Attestkeep
Sign up
Admission control

Every pod is allowed or denied at the door, with a reason.

Create an account Admission
admission review from the API server Verdict cache by image digest your cluster pod api:1.4 admitted pod worker:latest denied: critical finding validating webhook
The webhook reads a cached verdict by digest. It never waits for a scan.
What it does

Admission decisions

Attestkeep registers a validating admission webhook. When the API server asks about a pod, the webhook reads the image's verdict from a cache keyed by digest and applies your policy, so it never waits for a scan and a slow registry never slows a deployment.

A digest it has never seen is Unknown, never Compliant. The default failure policy is Ignore, so deployments proceed if the operator is down; any installation, Community included, can set Fail and deny until scanned.

How it works

Step by step.

  1. The API server asks

    It sends the pod's admission review to the webhook.

  2. The tag becomes a digest

    Resolved once and cached for a minute, so a burst of identical deployments makes one registry call.

  3. The verdict is read

    By digest, from the cache the scanner keeps current.

  4. Policy decides

    Allow or deny, with the reason.

  5. The decision is recorded

    Allows as well as denials: evidence that lists only denials cannot show a control was operating.

What it records

Every decision lands in the admission ledger with the name and hash of the policy that decided it.

AdmissionPolicies

75 clauses across 11 frameworks cite at least one of these statements.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account