CVEs with a blast radius
A CVE page lists the images, deployments and clusters it touches, with EPSS and fix advice, so the question is “which workloads” rather than “how many CVEs”.
PrioritizationCONSTELLATION / KUBERNETES SECURITY EARLY ALPHA
Know your clusters. Prove it.
Constellation is a Kubernetes-native security platform. See what is running, know what is exposed, control what is allowed and prove what happened, from one console installed in your own clusters.
Constellation is in early alpha and not production-ready. Interfaces can change without notice. We are looking for teams who will evaluate it in a lab and tell us what they find. Screens are from an AlphaBravo test environment.
CLUSTER / DASHBOARDCONSTELLATION
How Constellation fits together.
SEE / KNOW / CONTROL / PROVE01 / SEE
See what is running.
Clusters, workloads, images, nodes and platform components, discovered continuously and linked together.
INVENTORY · DISCOVERY · HEALTH02 / KNOWKnow what is exposed.
Image, workload, node and repository scans, ranked by severity, exploit likelihood and exposure.
CVE · KEV · EPSS · SBOM03 / CONTROLControl what is allowed.
Admission rules before deployment, runtime baselines and network policy after it.
ADMISSION · RUNTIME · NETWORK04 / PROVEProve what happened.
Framework-mapped checks, exemptions with expiry, and an audit log you can verify.
EVIDENCE · AUDIT · ACCESSDetection is on by default. Blocking is something you turn on, where you choose.See the architecture
FROM IMAGE TO EVIDENCE
Follow one workload through Constellation.#
Select a stage. Each shows the console screen and the specifics behind it, including what is on by default and what you have to turn on.
Find it
Start from what is actually deployed. The discoverer records each cluster’s workloads, images, nodes and platform, and the dashboard rolls them up into a risk score and the counts that need action.
- Workloads linked to the images they run.
- Privileged, root and host-network workloads called out.
- Every registered cluster in one console.
Scan it
Scanner workers inventory images with Syft and match them with Trivy and Grype. Nodes, the Kubernetes platform, repositories and AWS Lambda functions are scanned too.
- Each finding records which engines reported it.
- Signature checks with cosign on every image scan.
- Offline mode for networks without internet access.
Rank it
Findings are ranked by a risk score that combines CVSS, the EPSS exploit probability, the CISA Known Exploited list and exposure. Accepting a risk needs a reason and an expiry.
- KEV and EPSS refreshed every 6 hours.
- See every image, deployment and cluster a CVE touches.
- Exceptions expire within 30 days and are audited.
Gate it
A validating webhook checks pods and the controllers that create them. Privileged, host-network and host-PID workloads are rejected by default. Simulate a manifest before you deploy it.
- Profiles including Pod Security Standards baseline and restricted.
- Optional gates on scan results and trusted signatures.
- Fails open by default so a degraded webhook never blocks the cluster.
Watch it
An agent on every node sees process execs and file access with eBPF and inspects pod traffic. Each workload learns a baseline; drift raises an alert, and blocking is opt-in per workload.
- Learn, Monitor and Enforce per workload.
- Traffic map and network policies generated from observed flows.
- Response rules: notify, webhook, quarantine or isolate.
Prove it
Live cluster objects are checked every 6 hours and mapped to framework controls. Exemptions carry a reason and an expiry, and every change lands in a hash-chained audit log you can verify.
- Mapped to frameworks such as CIS Kubernetes and NIST SP 800-53. Not a certification.
- Audit chain verified from the API or CLI.
- Optional signed daily audit archives to S3.
IN PRACTICE
Built for the people who answer for the cluster.#
Security, platform and audit teams look at the same findings, the same policies and the same record.
Simulate before you enforce
Run a manifest or a live resource through admission rules without changing anything. Keep rules in monitor mode until the warnings are what you expect.
SimulationBaselines, not guesswork
Each workload learns its normal processes. Freeze the baseline to alert on drift, then enforce it for the workloads that are ready.
BaselinesPolicy from observed traffic
Candidate network policies come from the flows Constellation saw. Approve, apply, demote and roll back, with every step audited.
Policy lifecycleExceptions that expire
Accepting a risk or exempting a control needs a reason and an end date, and leaves a record in a hash-chained audit log.
ExemptionsWorks without the internet
Scanners run from pre-loaded databases or internal mirrors, and the KEV and EPSS feeds can point at your own copies.
Offline scanningWORKS WITH ASTRONOMER
Astronomer runs the fleet. Constellation secures it.#
Constellation is a curated application in Astronomer’s catalog. Install it on the clusters Astronomer manages through its GitOps path, with admission policies that stay strict for tenant namespaces.
Constellation + AstronomerASTRONOMER / CATALOG / INSTALL CONSTELLATIONASTRONOMER
STRAIGHT ANSWERS
Questions evaluators ask first.#
Is Constellation ready for production?
No. It is in early alpha: APIs and data formats can change without notice, and there are no stability, security or support guarantees. Evaluate it on non-production clusters and tell us what you find. #
Where does it run?
In your own Kubernetes cluster, installed with a Helm chart. It needs Kubernetes 1.27 or later and stores its data in PostgreSQL, bundled or your own. A Docker Compose demo is available for a first look at the console. #
Will installing it break our workloads?
The runtime agent only detects and alerts by default, and no network policy is applied until someone approves it. The admission webhook does reject privileged, host-network and host-PID pods by default outside its own namespace, so exempt the system namespaces you trust first. It fails open if it is unavailable. #
Does it certify compliance?
No. Constellation maps its checks to framework controls and keeps the evidence and audit trail. A mapped check supports a control; it does not certify a cluster. #
Do we need Astronomer?
No. Constellation runs on its own. If you already use Astronomer, you can install Constellation from its catalog. #
NEXT STEP
See Constellation with your environment in mind.
Tell AlphaBravo what you run today. We will show you the workflows that matter to your team.