KubeTrust
Coming soon LicenceApache-2.0 SourceGitHub

Know your blast radius before an attacker does.

Kubernetes allows all pod-to-pod traffic by default, and workloads are often over-privileged. One compromised pod can reach much of the cluster. KubeTrust shows you how far, before it happens.

Become an early tester

What KubeTrust does

Select a workload and see its blast radius: what it can reach over the network, what its permissions let it do through RBAC, and which Secrets are exposed along the way.

KubeTrust combines what your configuration allows with what actually happens at runtime:

  • Network reachability

    Under Kubernetes NetworkPolicy, Cilium and Calico, including Ingress paths.

  • RBAC escalation paths

    And reachable Secrets, derived from RBAC rules and pod specs without reading Secret objects.

  • Runtime evidence

    From CoreDNS queries and a CNI-independent eBPF flow collector.

  • Allowed but never used

    Access that nothing exercises, which is where segmentation should start.

Built to run in your cluster

  • Read-only access to your cluster, with every permission published; the runtime agent uses only the minimum access it needs.
  • Runs fully inside your cluster; data never leaves your environment.
  • JSON export and a comparison of two runs, so you can see what a change actually opened.