Integrations · Deploy targets
A snapshot reporter shows what is running in every namespace. Admission control admits only images whose digest has an approved change.
Control levels
1Observe
We watch, record and flag.
A snapshot reporter in the cluster: every running image, by SHA-256 digest.
2GateRecommended
The tool waits for an approval.
Admission control with a Kyverno ImageValidatingPolicy or the Sigstore policy-controller.
3Hold
Only Aspian holds the credentials.
Optional: Aspian applies approved manifests with the only write credential.
Set it up
- 1Install the reporter with Helm.
- 2Add the Aspian admission policy in Audit, then Enforce.
- 3Allowlist third-party images, each with a stated reason.
Limits worth knowing
- Kyverno’s ClusterPolicy is removed in v1.20; use ImageValidatingPolicy.
More deploy targets
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.