Supported Design Patterns

Supported design patterns define technical and security requirements for integrating customer applications with the 2F Platform. These patterns guide customers on architectural expectations, security compliance, and operational considerations to streamline onboarding and deployment.

Architecture

Containerized applications: Package your application as an Open Container Initiative (OCI)-compliant container. If you plan to deploy your software using any other format, please contact your sales representative or Mission Success Manager for guidance.
Database seeding services or scripts: Provide database seeding services or scripts for Game Warden to execute. At IL4, Game Warden restricts production database write access.
Complete applications: Applications must be fully functional before starting the onboarding process.

Must-Have

Containerized applications: Package your application as an Open Container Initiative (OCI)-compliant container. If you plan to deploy your software using any other format, please contact your sales representative or Mission Success Manager for guidance.
Database seeding services or scripts: Provide database seeding services or scripts for Game Warden to execute. At IL4, Game Warden restricts production database write access.
Complete applications: Applications must be fully functional before starting the onboarding process.

Nice-to-Have

Built-in database migration: Your organization should handle your own data and schema migrations.
Microservice architecture: Deploy one service per container to improve reliability.
Dummy data for testing: Provide dummy data or data scrubbing methods for Staging (STG) environment testing.
End-to-end automated testing: Use automated testing to test application functionality.
Structured logs: Use structured logging to simplify observability and troubleshooting.
Configuration documentation: Provide documentation for configuration variables and APIs.
Simple Helm charts: Prefer Helm charts designed for Helminator, supported by detailed Authorization Boundary Diagrams.
Logs to stdout: Log to stdout for seamless collection and analysis with observability tools.
Detailed diagrams: Submit comprehensive Authorization Boundary Diagrams showing ports, protocols, and system architecture.

Acceptable Use

Single points of failure: Must function reliably; Game Warden will assist with resilience improvements.
Monolithic applications: Accepted but increase operational complexity.
S3-hosted frontends: Supported with conversion to NGX containers as needed.
Own Helm charts or Kustomize manifests: Use Helm (via Helminator) when possible, and ensure your team is familiar with Kubernetes.
Mobile applications: Supported.

Deal Breaker

Moving high Impact Level (IL) data to lower ILs: Prohibited to prevent data spillage.
External connections outside NIPRNet: Not supported; feature under future consideration.
IL4/IL5 access without Appgate SDP: For AFWERX deployments, connect via Appgate SDP or an approved VPN when not on NIPRNet.

Security

Data classification adherence: Allow only approved classifications (CUI, PII, IL2, IL4, IL5, ITAR). Contact Game Warden for IL6, SAP, or SCI data.
Keycloak integration: All applications must use Game Warden's Keycloak for access control.
ATO compliance: Applications must meet Authority to Operate (ATO) standards and address security vulnerabilities.
Integration with DOW-approved authentication: Support only Game Warden and Platform One authentication services.
Government-issued access credentials: Required Common Access Card (CAC), External Certification Authority (ECA), or Personal Identity Verification (PIV) credentials for IL4+ access.
Regular updates: Maintain and update your application to mitigate known vulnerabilities and meet the Acceptance Baseline Criteria.
Authorization Boundary Diagram: Provide a detailed diagram showing components, data flow, ports, protocols, and external connections.
Active DOW contract: Required for IL4+ deployment.

Must-Have

Data classification adherence: Allow only approved classifications (CUI, PII, IL2, IL4, IL5, ITAR). Contact Game Warden for IL6, SAP, or SCI data.
Keycloak integration: All applications must use Game Warden's Keycloak for access control.
ATO compliance: Applications must meet Authority to Operate (ATO) standards and address security vulnerabilities.
Integration with DOW-approved authentication: Support only Game Warden and Platform One authentication services.
Government-issued access credentials: Required Common Access Card (CAC), External Certification Authority (ECA), or Personal Identity Verification (PIV) credentials for IL4+ access.
Regular updates: Maintain and update your application to mitigate known vulnerabilities and meet the Acceptance Baseline Criteria.
Authorization Boundary Diagram: Provide a detailed diagram showing components, data flow, ports, protocols, and external connections.
Active DOW contract: Required for IL4+ deployment.

Nice-to-Have

Case-by-case external data transit: Requires Game Warden review and government approval.
Pre-scan with open source security tools: Recommended before submitting images.
Data classification tagging: Use data tags (from example, CUI) to aid in proper handling.
Known base containers: Use commonly supported base images, such as Universal Base Images (UBIs), which streamline security review and troubleshooting.

Acceptable Use

Data pull operations: Allowed when initiated within the Game Warden boundary.
NIPRNet external connections: Permitted with NIPRNet IP whitelisting.
Iron Bank-based containers: Acceptable if they meet Iron Bank baseline standards.

Deal Breaker

Hosting classified data: Prohibited on Game Warden; deployment to classified networks requires ODIN.
Data movement from higher to lower ILs: Prohibited.
No Game Warden SSO for IL4/IL5: Mandatory to use Game Warden SSO.
Non-accredited external connections: External IL4/IL5 connections must be to accredited systems.
Unvetted commercial data streaming: Requires pre-approval discussion with Game Warden.

General

DOW contract for IL4/IL5: You must have an active DOW contract to deploy to the IL4 and IL5 Staging (STG) and Production (PRD) environments.
U.S. Citizenship: Required for engineers involved in deployment.
.mil domain association: For AFWERX, applications must deploy under afwerx.dso.mil.
2F.mil domain association: For DISA, applications must deploy under 2F.mil.

Feature requests

Have an idea for a new Game Warden feature or improvement? Use the feedback widget to share your suggestion with the product team.