Videos
Video tutorials
Each video shows one task, recorded on a real Attestkeep 1.4.0 installation.
All videos are on our YouTube channel, Attestkeep Kubernetes Security. Choose one to play it here, or open it on YouTube. The full reference is on docs.attestkeep.com.
Start here
Playlist on YouTubeWhat is Attestkeep? Container image security for Kubernetes
Watch on YouTubeInstall Attestkeep on Kubernetes with Helm | Attestkeep 1.4.0
Watch on YouTubeWhat Attestkeep installs, may do, and connects to | Attestkeep 1.4.0
Watch on YouTubeVerify the Attestkeep release with cosign | Attestkeep 1.4.0
Watch on YouTubeRun Attestkeep on your own PostgreSQL | Attestkeep 1.4.0
Watch on YouTubeUpgrade Attestkeep and roll back from backup | Attestkeep 1.4.0
Watch on YouTubeA tour of the Attestkeep security overview | Attestkeep 1.4.0
Watch on YouTubeRun Attestkeep in an air-gapped cluster | Attestkeep 1.4.0
Watch on YouTube
Admission and policies
Playlist on YouTubeSee what Kubernetes admission refused, and why | Attestkeep 1.4.0
Watch on YouTubeTest a Kubernetes image policy before enforcing it | Attestkeep 1.4.0
Watch on YouTubeVerify container image signatures with cosign | Attestkeep 1.4.0
Watch on YouTubeSLSA provenance, SBOM and attestations | Attestkeep 1.4.0
Watch on YouTubefailurePolicy and admission timing, explained | Attestkeep 1.4.0
Watch on YouTubeThe default Kubernetes image policy, line by line | Attestkeep 1.4.0
Watch on YouTubeA strict Kubernetes image policy for production | Attestkeep 1.4.0
Watch on YouTubeBlock end-of-life base images and exploited CVEs | Attestkeep 1.4.0
Watch on YouTubePin image signatures to your own cosign key | Attestkeep 1.4.0
Watch on YouTubeSLSA build provenance and trusted builders | Attestkeep 1.4.0
Watch on YouTubeVEX producer statements in admission decisions | Attestkeep 1.4.0
Watch on YouTubeStricter rules for privileged and exposed pods | Attestkeep 1.4.0
Watch on YouTubeBreak-glass: a time-boxed policy exception | Attestkeep 1.4.0
Watch on YouTubeDeny until scanned vs allow and scan | Attestkeep 1.4.0
Watch on YouTubeProve your admission controller is enforcing | Attestkeep 1.4.0
Watch on YouTube
Images and vulnerabilities
Playlist on YouTubeRead a container image scan report | Attestkeep 1.4.0
Watch on YouTubeTriage a CVE: accepted risk with reason and expiry | Attestkeep 1.4.0
Watch on YouTubeRescans, scan schedule and scan limits | Attestkeep 1.4.0
Watch on YouTubeImage states: compliant, blocked, unverified | Attestkeep 1.4.0
Watch on YouTube
Deny list
Playlist on YouTubeDeny list: block, take down and restore | Attestkeep 1.4.0
Watch on YouTubeDeny list entries: digest, CVE, package, binary | Attestkeep 1.4.0
Watch on YouTubeFind runtimes built from source: binary check | Attestkeep 1.4.0
Watch on YouTubeDeny list hits, events and notifications | Attestkeep 1.4.0
Watch on YouTubeDeny list roles: who can add, remove and take down | Attestkeep 1.4.0
Watch on YouTube
Runtime with Falco
Playlist on YouTubeAct on Falco runtime events in Kubernetes | Attestkeep 1.4.0
Watch on YouTubeConnect Falco to Attestkeep over mutual TLS | Attestkeep 1.4.0
Watch on YouTubeFalco runtime policies: record, notify, stop | Attestkeep 1.4.0
Watch on YouTubeStop a pod on a Falco event: rbac.allowEnforce | Attestkeep 1.4.0
Watch on YouTubeWrite and publish Falco rules: the rule editor | Attestkeep 1.4.0
Watch on YouTubeFalco events in Attestkeep: retention and metrics | Attestkeep 1.4.0
Watch on YouTube
Evidence and compliance
Playlist on YouTubeCompliance frameworks in Attestkeep | Attestkeep 1.4.0
Watch on YouTubeGenerate and sign an evidence package | Attestkeep 1.4.0
Watch on YouTubeFind who changed what in the audit log | Attestkeep 1.4.0
Watch on YouTubeRead an evidence package, clause by clause | Attestkeep 1.4.0
Watch on YouTubeLedger integrity and checking an evidence package | Attestkeep 1.4.0
Watch on YouTubeOrganisation profile in evidence packages | Attestkeep 1.4.0
Watch on YouTubeWhat Attestkeep evidence does not prove | Attestkeep 1.4.0
Watch on YouTube
Integrations and operations
Playlist on YouTubeSend Kubernetes security events to your SIEM | Attestkeep 1.4.0
Watch on YouTubeOpen GitHub issues for critical CVEs automatically | Attestkeep 1.4.0
Watch on YouTubeSend Kubernetes image security alerts to your team | Attestkeep 1.4.0
Watch on YouTubeBack up Attestkeep: database, keys, configuration | Attestkeep 1.4.0
Watch on YouTubeRun Attestkeep on call: probes, outages, alerts | Attestkeep 1.4.0
Watch on YouTubePrometheus metrics for admission control | Attestkeep 1.4.0
Watch on YouTube
Licensing and account
Playlist on YouTubeLicence activation and the daily check | Attestkeep 1.4.0
Watch on YouTubeCluster slots and the node ceiling | Attestkeep 1.4.0
Watch on YouTubeActivate Attestkeep offline with a certificate | Attestkeep 1.4.0
Watch on YouTubeWhat happens when an Attestkeep licence ends | Attestkeep 1.4.0
Watch on YouTubeImage allowance and the usage page | Attestkeep 1.4.0
Watch on YouTubeConsole users and roles | Attestkeep 1.4.0
Watch on YouTube
Plugin and CLI
Playlist on YouTubekubectl image-security: the Attestkeep plugin | Attestkeep 1.4.0
Watch on YouTubeScan and verify a container image from the CLI | Attestkeep 1.4.0
Watch on YouTubeImage reports and evidence as CSV from the CLI | Attestkeep 1.4.0
Watch on YouTube