Attestkeep
Language: English
Sign up
Kubernetes admission control

Decide which images run in your cluster, and keep signed proof of every decision.

It runs inside the cluster it protects. Nothing about your images leaves it.

Create an accountSee the product
admission review from the API serverVerdict cacheby image digestyour clusterpodapi:1.4admittedpodworker:latestdenied: critical findingvalidating webhook
The webhook reads a cached verdict by digest. It never waits for a scan.
Where are you starting from

Three places teams start from.

No admission control yetNothing checks an image before it runs.

One Helm release installs the operator, its console and its database into a namespace you own. Images are scanned with Trivy and their signatures checked with cosign, and admission refuses what your policy does not allow. Community Edition is free and does not expire.

Admission control
Passing an auditThe auditor wants proof, not screenshots.

Pick a framework and a period. Attestkeep maps the cluster's own admission and scan records to that framework's clauses and signs the report inside the cluster. Your auditor checks the signature with their own tools, without asking us.

Evidence packages
Running at scaleRules that hold when many teams deploy.

Policy is a Kubernetes resource your Argo CD or Flux can own. Accepted risks carry a reason and an expiry, break-glass is recorded, and a new critical finding opens a ticket in GitHub, GitLab or Jira. Sign-in goes through the identity provider you already run.

The product
From image to evidence

One chain, inside your cluster.

  1. ScanTrivy, inside the cluster
  2. Verify the signaturecosign, key or keyless
  3. Decide at admissionyour policy, on the cached verdict
  4. Recordevery allow and deny, in the ledger
  5. Sign the reportwith the installation's key
  6. Verify anywhereby your auditor, without us
Product

Five parts, one Helm release.

Admission control

Scan, verify the signature, decide at the door. Admission reads a cached verdict, so it never waits for a scan.

Admission control

Evidence packages

A period report mapped to a framework, signed by your cluster, checkable by anyone.

Evidence packages

Runtime with Falco

Falco sees, Attestkeep decides. Your policies turn Falco events into records, notifications, issues or a stopped pod.

Runtime with Falco

Supply chain

Signatures, SBOMs, build provenance and producer statements, checked before an image runs.

Supply chain

Operations

Notifications, issue tracker sync and air-gapped clusters: how Attestkeep fits the tools and networks you already run.

Operations
Frameworks

13 frameworks. 293 clauses, each one cited.

All frameworks

Check it yourself

Nothing here asks you to take our word for it.

Verify a report without usDrop in the zip a report was delivered in. The chain is checked in your browser against a root key built into the page, and nothing is uploaded.VerifyOur signing key is publishedOne file on the documentation site. Every release image and every attestation we publish verifies against it with your own cosign.cosign.pubEvery release image is signedBuilt for linux/amd64 and linux/arm64 and signed with cosign, with the scanner and the signature verifier pinned into the image rather than pulled at runtime.Release integrityThe handbook, 52 pagesWhat it installs, how it is run and what it costs, in one document. Every screenshot comes from a real installation.PDF
Next to what you already run

Three good tools, and the seam between them.

Each of these does one part of this well and is free. None of them carries a scanner, a signature verifier and the record of the decision in one place, which is the part an auditor asks about.

KyvernoA graduated CNCF policy engine for every resource in the cluster. It verifies image signatures; it has no scanner of its own and no period report.Side by sideTrivy OperatorThe same scanner we run, as reports in the cluster. It finds what is wrong and writes it down; stopping the pod is somebody else's webhook.Side by sideSigstore policy-controllerSignature and attestation verification at admission, from the project that defines the format. It answers who signed the image, not what is in it.Side by side

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licences page, and install with Helm.

Create an account