Your GKE clusters are discovered from the connected Google Cloud project and read through their API, with no agent in the cluster.
The cluster is discovered during the project inventory. Ctadel obtains the cluster address and certificate through the GKE API and authenticates with a token of the connected service account. A kubeconfig provided in the application takes precedence.
Workloads, service accounts, RBAC, network policies, secrets and configmaps, nodes and images. Running images are analysed for vulnerabilities. The cluster enters the same graph as the cloud account hosting it: a privileged pod on a node reachable from the internet becomes a link of an attack path.
The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.