Attestkeep
Sign up
Kubernetes admission control

Decide which images run in your cluster, and keep signed proof of every decision.

It runs inside the cluster it protects. Nothing about your images leaves it.

Create an account See the product
admission review from the API server Verdict cache by image digest your cluster pod api:1.4 admitted pod worker:latest denied: critical finding validating webhook
The webhook reads a cached verdict by digest. It never waits for a scan.
Where are you starting from

Three places teams start from.

No admission control yet Nothing checks an image before it runs.

One Helm release installs the operator, its console and its database into a namespace you own. Images are scanned with Trivy and their signatures checked with cosign, and admission refuses what your policy does not allow. Community Edition is free and does not expire.

Admission control
Passing an audit The auditor wants proof, not screenshots.

Pick a framework and a period. Attestkeep maps the cluster's own admission and scan records to that framework's clauses and signs the report inside the cluster. Your auditor checks the signature with their own tools, without asking us.

Evidence packages
Running at scale Rules that hold when many teams deploy.

Policy is a Kubernetes resource your Argo CD or Flux can own. Accepted risks carry a reason and an expiry, break-glass is recorded, and a new critical finding opens a ticket in GitHub, GitLab or Jira. Sign-in goes through the identity provider you already run.

The product
From image to evidence

One chain, inside your cluster.

  1. ScanTrivy, inside the cluster
  2. Verify the signaturecosign, key or keyless
  3. Decide at admissionyour policy, on the cached verdict
  4. Recordevery allow and deny, in the ledger
  5. Sign the reportwith the installation's key
  6. Verify anywhereby your auditor, without us
Product

Four parts, one Helm release.

Admission control

Scan, verify the signature, decide at the door. Admission reads a cached verdict, so it never waits for a scan.

Admission control

Evidence packages

A period report mapped to a framework, signed by your cluster, checkable by anyone.

Evidence packages

Runtime with Falco 1.2.0

Falco sees, Attestkeep decides. Your rules turn Falco events into records, tickets or a refusal at admission.

Runtime with Falco

Supply chain

Signatures, SBOMs, build provenance and producer statements, checked before an image runs.

Supply chain
Frameworks

13 frameworks. 293 clauses, each one cited.

All frameworks

Check it yourself

Nothing here asks you to take our word for it.

Verify a report without us Drop in the zip a report was delivered in. The chain is checked in your browser against a root key built into the page, and nothing is uploaded. Verify Our signing key is published One file on the documentation site. Every release image and every attestation we publish verifies against it with your own cosign. cosign.pub We publish the scan of our own image Severity counts and every finding in the release you are about to run, generated from the signed vulnerability attestation. Release scan The handbook, 50 pages What it installs, how it is run and what it costs, in one document. Every screenshot comes from a real installation. PDF
Next to what you already run

Three good tools, and the seam between them.

Each of these does one part of this well and is free. None of them carries a scanner, a signature verifier and the record of the decision in one place, which is the part an auditor asks about.

Kyverno A graduated CNCF policy engine for every resource in the cluster. It verifies image signatures; it has no scanner of its own and no period report. Side by side Trivy Operator The same scanner we run, as reports in the cluster. It finds what is wrong and writes it down; stopping the pod is somebody else's webhook. Side by side Sigstore policy-controller Signature and attestation verification at admission, from the project that defines the format. It answers who signed the image, not what is in it. Side by side

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account