Non-production only.
Use a lab or disposable cluster with representative workloads, CNI and kernel. Do not install it where you care about the outcome.
CONSTELLATION RESOURCES / STATUS
Early alpha. Here is exactly where it stands.
Constellation is in early alpha and not production-ready. APIs and data formats can change without notice, and there are no stability, security or support guarantees. It is published for evaluation and feedback. This page separates what a default install does from what is optional and what is not there yet.
Early alpha · Chart 0.2.0 · Reviewed 19 October 202601 / STATUS BOARD
Default, optional, not yet.#
“On by default” means present in the code and switched on by the Helm chart. It does not mean every CNI, kernel or cloud has been tested. Items not there yet are not current capabilities.
On by default 8
In a default Helm install
- InventoryDiscoverer, workload-to-image links, cluster dashboard
- Vulnerability scanningSyft, Trivy and Grype; images, workloads, nodes, platform; registry walker
- PrioritizationRisk score with CVSS, EPSS, KEV and exposure; KEV and EPSS feeds every 6 hours
- Admission webhookBlocks privileged, host-network and host-PID; fails open
- Runtime agentMonitor mode: eBPF process and file events, traffic inspection, alerts
- NetworkTraffic map, policy candidates, approve-apply-rollback lifecycle
- Compliance collectorLive-object checks every 6 hours, framework mappings, exemptions
- GovernanceRoles, OIDC/SAML/LDAP, expiring API tokens, hash-chained audit log
Optional 7
Shipped, off by default or needs setup
- Runtime enforcementProtect mode per workload; inline network, WAF and DLP blocking per labeled pod
- Database-backed admissionProfiles, Rego/CEL, scan-backed gates, quarantine list, admission audit
- CIS benchmark runnerskube-bench and docker-bench CronJobs; bring an image with the tool
- Audit archiverDaily signed archives to S3-compatible storage
- Offline scanningPre-loaded databases or internal mirrors; NVD importer
- High availabilityTopology spreading and disruption budgets; needs an HA database
- Policy CRDsReconciled only when the operator has a database connection
Not there yet 9
Not available today; no dates promised
- Shared sign-in with AstronomerThe Astronomer token mode needs JWKS-verified RS256/ES256 tokens; Astronomer sessions are HS256
- Scheduled compliance reportsSchedules can be defined; nothing in a shipped install runs them
- Console admission mode switchStored, but does not yet change the live webhook
- Built-in MFAUse your identity provider
- Self-service organizationsOne organization per deployment
- Kubernetes audit viewEvents can be ingested by API; no console view
- Forensic capture on quarantineNot wired
- Agent-only remote clustersRemote collectors need database access today
- arm64 and FIPS release imagesRelease images are linux/amd64; FIPS images not released
02 / KNOWN LIMITS
Plan around these.#
| Area | Limit |
|---|---|
| Admission | Fails open by default. Not scoped away from kube-system by default. Some built-in vulnerability profiles expect scan provenance the current scanner does not record; simulate before enforcing. |
| Runtime | eBPF events need kernel BTF. Out-of-baseline processes are killed just after they start. Process-kill response actions need an agent setting not yet in the chart. |
| Network | Inline blocking only on iptables-based CNIs, not Cilium eBPF mode. Isolation needs a CNI that enforces NetworkPolicy. Cloud CNIs are unit-tested only. Hubble flows on Cilium need manual setup. |
| WAF and DLP | Ten starter WAF signatures modeled on OWASP CRS, not the full rule set. Rule changes restart the data plane. |
| Scanning | Three engines are memory-heavy; the chart starts at one scan per replica. Go reachability analysis is experimental and off. Serverless is AWS Lambda only, pushed from the CLI. |
| Compliance | Framework coverage is partial and uneven. PDF rendering is not in the API image; print reports from the browser. |
| Platform | GKE Autopilot is not supported (privileged DaemonSets). The bundled database is a single instance. |
03 / EVALUATING SAFELY
Use a cluster you can lose.#
Constellation installs privileged components and a cluster-wide admission webhook. Treat an evaluation accordingly.
Exempt system namespaces.
Set a namespace selector for the platform namespaces that legitimately run privileged, or they will be rejected on their next update.
Start in monitor.
Leave runtime enforcement in monitor and network policies in Discover until you have read the alerts they would have produced.
FAQ
Maturity questions.#
Should we run production on Constellation today?
No. It is early alpha with no stability, security or support guarantees. Use it to evaluate and to tell us what matters to you. #
Will upgrades preserve our data?
Not guaranteed. APIs and data formats can change without notice during the alpha. Expect to reinstall. #
Is there a roadmap?
We do not publish dates. Ask us about the areas that matter to your evaluation and we will tell you plainly where they stand. #
NEXT STEP
Plan an evaluation with us.
Tell AlphaBravo what you run. We will help you choose a cluster, workloads and tests that answer your questions.