CONSTELLATION PRODUCT / PLATFORM
Constellation runs inside the Kubernetes clusters it protects. It finds what is running, scans it, checks it at admission, watches it at runtime, maps its traffic and keeps the evidence, in one console with one audit trail.
Early alpha · Not production-ready · Defaults noted per area01 / PRODUCT AREAS
Select an area to see the screen and the specifics. Each one has its own page with the limits spelled out.
The discoverer watches each cluster and records namespaces, workloads, images, nodes and platform facts. Workloads link to the images they run, so every finding has a place in the estate.
Images, running workloads, nodes, the Kubernetes platform, repositories and AWS Lambda functions are scanned with Syft, Trivy and Grype. Findings are ranked by a risk score built from CVSS, EPSS, KEV and exposure.
A validating webhook rejects privileged, host-network and host-PID workloads by default, with image-signature and read-only-root-filesystem rules in warn-only monitor mode. Simulate any manifest before you deploy it.
An agent on each node sees process execs and file access with eBPF, learns a baseline per workload, and inspects pod traffic for WAF and DLP matches. Response rules decide what happens next.
Observed connections become a traffic map and candidate network policies. Policies are approved, applied, demoted or rolled back, and rendered as native, Cilium or Calico policy.
Live-object checks every 6 hours, optional CIS benchmark runners, framework mappings, exemptions with a reason and expiry, and a hash-chained audit log you can verify.
Roles and scoped, expiring role bindings; local accounts, OIDC, SAML and LDAP; scoped API tokens; signed backups; receivers for chat, paging and ticketing with a delivery record.
02 / SAFE DEFAULTS
A default install sees and reports a lot and blocks very little. That is deliberate: you decide where enforcement starts.
03 / COVERAGE HEALTH
Security coverage only counts if the agents, scanners and webhooks behind it are healthy. System health shows build versions, restarts, version drift and stale or crashlooping components for the control plane and every connected cluster, and produces a redacted support bundle.
04 / GO DEEPER
Targets, engines, risk score, exceptions, CI and offline scanning.
VulnerabilitiesDefault rules, profiles, simulation, scan-backed gates and cosign verification.
Admission & supply chainThe agent, Learn/Monitor/Enforce, WAF and DLP, response rules and quarantine.
RuntimeThe traffic map, the approve-apply-rollback lifecycle and CNI support.
NetworkChecks, frameworks, exemptions, the audit chain, roles and SSO.
Compliance & governanceComponents, PostgreSQL, Helm and multi-cluster registration.
ArchitectureFAQ
No. You install it in your own Kubernetes cluster with its Helm chart. Its data stays in your PostgreSQL database. #
It runs open-source scanners for you, Syft, Trivy and Grype, and adds what sits around them: workload correlation, KEV and EPSS prioritization, exceptions with an audit trail, admission gates and a runtime view. #
Not yet. Constellation is in early alpha: interfaces and data formats can change without notice, and there are no stability, security or support guarantees. Use it in a lab and tell us what you find. #
NEXT STEP
Tell AlphaBravo what you run today. We will show you the workflows that matter to your team.