Release publication
Releases require builds, fresh vulnerability scans, SBOMs, signatures, clean Kubernetes installs, and signed upgrade, backup and restore checks.
ASTRONOMER RESOURCES / STATUS
What works today, stated plainly.
Astronomer is in alpha. This page separates what ships, what you have to turn on, and what has not been proven yet, so you can plan an evaluation around facts rather than promises.
Alpha · Reviewed against the current Astronomer source · Requirements vary by release01 / STATUS BOARD
Shipped, off by default, not yet proven.#
Available means implemented in the alpha product with automated tests. It does not mean every topology and failure mode has been accepted on production-like infrastructure.
Available 10
In the product today
- Cluster adoptionSigned, expiring registration, outbound agent, heartbeat, compatibility checks, decommission
- Cluster explorerBuilt-in and custom resources, dry-run, diff, server-side apply, logs, exec, workload and node actions
- GitOps deliveryImmutable sources and bundles, frozen placement, staged rollouts, local Flux reconciliation
- Apps catalog21 curated applications; first-party, community and your own sources
- Projects and RBACGlobal, project, cluster and namespace roles; effective-permission view; quotas
- IdentityLocal accounts, TOTP, API tokens, SCIM, group mappings
- Audit and SIEMFail-closed mutation audit, read audit, syslog, Splunk HEC and NDJSON forwarding
- Security postureTrivy image scans, CIS scans, Pod Security, Gatekeeper, network policy templates
- ObservabilityMonitoring stacks, shared Thanos, Alertmanager and Grafana, anomaly alerting, logging
- Disconnected installSigned release manifest, digest-pinned images, private-registry mirroring
Off by default 8
Shipped; you turn it on
- Browser shellEnabled in the Helm chart; read-only unless elevated
- Single sign-onRequires the bundled Dex tool, off by default
- Management CRDsCluster, Project and AgentProfile intent when CRDs are enabled
- Hosted LokiOptional fleet log store, gated by a capacity sizer
- ExtensionsSigned declarative extensions; off while the marketplace is incomplete
- Management-plane backupRuns once S3-compatible storage and credentials are configured
- Cluster backupInstall Velero from the catalog, then configure storage
- Delivery on evaluation installsStarts disabled until signed release artifacts are configured
Not yet proven 7
No claim made until evidence exists
- Shared sign-in with ConstellationConstellation’s Astronomer token mode needs JWKS-verified RS256/ES256 tokens; Astronomer sessions are HS256, so sign-in stays separate
- ScaleNo cluster-count or service-level claim until a release has a retained passing scale report
- Multi-host HA and DRLocal single-node acceptance has passed; multi-host HA and DR are not certified
- Cloud providersCloud-provider acceptance runs are deferred
- AccessibilityHuman keyboard-only and screen-reader acceptance is still pending
- Comparative usabilityThe benchmark against Rancher and its human study are deferred
- License qualificationDeferred; findings are retained in the release report and SBOMs
02 / KNOWN LIMITS
Where the edges are.#
These are current limits of the product. Some are deliberate boundaries; none comes with a promised date.
| Area | Limit |
|---|---|
| Provisioning | Astronomer does not create clusters, machines or node pools. This is by design. |
| Branch tracking | Targets release immutable versions; following a branch is intentionally excluded. |
| Management-plane outage | Released intent keeps reconciling; new intent, approvals and the central view wait for the management plane. |
| Log query | Loki, OpenSearch, Elasticsearch and Splunk are queryable; Datadog and CloudWatch are deep links; S3 and syslog are shipping-only. |
| API-server allowlist | Monitoring and enforcement are unavailable for self-managed providers; the console says so. |
| Bulk actions | Bulk delete is available; bulk scale and restart, and node changes, act on one object at a time. |
| Directory discovery | Pre-login principal discovery works with LDAP connectors only. |
| Audit transactions | Not every domain change writes its audit row in the same database transaction yet. |
| Image scanning | Vulnerability scanning only, not runtime protection; not shown for the management cluster. |
| Custom resources | Complex or non-structural CRDs may be easier to edit in YAML. |
| Upstream vulnerabilities | Some upstream image findings are carried with explicit, expiring, digest-specific waivers, disclosed with the release. |
03 / HOW IT IS TESTED
Evidence comes with a scope.#
Static gates cover Go builds and tests, frontend type checks, lint, unit tests and bundle budgets, Helm render tests and the API contract. Stateful lanes add PostgreSQL and worker integration, restart and outage recovery, tunnel HA, database failover and browser qualification.
A green static gate is not a measured scale result, and a local single-node pass is not proof of multi-host HA, production restore or accessibility. Those need separate, retained evidence, and the product makes no claim until it exists.
Supported versions
Kubernetes v1.33, v1.34 and v1.35; PostgreSQL 16 and 17; Chrome and Edge 130+, Firefox 128+, Safari 18+.
Data safety
Use non-production clusters, keep the encryption key with your database backups, and rehearse a restore before relying on it.
FAQ
Maturity questions.#
Should we run production clusters on Astronomer today?
We do not recommend it during alpha. Start with non-production clusters and the workflows that matter most to you. We will tell you plainly what has and has not been proven for your scenario. #
Will APIs change?
They can. Releases record intentional API changes in a compatibility review, and clients should be checked before upgrading. #
When will Astronomer leave alpha?
There is no date. The items under Not yet proven are what we need evidence for, and early access testing on real clusters is how that evidence gets built. #
NEXT STEP
Plan an evaluation with us.
We will help you pick the clusters, workflows and tests that answer your questions.