Know what will change
A placement preview shows which clusters a target selects and which are excluded. The rollout is bound to that frozen result, so what you approved is what runs.
GitOps deliveryASTRONOMER / KUBERNETES FLEET OPERATIONS ALPHASELF-HOSTED
Your clusters. One control plane.
Astronomer is a self-hosted management plane for the Kubernetes clusters you already run. Adopt them without opening inbound access, deliver to them through Flux, and govern and operate all of them from one console.
Astronomer is in alpha and actively being built. We are looking for platform teams who want to evaluate it on non-production clusters. Screens are from an AlphaBravo test environment.
PLATFORM OVERVIEWASTRONOMER
How Astronomer fits together.
ADOPT / DELIVER / GOVERN / OPERATE01 / FLEET
Adopt what you run.
Register existing clusters. An outbound agent connects each one, and the inventory shows its health, version, agent and tools.
REGISTRATION · AGENT · EXPLORER02 / DELIVERYShip it the same way everywhere.
Immutable bundles, previewed placement and staged rollouts, reconciled by release-pinned Flux on every cluster.
SOURCES · BUNDLES · ROLLOUTS · CATALOG03 / GOVERNANCEDecide who can do what.
Projects, quotas, scoped RBAC, single sign-on and an audit log that records the material actions.
PROJECTS · RBAC · SSO · AUDIT04 / OPERATIONSSee it and recover it.
Metrics, alerting, logging, SIEM forwarding, cluster snapshots and management-plane backups with restore drills.
MONITORING · ALERTS · LOGS · BACKUPAstronomer starts where provisioning ends. Keep Terraform, Cluster API or your cloud console for creating clusters.See the architecture
THE DAY-2 WORKFLOW
Follow one cluster from adoption to evidence.#
Select a stage to see the screen and the specifics behind it. Limits and defaults are called out where they matter.
Adopt it
Register a cluster you already run. Astronomer generates an agent manifest; apply it and the agent connects outbound to the management plane. The cluster appears in the inventory with its distribution, version, health and labels.
- No inbound access to the managed cluster is required.
- Registration is signed and expiring, with progress, retry and cancel.
- Register from the console, the API, the astro CLI or an optional Cluster CRD.
Standardize it
Each adopted cluster gets the release-pinned Flux controllers, a small metrics baseline if you choose it, and Trivy image scanning unless you opt out. Everything else comes from a curated catalog you pick from.
- 21 curated applications, from cert-manager and Kyverno to Velero and CloudNativePG.
- Install forms surface the settings that matter, with full YAML values when you need them.
- Onboarding bundles capture tools, policy and project defaults to reuse.
Deliver to it
Publish an immutable bundle version from a Git, OCI or Helm source, preview exactly which clusters a target selects, then roll it out. Flux on each cluster reconciles what was released to it.
- All at once, rolling, canary and partitioned cohort strategies.
- Approval gates, maintenance windows, failure budgets and rollback to a recorded version.
- Clusters keep reconciling the last accepted version if the management plane is down.
Operate it
Browse live resources, scale and restart workloads, read logs and open a controlled shell from the same console, without handing out cluster-admin kubeconfigs.
- Built-in and custom resources, with dry-run, diff and server-side apply.
- A browser shell that is read-only unless elevation is requested and permitted. Off by default.
- Search Kubernetes resources across every connected cluster.
Govern it
Projects carve shared clusters into tenants with namespaces, quotas and policy. Roles are granted globally or on a project, cluster or namespace, and the console shows the effective permissions a person actually holds.
- Single sign-on through Dex: OIDC, Okta, Entra ID, GitHub, GitLab, Google, SAML and LDAP.
- SCIM users and groups, group mappings, TOTP and scoped API tokens.
- Permission-aware navigation: people see what they may use.
Prove it
Material reads, writes, secret access, shell sessions and delivery operations are recorded in the audit log. Forward events to your SIEM, apply compliance presets and keep restore drills on record.
- Mutation-intent audit fails closed.
- Syslog, Splunk HEC and NDJSON HTTPS forwarding.
- Compliance baselines are configuration presets, not certifications.
OUTBOUND BY DESIGN
Reach clusters without opening them up.#
The agent in each managed cluster dials out to the management plane. Kubernetes API proxying, log streaming, service proxying, health reports and delivery assignments all travel over that connection, so clusters behind NAT or in private networks can be managed without inbound firewall paths.
Requests are authorized against Astronomer RBAC, and changes are audited, before they reach the agent. People get short-lived, read-only proxy kubeconfigs routed through Astronomer, not long-lived cluster-admin credentials.
How adoption worksCLUSTER AGENTSASTRONOMER
DAY TO DAY
The work of running many clusters, in one place.#
Delivery, access, security and observability share one console, one permission model and one audit trail.
Survive a management outage
Flux runs locally on each cluster. If Astronomer is unavailable, clusters keep reconciling the last accepted version; new intent waits until it is back.
ArchitectureGive teams a bounded space
Projects bring namespaces, quotas, pod security and network policy posture, plus project-scoped catalogs and cloud credentials.
Governance & accessSee what is exposed
Trivy image scans, CIS scans, Pod Security templates, Gatekeeper constraints and network policy templates, surfaced per cluster and across the fleet.
Security & policyAlert on what is unusual
Threshold rules and anomaly rules that learn a rolling baseline, routed to Slack, email, PagerDuty, Microsoft Teams or a webhook.
Observability & recoverySame work, through code
A public OpenAPI contract with generated TypeScript and Go clients, the astro CLI and optional Kubernetes CRDs for Cluster, Project and AgentProfile intent.
InterfacesWORKS WITH CONSTELLATION
Astronomer runs the fleet. Constellation secures it.#
Constellation, AlphaBravo’s Kubernetes security platform, is one of the curated applications in Astronomer’s catalog. Install it on managed clusters like any other app, delivered through the same GitOps path. Astronomer’s install keeps Constellation’s admission policies and Astronomer’s platform tools working together. Both products are in alpha.
Astronomer + Constellation Visit the Constellation siteAPPS / CONSTELLATIONASTRONOMER
STRAIGHT ANSWERS
Questions evaluators ask first.#
Does Astronomer create clusters?
No. Astronomer adopts clusters that already exist. It does not provision clusters, machines, node pools or cloud infrastructure. Keep using Terraform, Cluster API, a cloud console, RKE2, k3s or whatever you use today. #
Do we need to open inbound ports to our clusters?
No. The agent connects outbound to the management plane. Managed clusters do not need a public API endpoint or an inbound firewall rule for Astronomer. #
Is this Rancher Fleet or Argo CD?
Neither. Astronomer has its own delivery model of sources, bundles, targets and rollouts. Release-pinned Flux source, Kustomize and Helm controllers on each cluster do the local reconciliation. There is no Fleet or Argo CD compatibility layer. #
Where does Astronomer run?
On a Kubernetes cluster you control, installed with a Helm chart. It stores its state in PostgreSQL and uses Redis-compatible queues. A disconnected install path mirrors the signed release into your own registry. #
How mature is it?
Astronomer is in alpha. Single-node acceptance has passed for the current release line; cloud-provider, production-scale and multi-host HA qualification have not. The status page lists what ships, what is off by default and what is not yet proven. #
NEXT STEP
See Astronomer with your environment in mind.
Tell AlphaBravo what you run today. We will show you the workflows that matter to your team.