Attestkeep
Sign up
Admission control

Every image is scanned inside your cluster, and scanned again every day.

Create an account What runs in your cluster
your cluster Image sha256:… Trivy pinned in the release Findings critical high medium low verdict cached by digest rescanned daily · database refreshed every 6 hours
Scanning happens inside your cluster. Admission only reads the result.
What it does

Image scanning

The scanner runs Trivy, pinned into the Attestkeep release, so nothing about your images is sent anywhere to be scanned. Images in private registries are pulled with the workload's own image pull secrets.

The vulnerability database refreshes every six hours and every image is rescanned daily, so an image admitted weeks ago is judged again when a new CVE is published. Findings carry the fixed version where one exists and are matched against CISA's catalogue of known exploited vulnerabilities.

How it works

Step by step.

  1. A new digest is queued

    Admission never waits for it.

  2. Trivy scans it

    Inside the cluster, pulling with the workload's own credentials.

  3. Findings are stored

    By severity, with the fixed version where one exists.

  4. The verdict is cached

    Admission reads it by digest.

  5. Everything is rescanned daily

    And the database is refreshed every six hours.

What it records

Each image's scan record and severity counts go into the evidence package's coverage and findings sections.

What runs in your clusterAir-gapped installs

67 clauses across 11 frameworks cite at least one of these statements.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account