Attestkeep
Language: English
Sign up
Admission control

Every pod is allowed or denied at the door, with a reason.

Create an accountAdmission
admission review from the API serverVerdict cacheby image digestyour clusterpodapi:1.4admittedpodworker:latestdenied: critical findingvalidating webhook
The webhook reads a cached verdict by digest. It never waits for a scan.
What it does

Admission decisions

Attestkeep registers a validating admission webhook. When the API server asks about a pod, the webhook reads the image's verdict from a cache keyed by digest and applies your policy, so it never waits for a scan and a slow registry never slows a deployment.

A digest it has never seen is Unknown, never Compliant. The default failure policy is Ignore, so deployments proceed if the operator is down; any installation, Community included, can set Fail and deny until scanned.

How it works

Step by step.

  1. The API server asks

    It sends the pod's admission review to the webhook.

  2. The tag becomes a digest

    Resolved once and cached for a minute, so a burst of identical deployments makes one registry call.

  3. The verdict is read

    By digest, from the cache the scanner keeps current.

  4. Policy decides

    Allow or deny, with the reason.

  5. The decision is recorded

    Allows as well as denials: evidence that lists only denials cannot show a control was operating.

What it records

Every decision lands in the admission ledger with the name and hash of the policy that decided it.

AdmissionPolicies

75 clauses across 11 frameworks cite what this feature records.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licences page, and install with Helm.

Create an account