Your MKS clusters are discovered from the connected OVHcloud project and read through their API, with no agent in the cluster.
The cluster is discovered during the project inventory. Ctadel requests the kubeconfig from the OVHcloud API: one of the few write routes allowed to the consumer key. A kubeconfig provided in the application takes precedence.
Workloads, service accounts, RBAC, network policies, secrets and configmaps, nodes and images. Running images are analysed for vulnerabilities. The cluster enters the same graph as the cloud account hosting it: a privileged pod on a node reachable from the internet becomes a link of an attack path.
The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.