Kubernetes security
Every cluster, explained.
One Helm install maps how your workloads really talk, who can do what, where an attacker could go next and how each cluster stands against an industry hardening benchmark, with runtime detection on every node.
A network map from real traffic
Built from eBPF flows over 24 hours, 7 or 30 days. Every connection is marked: allowed and used, allowed but unused, traffic with no policy, or traffic a policy denies.
Network policies, drafted and audited
orta drafts NetworkPolicies from observed traffic and audits them for would-be violations before you apply them yourself.
RBAC in plain English
Ask who can read secrets in production. The answer is computed from your real bindings, with a graph, a who-can matrix and effective permissions per subject.
Attack paths
Eight rules join privileged containers, exposed load balancers, runtime-socket mounts and cluster-admin service accounts into the paths that matter.
A risk score for every workload
0 to 100 from failing hardening checks and risk factors, with a toxic-combination flag when three critical factors meet.
SBOM and image vulnerabilities
Optional: a CycloneDX SBOM is built on the node for every running image and matched against a signature-verified vulnerability database. Images never leave the cluster.
Hardening checks, continuously
An industry-standard Kubernetes hardening benchmark, re-evaluated every few minutes as the cluster changes, with exemptions you can revoke.
Runtime detection on every node
The same kernel sensor and policies as on hosts, with alerts counted per node and workload.
Where an attacker goes next.
Findings that are minor alone join into paths: an exposed service, a pod running as the default service account, a token that reaches the API server. orta draws the path, so you fix the link that breaks it.
Works with what you run.
Installs with
- Kubernetes
- Helm
Alerts go to
- Slack
- Telegram
- Jira
- Signed webhooks