Your EKS clusters are discovered from the connected AWS account and read through their API, with no agent in the cluster.
The cluster is discovered during the AWS account inventory. By default, the CloudFormation template of the Ctadel role allows creating an access entry associated with the cluster admin policy. The recommended path is to disable that option and grant read access yourself with the ctadel-scanner role the application gives you (get and list only), on the cluster in “Configuration required” state.
Workloads, service accounts, RBAC, network policies, secrets and configmaps, nodes and images. Running images are analysed for vulnerabilities. The cluster enters the same graph as the cloud account hosting it: a privileged pod on a node reachable from the internet becomes a link of an attack path.
The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.