Helm chart
Published as an OCI chart and signed. Every component can be turned off, scaled or pointed at your own images. High availability adds topology spreading and disruption budgets and requires a highly available database.
CONSTELLATION PRODUCT / ARCHITECTURE
Runs inside the clusters it protects.
Constellation is a set of Kubernetes services, an agent on each node and one PostgreSQL database, installed with a Helm chart. Each role has one job and its own identity.
Alpha · Chart version 0.2.0 · Kubernetes 1.27 or later01 / COMPONENTS
Inspect the components.#
Select a component to see its job, how it is deployed and what it depends on. Defaults are the Helm chart’s.
API
constellation-api serves the REST API the console and CLI use, checks every call against roles, and writes the audit log. One replica holds a leader lease for background work.
- Leader-elected loops: registry walker, workload auto-scan, scheduled backups, KEV and EPSS imports.
- Health, readiness and Prometheus metrics endpoints.
- Sessions are RS256 JWTs signed with a rotatable key.
Console
A single-page web console served by nginx, which proxies API calls to the API service. Ingress or Gateway API exposure is optional.
- Light and dark themes and a command palette.
- Cluster-scoped views plus organization-wide CVE, posture and settings pages.
- No state of its own.
Scanner
Scanner workers claim scan jobs from the API with a lease, scan with Syft, Trivy and Grype, verify signatures with cosign and report findings back.
- Image, workload, host, platform, repository and serverless targets.
- Concurrency per replica and per target type; optional autoscaling.
- Vulnerability database cache on a volume, with an offline mode.
Admission webhook
A validating webhook for pods, the controllers that template them and PVCs. It runs built-in rules, or database-backed policies when enabled.
- Fails open by default (failurePolicy: Ignore), 5-second timeout.
- Optional quarantine deny-list and audit of decisions.
- TLS from a bootstrap job or cert-manager.
Runtime agent
A privileged agent on every node: eBPF for process and file events, a packet data plane on pod interfaces, and host facts and packages for scanning.
- Enforcement mode monitor by default; protect is opt-in.
- Readiness and liveness probes; a PodDisruptionBudget.
- Tolerates control-plane and other tainted nodes.
Discoverer & collectors
The discoverer watches the cluster and fills the inventory: workloads, images, nodes and platform facts. A compliance collector CronJob checks live objects every 6 hours.
- Workload-to-image links drive CVE impact.
- kube-bench and docker-bench runners are optional CronJobs.
- Namespace filters for the discoverer and collector.
Operator & policy applier
The operator reconciles the ConstellationCluster resource. The network-policy applier puts approved Protect policies on the cluster as native, Cilium or Calico policy.
- Eight custom resource definitions ship with the chart.
- Policy resources reconcile only when the operator has a database connection (not by default).
- The applier polls every 15 seconds.
PostgreSQL
PostgreSQL 16 holds everything: inventory, findings, policies, events and the audit log. There is no other datastore.
- Bundled single-instance StatefulSet by default.
- CloudNativePG cluster (operator installed separately) or an external database for production-style installs.
- S3-compatible storage only for audit archives, backups and report artifacts.
02 / LAYERS
From your people to your nodes.#
| Layer | Components | Owns |
|---|---|---|
| Clients | Web console, constellationctl, CI templates, receivers | Nothing of their own; every call is checked by the API |
| Control plane | API replicas (one leader), console | Policy, findings, exceptions, access, audit chain |
| Workers | Scanner workers, compliance collector, optional benchmark runners | Scan jobs and compliance results |
| In-cluster control | Admission webhook, network-policy applier, operator, discoverer | What is admitted, which network policies apply, the inventory |
| Nodes | Runtime agent DaemonSet | Process, file and network events; host facts and packages; enforcement when enabled |
| State | PostgreSQL 16 | Everything above |
03 / VULNERABILITY DATA
Where the intelligence comes from.#
Trivy and Grype match packages against their own vulnerability databases, refreshed every 6 hours by default. The API imports the CISA Known Exploited Vulnerabilities list and FIRST EPSS scores every 6 hours. An NVD importer is optional.
For restricted networks, scanners can run offline from pre-loaded databases or an internal OCI mirror, and the KEV and EPSS feeds can point at internal mirrors.
Scanning offlineSETTINGS / SCANNER & CVE SOURCESCONSTELLATION
04 / INSTALL
Helm for clusters. Compose for a quick look.#
Docker Compose
A single-host demo with seeded data, for looking around the console. Not a way to protect a cluster.
systemd units
An install script and units for the API, scanners, runtime agent, discoverer and audit archiver timer, for hosts outside Kubernetes. Built from source; no console unit.
helm
helm install constellation \
oci://ghcr.io/alphabravo-oss/charts/constellation \
--namespace constellation --create-namespace \
--version 0.2.0 -f my-values.yamlHardened by default, where it can be
Components run as a non-root user with a read-only root filesystem, all capabilities dropped and the RuntimeDefault seccomp profile. The runtime agent is the exception: it runs privileged to see the node. Chart NetworkPolicies for Constellation’s own components are available and off by default.
05 / MORE CLUSTERS
One console, several clusters.#
Register a cluster to mint an init bundle: scoped scanner and runtime-agent tokens and admission TLS material. Install the chart on the new cluster with that bundle and it reports to the same control plane. Bundles can be listed, rotated and revoked.
In this alpha, a remote cluster’s discoverer, policy applier and compliance collector connect to the control plane’s database directly, so remote clusters need a network path to it. Plan for that before connecting clusters across trust boundaries.
CLUSTERSCONSTELLATION
06 / SUPPLY CHAIN
Built the way we ask you to build.#
Signed, with SBOMs
Each role image is signed keyless with cosign and carries a build SBOM, build provenance and a GitHub build-provenance attestation. Images are built for linux/amd64 today.
Tools checked by hash
Syft, Trivy, Grype and cosign in the scanner image are pinned versions verified by SHA-256 at build time.
A FIPS build of the API
An API image built with Go’s FIPS 140-3 module on a FIPS base image. The runtime agent’s packet data plane is not FIPS. Not a validated configuration; FIPS images are not part of the release yet.
NEXT STEP
Walk through the architecture with us.
Bring your cluster layout, CNI and database constraints. AlphaBravo will map them to Constellation’s components.