Runtime with Falco
Falco watches what containers do after they start. Attestkeep receives its events over mutual TLS, stores each one against the image and pod that raised it, and checks it against the runtime policies you write in the console. Falco is optional: you install and configure it, and Attestkeep does not ship it or write to it.
The first policy that matches decides: keep a record, send a notification, open an issue in your tracker, or stop the pod. A stop is an eviction through the API server, so PodDisruptionBudgets apply, and the pod's controller starts a new one. A runtime event never changes an admission decision.
Step by step.
Falco reports an event
Directly or through Falcosidekick, with mutual TLS.
A policy matches it
On rule, tags, priority, namespace and image.
An action is taken
Record, notify, open an issue or stop the pod.
A stop evicts the pod
At once or after its shutdown time; its controller starts a new one.
Every stop is audited
Under the policy's name, with the pod and the Falco rule.
The policy set and its hash, policy changes, event counts, alerts sent, issues opened and closed, and the pods stopped go into the package's runtime section.
1 clause in 1 framework cites what this feature records.
Install it yourself.
Create an account, confirm your e-mail with the code we send, take the free Community key from the Licences page, and install with Helm.
Create an account