Gough for Security Engineers
Every service gets a SPIFFE identity, every certificate comes from Vault PKI, and every BMC gets its certificate checked before Gough trusts it.
Pain points
- Static, long-lived credentials scattered across a bare-metal fleet are a standing liability.
- BMC/iLO management interfaces are a common blind spot for certificate validation.
- Workload templates deployed at the infrastructure layer need supply-chain provenance, not just a filename.
How Gough helps
- Vault PKI plus SPIRE-issued SPIFFE identity means every service authenticates over mTLS with no long-lived static credentials. (Vault PKI + SPIFFE/SPIRE Identity)
- BMC certificate validation runs during Phase 1 discovery and flags a mismatch rather than silently trusting it. (Hardware Discovery & BMC Validation)
- The four built-in Biomes ship pre-verified at release; cosign signing and SBOM generation for a custom Biome you author is on the roadmap, so treat custom Biomes as unverified until it ships. (Biomes: Packaged, Versioned Workloads)
- Node shell access uses short-lived, Vault-rooted SSH certificates instead of distributed static keys, and rejects anything outside its validity window. (Auditable Reverse-SSH Remote Access)