Security best practices

Security recommendations for CARTO Self-Hosted

Overview

Follow these best practices to harden your CARTO Self-Hosted installation.

TLS configuration

• Enforce TLS 1.2 or higher, and disable TLS 1.0 and 1.1 on your load balancer and ingress controller

• Use strong cipher suites

• Automate certificate renewal using cert-manager + Let's Encrypt, or your cloud provider's managed certificate service. Do not rely on manual certificate renewal processes

Secret management

• Rotate secrets regularly — see the Key rotation schedule section below

• Never commit carto-secrets.yaml to version control. Use .gitignore and store the file in your secrets manager.

Network segmentation

• Apply Kubernetes NetworkPolicies to restrict pod-to-pod traffic:

  • CARTO pods should only accept traffic from within the CARTO namespace and from the ingress controller

  • PostgreSQL should only accept connections from the CARTO namespace CIDR

  • Valkey should only accept connections from the CARTO namespace

• Use private cluster networking — no public node IPs; all inbound traffic through the load balancer only

• If connecting to managed database or cache services, use private endpoints (VPC peering, Private Service Connect, PrivateLink, Private Endpoint) to avoid traffic traversing the public internet

Identity and access

Use cloud-native workload identity instead of long-lived keys:

Cloud	Mechanism	Benefit
GCP	Workload Identity	CARTO pods authenticate as a GCP service account without key files
AWS	EKS Pod Identity	CARTO pods assume an IAM role without access keys

See the configuration guides in the Security configuration section for setup instructions.

Restrict Admin Console access (Kots):

• Change the default Admin Console password immediately after the first login

• Limit network access to the Admin Console port to your operations team's IP range

Key rotation schedule

Secret	Rotation cadence	How to rotate
PostgreSQL database credentials	Every 90 days	Update in your secrets store; restart CARTO pods to pick up the new credentials
Object storage service account keys	Every 90 days (if using key-based auth)	Prefer Workload Identity / IRSA / Managed Identity to eliminate key rotation
TLS certificates	Per certificate validity (typically 90 days for Let's Encrypt, 1 year for commercial CAs)	Automate with cert-manager
CARTO license credentials	On renewal (before expiry)	Apply updated carto-secrets.yaml or Kots license file