Overview
The Xloud Compute control plane manages hypervisor hosts, instance lifecycle, and metadata delivery. Securing it against unauthorized access, network eavesdropping, and API abuse is critical in any production deployment. This guide covers the three primary hardening areas: metadata service protection, live migration TLS, and API rate limiting.The following hardening measures must be applied to all production deployments.
Failure to secure the compute control plane exposes hypervisor hosts, instance
metadata, and inter-node communication to unauthorized access and data interception.
Prerequisites
- Admin credentials sourced from
admin-openrc.sh - XDeploy access for host-level configuration changes
- TLS certificates issued by the cluster CA (required for live migration TLS)
Metadata Service Protection
The instance metadata service (169.254.169.254) is accessible from every running
instance by default. It delivers user data, SSH public keys, and cloud-init configuration.
Unrestricted access to this endpoint is a common attack vector in multi-tenant environments.
Restrict metadata access via security groups
Restrict metadata access via security groups
Apply security group rules to limit which instances can reach the metadata endpoint.
In environments where instances do not require cloud-init or credential injection at
boot, block metadata access entirely.Configure metadata access restrictions through XDeploy under Compute → Advanced
Settings → Metadata Security.
Verify instance metadata service status
Enable metadata service authentication
Enable metadata service authentication
Metadata service authentication requires instances to present a signed token when
requesting user data and credentials. This prevents unauthorized metadata reads from
compromised instances or SSRF attacks.Enable authenticated metadata through XDeploy under Compute → Advanced Settings →
Metadata Security → Require Authentication.
Apply API rate limiting on the metadata endpoint
Apply API rate limiting on the metadata endpoint
Configure rate limits on the metadata endpoint to prevent abuse:
- Maximum 60 requests per minute per instance
- Temporary block after 3 consecutive rate limit violations within 5 minutes
Live Migration TLS
By default, live migration transfers instance memory and disk data over the management network without encryption. Enable TLS for live migration to protect in-flight instance data from network interception.Enable live migration TLS
Enable live migration TLS
Live migration TLS encrypts the migration data channel between source and destination
hypervisor nodes using mutual TLS authentication.Enable TLS through XDeploy under Compute → Security → Live Migration TLS.
This requires all compute nodes to have valid TLS certificates issued by the cluster CA.
Verify current live migration configuration
Verify TLS is active after enabling
Verify TLS is active after enabling
After enabling live migration TLS and restarting all compute agents, verify the
configuration is active:Initiate a test live migration between two hosts and verify in the migration log
that the connection uses TLS. Inspect the migration network traffic to confirm
data is encrypted.
Check compute agent configuration on a host
A successful live migration after enabling TLS confirms the configuration is
working. Any migration failure at this stage typically indicates a certificate
validation error — verify certificate validity and CA trust chain on all nodes.
API Rate Limiting
The Compute API does not enforce rate limits by default. Without rate limiting, malicious actors or misconfigured automation can issue thousands of API requests per second, degrading control plane performance and enabling denial-of-service conditions.Configure rate limits
Configure rate limits
Xloud recommends the following rate limits for production deployments:
Apply these limits at the load balancer layer or via the Compute API service
configuration through XDeploy under Compute → Security → API Rate Limiting.
| Operation Type | Recommended Limit | Scope |
|---|---|---|
| Write operations (POST/PUT/DELETE) | 100 per minute | Per user |
| Read operations (GET) | 1,000 per minute | Per user |
| Admin operations | 500 per minute | Per admin user |
Enable automatic temporary bans
Enable automatic temporary bans
Configure automatic temporary bans for clients that repeatedly exceed rate limits:
- Clients exceeding the rate limit threshold 3 times within 5 minutes receive a temporary 15-minute block
- All blocked requests return
HTTP 429 Too Many Requests - Block events are logged for security audit review
Security Checklist
Review these items on every production deployment.| Control | Configured Via | Priority |
|---|---|---|
| Metadata service authentication enabled | XDeploy → Compute → Metadata Security | High |
| Metadata endpoint rate limiting applied | XDeploy → Compute → Metadata Rate Limiting | High |
| Live migration TLS enabled | XDeploy → Compute → Security → Live Migration TLS | High |
| API rate limiting configured | XDeploy → Compute → Security → API Rate Limiting | Medium |
| Console proxy ports firewalled to admin CIDRs | Firewall / security group rules | Medium |
| Admin API endpoints restricted to management network | Load balancer / HAProxy ACL | High |
Next Steps
Live Migration
Configure and test live migration after enabling TLS on the migration channel.
Advanced Features
Enable vTPM and UEFI Secure Boot for instance-level hardware security.
Admin Guide
Return to the Compute Administration Guide index.