No machine drivers
No node-pool provisioning and no forced infrastructure workflow.
ASTRONOMER PRODUCT / PLATFORM
Day-2 operations for every cluster you run.
Astronomer is the operating layer after a cluster exists. Adopt it, standardize it, deliver to it, operate it and govern it from one console, one API and one audit trail, while each cluster keeps running on its own.
Alpha · Self-hosted · Defaults and limits listed with each feature01 / PRODUCT AREAS
Everything a fleet needs after day one.#
Select an area to see its screen and the specifics. Fleet, delivery, governance, security and operations each have their own page.
Fleet inventory
Every adopted cluster in one list, with its connection state, distribution, Kubernetes version, environment, region, provider, labels and projects. Cluster groups organize the fleet by whatever matters to you.
- Registration, heartbeat, compatibility checks and decommission are tracked as a lifecycle.
- Agent health, version and diagnostics for every cluster.
- Onboarding bundles reuse tools, policy and project defaults.
Cluster explorer
Browse live built-in and custom resources on any cluster: namespaces, nodes, workloads, services, ingresses, Gateway API resources, storage, RBAC objects, network policies, quotas, CRDs and more.
- Guided create and edit forms for common resources, YAML for everything else.
- Strict dry-run, diff and server-side apply; conflict takeover is explicit and audited.
- Scale, restart, delete, logs, exec, cordon, drain and taints, within your permissions.
GitOps delivery
Project-scoped sources, immutable bundle versions, targets that select clusters by label or group, and rollouts with approvals, maintenance windows and failure budgets. Flux reconciles locally on each cluster.
- Git, OCI artifact, Helm HTTP and Helm OCI sources pinned to an immutable identity.
- Drift, orphaned and stale status normalized from local Flux conditions.
- Branch tracking is intentionally not supported.
Apps catalog
Install Helm charts on a cluster from curated, Astronomer first-party, community and operator-added sources. Installs go through the same delivery path, so Flux owns their lifecycle.
- 21 curated applications with schema-guided install and upgrade forms.
- An immutable values review before anything is applied.
- An air-gap export and import workflow for the application catalog.
Governance
Projects, quotas, global, project, cluster and namespace roles, single sign-on through Dex, SCIM provisioning, TOTP and scoped API tokens. Permissions shape what the console shows.
- An effective-permission view explains where each grant comes from.
- Compliance presets for PCI DSS 4.0, HIPAA, FedRAMP Moderate and SOC 2 settings.
- Presets configure Astronomer; they do not certify anything.
Security posture
Image vulnerability scans from the in-cluster Trivy Operator, CIS scans, Pod Security Admission templates, Gatekeeper constraints, network policy templates, registry and service-mesh posture.
- Trivy is installed automatically on adopted clusters unless you opt out.
- Vault connections for externally managed secret material.
- Findings support decisions; they do not replace risk acceptance.
Observability
Per-cluster monitoring stacks, shared Thanos, Alertmanager and Grafana, alert rules with anomaly detection, log pipelines and destinations, SIEM forwarders and outbound webhooks.
- Loki, OpenSearch, Elasticsearch and Splunk logs can be queried from Astronomer.
- Datadog and CloudWatch are deep links; S3 and syslog are shipping-only.
- Slack, email, PagerDuty, Microsoft Teams and webhook channels.
Backup & recovery
Velero-backed cluster snapshots and schedules on member clusters, and management-plane backups to S3-compatible storage with a recorded restore drill.
- S3, MinIO-compatible, GCS and Azure Blob backup storage for Velero.
- Management backups default off; turn them on and prove a restore.
- Runbooks for PostgreSQL failover, restore and key recovery.
02 / DURABLE OPERATIONS
Changes are records, not side effects.#
Astronomer keeps its intent and history in PostgreSQL: users, roles, audit history, projects, inventory, encrypted credentials and operation records. Work that has been committed but not yet picked up by a worker sits in a durable outbox, so a restart does not lose it.
Operators can see queues, dead letters and the outbox from the console, and long-running actions return a receipt you can follow.
- High-risk operations are permission-gated and audited
- Every mounted API route is described in the published OpenAPI contract
- The CLI uses the same API as the console
03 / PRODUCT BOUNDARY
What Astronomer deliberately does not do.#
Astronomer is not a cluster provisioning product. It does not create clusters, machines or node pools, and it does not drive cloud infrastructure. Use Terraform, Cluster API, a cloud service or your own automation for that, then adopt the result.
It also does not install or emulate Rancher Fleet or Argo CD. Delivery uses Astronomer’s own model on top of local Flux controllers.
No inbound path
Managed clusters are reached through an outbound agent connection.
No hidden state
PostgreSQL holds product intent and history; each cluster’s Kubernetes API holds its live objects.
04 / GO DEEPER
Pick the part you need to trust.#
Adopt and reach clusters
Registration, the outbound agent, the explorer, the shell and kubeconfigs.
Fleet & adoptionShip through Flux
Sources, bundles, placement previews, rollout strategies and the apps catalog.
GitOps deliveryControl and record access
Projects, RBAC, single sign-on, audit, read audit and compliance presets.
Governance & accessKnow the posture
Image and CIS scans, Pod Security, Gatekeeper, network policy and secrets.
Security & policyWatch and recover
Metrics, alerts, logs, SIEM forwarding, snapshots and management-plane backup.
Observability & recoveryKnow what owns what
Management plane, PostgreSQL, the agent and Flux on each cluster.
Architecture05 / FAQ
A few useful distinctions.#
Can we bring our own ingress, logging or scanner?
Yes. The automatic baseline is small: Flux controllers, optional metrics exporters and Trivy image scanning, which you can opt out of. Everything else is a choice from the catalog or your own delivery bundles. #
What Kubernetes versions are supported?
The current release line supports Kubernetes v1.33, v1.34 and v1.35, latest patch of each. Agents must fall inside a declared compatibility window, and an unknown future agent version is rejected before it is authenticated. #
Is there an extension model?
There is a signed, declarative extension model with governed mounts and a constrained data proxy. It is off by default while the marketplace is incomplete, and arbitrary backend plugins are not supported. #
Is Astronomer open source?
Astronomer is licensed under the GNU Affero General Public License v3.0 or later. Ask AlphaBravo about access to source and release artifacts during alpha. #
NEXT STEP
See Astronomer with your environment in mind.
Tell AlphaBravo what you run today. We will show you the workflows that matter to your team.