Described are techniques for secure workload configuration including a method comprising receiving a workload definition file at a worker node and from a master node, where the workload definition file comprises an encrypted immutable definition, a partially immutable definition with a predefined range of values and a first value modified by the master node, and a variable definition with a second value modified by the master node. The method further comprises decrypting, by the worker node, the encrypted immutable definition to generate a decrypted immutable definition. The method further comprises verifying, by the worker node, that the first value satisfies the predefined range of values. The method further comprises, in response to decrypting the encrypted immutable definition and verifying that the first value satisfies the predefined range of values, executing a workload based on the workload definition file in a virtual computing environment.