and support controls in Data boundary & responsibilities.
- Use a dedicated Linux server and operating-system service account.
- Restrict Docker-administration membership.
- Restrict access to the OneView installation account and protected installation data.
- Keep a tested protected installation backup.
- Use externally managed PostgreSQL with verified TLS and tested backups.
- Do not expose PostgreSQL publicly.
- Require HTTPS for every production browser and API request.
- Permit outbound traffic only to required OneView, database, and vendor endpoints.
- Use individual administrator accounts and least-privilege roles.
- Review active browser sessions and revoke unrecognised or retired access.
- Rotate temporary passwords and vendor credentials through approved workflows.
- Assign one API Service Account per application/environment with a named owner and expiration where appropriate.
- Store API keys in an approved secret manager; rotate before expiry and revoke immediately after compromise, unexpected use, owner departure, or integration retirement.
- Never use human passwords or browser session cookies for application-to-application verification calls.
- Test host-authorized administrator recovery and keep its authorization/password files restricted to the host administrator.
- Keep host-authorized local recovery available when SSO is introduced later.
- Review administrative activity and infrastructure logs.
- Apply approved OneView releases with the exact command displayed by the installed application.
- Never share license or setup credentials, vendor credentials, certificate private material, or verification data.
Host administrator warning
Anyone with Docker or root access can inspect or replace client containers. Limit that access, monitor changes, and separate application administration from host administration where possible.