Speak Constellation.

27 terms

Accept riskVulnerabilities

Marking a finding as an accepted risk, with a written reason, an expiry no more than 30 days out and an audit record. An approver, if named, must differ from the requester.

Admission profileAdmission

A named bundle of admission rules for a purpose, such as Pod Security Standards restricted or image provenance required. Ten are built in; profiles can be exported and imported.

Admission webhookAdmission

Constellation’s validating webhook. It checks pods, the controllers that template them and PVCs on create and update, and admits, warns or rejects. It never mutates.

Audit chainGovernance

The audit log, with each event chained to the previous one by SHA-256. The database refuses updates and deletes; verification reports the first break.

BaselineRuntime

The set of processes a workload normally runs, learned by the runtime agent. Each baseline is in Learn, Monitor or Enforce.

Data planeRuntime

The runtime agent’s packet-inspection component on each pod’s interface. It reports flows, application protocols and threat matches, and can block inline when enabled.

DiscovererArchitecture

The component that watches a cluster and records its workloads, images, nodes and platform facts.

DLP ruleRuntime

A data-loss pattern, such as a card number or an API key, matched in pod traffic for opted-in workloads.

Enforcement modeRuntime

The cluster-wide runtime setting: disabled, monitor (the default: detect and alert) or protect (block for workloads whose baseline is in Enforce).

EPSSVulnerabilities

FIRST’s Exploit Prediction Scoring System: the estimated probability that a CVE will be exploited. Part of Constellation’s risk score.

Evidence gateAdmission

An admission check that reads an image’s stored scan, such as its CVEs, scan age or trusted signatures, before admitting it. Needs database-backed policies.

ExemptionCompliance

A recorded exception to a compliance control, with a required reason and expiry. Exempted checks report as exempted, not passed.

Failure policyAdmission

What Kubernetes does when the webhook cannot answer. Constellation defaults to Ignore, so pods are admitted if the webhook is down.

FindingVulnerabilities

One issue on one asset, such as a CVE in a package of an image, with its risk score and state.

Framework mappingCompliance

The link from a Constellation check to the framework controls it supports. Evidence for a control, not a certification.

Init bundleArchitecture

A registration package for another cluster: scoped component tokens and admission TLS material. It can be rotated and revoked.

IsolateNetwork

Cutting a workload off with a default-deny NetworkPolicy that still allows DNS. Needs a CNI that enforces NetworkPolicy.

KEVVulnerabilities

CISA’s Known Exploited Vulnerabilities catalog. A KEV listing raises a finding’s risk score.

Monitor modeAdmission

For an admission rule, admit the pod and return a warning. For runtime, detect and alert without blocking.

Policy applierNetwork

The component that puts approved network policies in the Protect posture on the cluster, as native, Cilium or Calico policy, and removes the rest.

QuarantineRuntime

A time-limited record that a workload is suspect. With the admission quarantine list on, the workload cannot be admitted again while it lasts.

Response ruleRuntime

An ordered rule that matches events and acts: notify, webhook, tag, suppress the log, quarantine or isolate.

Risk scoreVulnerabilities

A 0–100 score per finding from CVSS, EPSS, KEV and reachability, adjusted for asset criticality, policy violations and network exposure.

Runtime agentArchitecture

The DaemonSet on every node that collects process, file and network events, reports host facts and packages, and enforces when enabled.

Scan jobVulnerabilities

One queued scan of one target, claimed by a scanner worker. It can be paused, resumed, retried or cancelled.

Trust policyAdmission

Which signatures and attestations are required for images, and where the requirement applies.

WAF signatureRuntime

A pattern for an attack such as SQL injection, matched in pod traffic for opted-in workloads.

No matching term. Try a broader word.