Environments
Standard Kubernetes environments built from versioned blueprints and continuously verified for compliance.
| Environment | Pipeline Stage | Compliance & Health | Time to Ready |
|---|
Rollouts
Safely move environments to a new blueprint version with preview gates, canary phases, automated batching, and instant rollback.
Roll out a blueprint version
Pinned blueprint versions
Active environment registryRollout history
Past rollouts, preview audits, and automated rollbacksPreview runs evaluate policy changes without altering cloud state. Live rollouts target the designated canary first, verify compliance, then advance in canary batches. Pins are committed only after cluster verification passes.
Activity & Audit Log
Real-time queue execution, worker operations, and complete audit history of all environment lifecycle changes.
Worker job queue
Asynchronous pipeline and scan workersSecurity audit log
Immutable record of administrative actionsHow It Works
From self-service requests to continuously verified Kubernetes namespaces and automated version upgrades.
Continuous Compliance Matrix
Baseline Controls (14)
Determines formal compliance: Default-deny network policies, no open cluster-admin bindings, quota constraints, resource limits, ownership tags, S3 public block, S3 versioning/encryption, SQS KMS, CloudWatch log retention, and scoped IAM roles.
Workload Security
Detects privileged containers, host access escapes, root user execution, dangerous Linux capabilities, unpinned mutable image tags, plaintext secrets in specs, missing liveness/readiness probes, and unbounded resource requests.
Exposure & Access
Flags NodePort/LoadBalancer exposure, unencrypted ingress, permissive network policies, wildcard IAM permissions, unauthorised secret read permissions, and manual cluster-admin bindings.
Drift & Runtime Faults
Surfaces out-of-band policy mutations, broken IRSA bindings, pod CrashLoopBackOffs, pending workloads, replica starvation, namespace quota saturation, and Kubernetes warning events.
AWS Configuration
Deep inspection of S3 bucket policies, SQS dead-letter queues, automated Secrets Manager rotation, least-privilege IAM trust policies, cross-account boundaries, and wildcard actions.