Astronomer’s job
Adopt, govern and deliver to the fleet. Constellation arrives on a cluster the same way other catalog applications do.
CONSTELLATION SOLUTIONS / CONSTELLATION + ASTRONOMER
Astronomer runs the fleet. Constellation secures it.
Astronomer adopts, governs and delivers to your Kubernetes clusters. Constellation is one of the curated applications in its catalog, so the clusters Astronomer standardizes can get the same security platform the same way. Each product keeps its own console and its own job.
Both products alpha · Installs from Astronomer’s catalog01 / FROM THE CATALOG
A curated application, delivered through GitOps.#
Constellation is a first-party application in Astronomer’s curated catalog of 21. Astronomer operators install it to the clusters they manage from the catalog, and Astronomer delivers it through its GitOps path like any other catalog application.
The install form exposes the Constellation settings people actually change, so a first install does not start from a blank values file:
- Image tag, high availability (on or off, topology key, scheduling policy) and network policies
- API replicas; scanner on or off, replicas, scans per replica and cache
- Scanner engines: Syft, Trivy and Grype
- Runtime agent and its enforcement mode; admission webhook, failure policy and timeout
- Ingress, PostgreSQL mode and cert-manager for admission TLS
The full Helm values stay available for anything the form does not show. The recommended namespace is astronomer-constellation.
ASTRONOMER / CATALOG / INSTALL CONSTELLATIONASTRONOMER
02 / STRICT FOR TENANTS
Platform tools pass. Tenants still get every policy.#
Constellation’s default admission policies reject privileged, host-networked and host-PID workloads. Some of the platform tools Astronomer supports legitimately need those capabilities.
So when Constellation is installed from the Astronomer catalog, Astronomer adds one values default: the admission webhook’s namespace selector skips the system namespaces of Astronomer’s supported tools, such as cert-manager, monitoring, logging, Kyverno and Gatekeeper, ingress, Longhorn, Velero and Istio. Every other namespace, including every tenant namespace, still passes through every Constellation policy.
The exemption is a plain values default. Replace the list in your own values to narrow or widen it.
values set by the Astronomer catalog (excerpt)
admission:
webhook:
namespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: NotIn
values:
- astronomer-cert-manager
- astronomer-monitoring
- astronomer-kyverno
- istio-system
- longhorn-system
- velero
# …and the other supported tool namespaces03 / SET IT UP TODAY
Two steps, in this order.#
Everything here works with the current alpha builds of both products. Use non-production clusters.
Learn about Astronomer- Adopt the clusters in Astronomer
Bring the clusters you want to secure under Astronomer’s management first, so catalog applications can be delivered to them.
- Install Constellation from the catalog
Pick Constellation in Astronomer’s catalog, set the curated fields (or paste full values), and install into
astronomer-constellation. The platform-tool namespace exemptions come with it.
What this does not do yet.#
The products stay separate. Constellation findings do not appear in Astronomer’s console, there is no shared dashboard or single UI, and policy is not shared between them. Sign-in is separate too: Constellation’s optional Astronomer token mode expects JWKS-verified RS256 or ES256 tokens, which Astronomer’s HS256 session tokens are not. Both products are alpha.
Constellation’s job
Inventory, vulnerabilities, runtime, admission, network and compliance evidence for the workloads on those clusters, in its own console.
FAQ
Questions about using both.#
Do we need Astronomer to run Constellation?
No. Constellation installs on its own with its Helm chart, and its own sign-in works without Astronomer. The catalog install is a convenience for teams that already run Astronomer. #
Does the catalog install weaken admission control?
Only for the listed system namespaces of Astronomer’s supported platform tools, which are skipped at the webhook’s namespace selector. Every other namespace still goes through every Constellation policy, and you can replace the list in your values. #
Can our people sign in to Constellation with their Astronomer account?
Not today. Each product has its own accounts and single sign-on settings. Point both at the same OIDC identity provider if you want one set of corporate credentials. #
NEXT STEP
Secure the fleet you already manage.
Tell AlphaBravo how your Astronomer clusters are laid out. We will walk through a catalog install of Constellation with you.