Attestkeep
Sign up
Admission control

Try a policy against your own history before you enforce it.

Create an account Try a policy before enforcing it
Recorded admissions allowed · api denied · worker allowed · web allowed · batch last 7, 30 or 90 days Draft policy not applied Replay same code as the webhook unchanged would be denied would be allowed nothing is written
No pod is affected, no scan is queued, no registry is contacted.
What it does

Policy what-if

Whether a policy would refuse anything depends on your images, your scan results and your triage decisions, not on the policy text. The what-if answers it from the cluster's own records.

A draft policy is decided again against the admission reviews already in the ledger, by the same code the webhook runs. The result is three figures, unchanged, would be denied and would be allowed, with the rule behind each difference and up to two hundred of the changed admissions.

How it works

Step by step.

  1. Edit the policy

    In the console's policy editor.

  2. Press What if

    Pick a period of 7, 30 or 90 days.

  3. The draft is replayed

    Against the recorded admission reviews.

  4. Read the difference

    Unchanged, would be denied, would be allowed.

  5. Apply it, or keep editing

    Nothing changed until you do.

What it records

Each replay is one audit log entry, “replayed a draft policy”; no pod, scan or registry is touched.

Try a policy before enforcing it

9 clauses across 4 frameworks cite at least one of these statements.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account