PSA templates
Create Pod Security Admission templates at the privileged, baseline or restricted level, with enforce, audit and warn modes, and assign them to clusters.
ASTRONOMER PRODUCT / SECURITY & POLICY
Posture you can see on every cluster.
Astronomer puts the security basics of a Kubernetes fleet in the same console as delivery and access: what is vulnerable, what fails a benchmark, what policy applies where, and how workloads are segmented. It also keeps its own management plane and agents to a short list of trusted paths.
Alpha · Image scanning on by default · findings support decisions, they do not replace them01 / IMAGE SCANNING
Vulnerabilities next to the workloads they affect.#
Adopted clusters receive the release-pinned Trivy Operator through Flux unless you opt out at registration. The operator scans workloads inside the cluster and writes vulnerability reports; the agent streams them to Astronomer, which shows severity counts and the most vulnerable images per cluster and rolls them up across the fleet.
- Scanning runs in the cluster, not from the management plane
- One concurrent scan job and a 24-hour report lifetime by default
- Opt out with a checkbox or the
astronomer.io/image-scanning: disabledannotation
This is image vulnerability scanning, not runtime protection. Scans need access to image registries and Trivy’s vulnerability databases. The management cluster does not show image scans today.
CLUSTER / IMAGE SCANSASTRONOMER
SECURITYASTRONOMER
02 / CIS SCANS
Benchmark the clusters you adopted.#
Start a CIS scan on a cluster and follow it through a durable scan lifecycle to its results. Profiles cover generic Kubernetes and distribution-specific benchmarks for RKE, RKE2, K3s, EKS, AKS and GKE.
The Security page brings CIS scans, Pod Security Admission templates and security policies together for the fleet.
03 / POLICY
Guardrails, assigned where they apply.#
Constraints
Ready policies for privileged containers, latest image tags and required labels, plus your own Gatekeeper templates and constraints.
Allowlist posture
Check API-server allowlists where the provider exposes them. For self-managed providers the console says the check is unavailable instead of inventing a result.
Kyverno is available from the apps catalog for teams that prefer it. For admission control, runtime and vulnerability management beyond this, see Astronomer + Constellation.
04 / NETWORK AND MESH
Segment by template. Know the mesh.#
Network policy templates apply a single, named NetworkPolicy to the namespaces you pick on each cluster. Built-in templates are read-only; clone one to customize it. A sweep every 30 minutes compares the live object and marks drift.
Deny all ingress
Block inbound traffic; layer explicit allow rules on top.
Project isolated
Allow ingress only from pods in the same Astronomer project.
Namespace only
Allow ingress only from pods in the same namespace.
Ingress controllers
Permit traffic only from ingress controllers; egress stays open.
Service mesh posture
Astronomer detects Istio, Linkerd, Kuma and Cilium. For Istio it shows posture, inventory, managed resource types and mutual TLS; for Linkerd, posture. It reports what the mesh is doing; it does not replace the mesh’s own configuration.
Registries
Manage image registry connections and pull secrets per cluster, for Docker Registry v2-compatible registries.
05 / SECRETS
Clear values stay out of the record.#
Credentials Astronomer holds are encrypted in PostgreSQL, hashed, or kept as external references. Clear values never enter task payloads, audit details, support bundles, metrics or API responses; responses show redacted views.
Connect HashiCorp Vault with token, AppRole or Kubernetes authentication, against KV v1 or v2, for externally managed secret material. The External Secrets Operator is available from the catalog.
Write-only source credentials
Delivery source credentials can be set and rotated, not read back.
Redacted support bundles
Support bundle export applies redaction controls before anything leaves.
Key custody is yours
The chart ships no key material. You generate the signing and encryption keys and keep them; losing the encryption key makes encrypted columns unreadable.
06 / THE CONTROL PLANE
Harden the thing that reaches every cluster.#
Narrow paths
The chart ships NetworkPolicy with explicit ingress and egress boundaries, TLS through Gateway API or Ingress, and non-root workloads with dropped capabilities and seccomp.
No tokens in URLs
Browser sessions use HttpOnly cookies with CSRF protection, and streaming connections use one-use tickets instead of tokens in query strings.
Signed and pinned
Release images are signed keyless with cosign, carry SPDX SBOMs and provenance, and are pinned by digest in a signed release manifest.
Be precise about assurance.
Release builds scan images and block on new high and critical findings. Some upstream findings are carried with explicit, expiring, digest-specific waivers that are disclosed with the release. No FedRAMP authorization, FIPS validation or third-party penetration test is claimed. Ask us for the threat model and current findings.
FAQ
Security questions.#
Can we use a different scanner?
Yes. Opt out of Trivy at registration or with the cluster annotation. Opting out after installation stops automatic installs but does not remove an installed scanner or its reports; remove it through its delivery workflow. #
Does Astronomer block workloads at admission?
Through the policy tools you assign from Astronomer: Pod Security Admission levels and Gatekeeper constraints. Kyverno is also available from the catalog. #
Where does Constellation fit?
Constellation is AlphaBravo’s Kubernetes security platform: Cloud-native security for Kubernetes: vulnerabilities, runtime, admission control and compliance evidence. It installs from Astronomer’s catalog. See the Astronomer + Constellation page for exactly what works today. #
NEXT STEP
Walk through the security model with us.
Bring your policies, scanners and network rules. We will show how Astronomer applies them across your clusters.