Ctadel

Connect a Kubernetes cluster

Ctadel needs read-only access to your cluster's API server. Coverage starts immediately once the connection is established: Kubernetes posture, image vulnerability correlation, network policy auditing.

Cloud-managed cluster (EKS / AKS / GKE / Kapsule)

If you connected the parent cloud account, the cluster is already discovered as a resource. To enable Kubernetes-level scanning, provide a read-only credential for the API server.

  1. Settings, Kubernetes, Connect cluster.
  2. Pick the cluster from the list (auto-discovered from your cloud connection).
  3. Pick the auth method offered by the wizard.
  4. Test, save.

Self-hosted cluster

For clusters you run yourself (kubeadm, k3s, on-prem):

  1. Settings, Kubernetes, Connect cluster, Self-hosted.
  2. Follow the wizard. It walks you through creating a read-only service account in the cluster and pasting the API server URL, CA certificate, and token in Ctadel.
  3. Test, save.

Network reachability

Ctadel reaches your cluster's API server from our European infrastructure. The API server must be reachable from a small set of static egress IPs (shown in the wizard).

If your API is private:

  • Whitelist Ctadel's egress IPs in your master-authorized-networks (or the equivalent per cloud).
  • Or use cloud-native peering when supported by your provider.

What gets scanned

CadenceWhat
RegularlyWorkloads, RBAC, network policies, service accounts
Less oftenCluster-level config (audit policy, admission webhooks)
On changeImage references, then triggers a vulnerability scan

What's next