Portiger Kapan
TR
Self-hosted · No telemetry

Every container is cleared before it lands.

Portiger Kapan is a Kubernetes operator that scans image vulnerabilities, verifies signatures, decides what admission accepts, and keeps the record an auditor asks for. All of it runs inside your cluster. Nothing about your images, your workloads or your infrastructure ever leaves it.

Start 30-day trial Install in 3 commands
Kubernetes 1.27+ amd64 · arm64 Community edition free forever
Nothing about your images leaves One daily licence check carrying three values. No image names, no findings, no topology.
Your database, your disk Findings, verdicts and evidence live in a PostgreSQL you control.
Your registry, your mirror Scanner and signer are pinned into the image. Mirror the vulnerability database once.
Signed, multi-arch releases linux/amd64 and linux/arm64, each signed with cosign and verifiable by you.
The argument

A security console should not be the thing that leaks.

Most image-security products are hosted somewhere else. To work, they need a list of every image you run, which registries you pull from, and often a read path into the cluster itself. That inventory is a map of your estate, and it now lives on somebody else's infrastructure, under somebody else's breach notification duty.

Kapan is installed into a namespace you own, and it stays there.

The operator, its API, its console and its database go in with one Helm release. There is no agent to register and no account to create in your cluster; the one route out is the daily licence check, and it carries three values that say nothing about what you run. When the licence expires the installation falls back to the free edition rather than switching your admission control off.

Admission path

Admission reads a verdict. It never waits for a scan.

A webhook that scans inline is a webhook that eventually times out and takes deployments with it. Kapan decides from a cache that a separate scanner keeps warm, so an admission review is a database read and a policy evaluation, not a network call to a registry.

  1. 01

    A pod is created

    The API server calls the validating webhook with the pod's images.

  2. 02

    The verdict is looked up

    By digest, from the cache. A digest never seen before is Unknown, never Compliant.

  3. 03

    Policy decides

    Severity thresholds, tag rules, registry allow-lists, signature requirements, workload hardening.

  4. 04

    The scan is queued

    The scanner pulls the job, runs Trivy and cosign, and writes the verdict back for next time.

The default failure policy is Ignore. If the operator is down, deployments proceed unguarded rather than stopping. A licensed installation can set Fail and deny until scanned.

Capabilities

What it does on the day you install it.

Vulnerability scanning

Trivy, pinned into the image. Findings by severity, with the fixed version where one exists.

Signature verification

cosign verification, by key or keyless, plus in-toto attestations with a maximum age.

Triage with an expiry

Accept a risk with a reason and a deadline. Break-glass when a deployment cannot wait. Both are recorded.

Notifications

Slack, Teams, e-mail and a generic webhook for everything else. They name the cluster, never its topology.

Evidence packages

A period report mapped to the control set you select, stating what it cannot prove as clearly as what it can.

Private registries and mirrors

Pull from your own registry, mirror the vulnerability database into it. The documented default, not a workaround.

Audit log

Policy changes, admission overrides, triage decisions, evidence exports and access events in one record, kept for a retention you set.

Single sign-on and roles

Google, GitHub, GitLab, Okta, Microsoft Entra ID, Keycloak or plain OIDC, tested before you save. Roles decide who may change a policy.

Policy is a resource

Fifteen hardening controls, severity thresholds, tag and registry rules. The form and the manifest are one object, and the editor knows when Argo CD or Flux owns it.

The console

The console is part of the release, not a second product.

The same Helm release that installs the operator installs the console it serves. There is no separate deployment, no tenant to attach somewhere else and no second bill. You sign in at an address your own cluster exposes, and every screen reads the database sitting next to it.

Operators sign in through the identity provider you already run, so an account here is never a second place to remember to revoke access. Roles decide who may change a policy, accept a risk or generate evidence, and each of those actions lands in the audit log with a name against it.

English and Turkish, light and dark, and a help panel on every screen written in both. Verdicts appear as they are decided; nothing waits for a page refresh.

Security overview

Image posture, admission decisions and operator health, with the severity trend for the period.

Images

Every image admission has seen in this cluster, and the scan report behind each one.

Vulnerabilities

Findings across every image, grouped by CVE, with triage that carries a reason and an expiry date.

Policies

The rules admission applies. Edit the form or edit the manifest — they are the same resource.

Compliance evidence

One consolidated document per audit period: generated, printed, downloaded, and marked delivered.

Audit log

Policy changes, overrides, triage, evidence exports and access, searchable by actor, policy, image or CVE.

Usage and licence

Distinct image names counted this period, the edition that sets the limit, and six periods of history.

Users and sign-on

Accounts, roles and identity providers, with a connection test that reports the address it actually contacted.

Settings

Notification channels, SMTP, per-role e-mail preferences, appearance, and what this installation scans with.

Regulation (EU) 2024/2847 · NIS2

An evidence package that admits what it cannot prove.

Kapan generates a period report mapped to the control set you select. Every control lands in one of four states, and the honest two are not hidden: a control that was only partly operating says partial, and one with no supporting record says gap. If the webhook was down for forty minutes on a Tuesday, that window is in the document.

met partial gap outside_scope

The package is JSON, and the console renders it for printing. It is evidence produced from your own records. It is not a certification and no auditor is obliged to accept it.

evidence · report identity
{
  "report_id": "PS-EU-PRODEU-20260801-20260831-7A3F91",
  "framework": "eu-cra",
  "cluster":   "production-eu",
  "period": { "from": "2026-08-01", "to": "2026-08-31" },
  "availability": {
    "continuous": false,
    "outages": [
      { "from": "2026-08-12T09:14:02Z",
        "to":   "2026-08-12T09:54:40Z",
        "detail": "controller heartbeat gap" }
    ]
  }
}
SOC 2

Trust Services Criteria

13 criteria a container image control actually speaks to, each cited rather than paraphrased.

EU CRA · NIS2

Regulation (EU) 2024/2847 & Article 21(2)

34 requirements across two instruments that bind different subjects: the manufacturer and the entity.

DORA

Regulation (EU) 2022/2554

22 requirements for the financial sector's digital operational resilience.

Three instruments today, and the mapping ships inside the operator rather than being fetched. ISO 27001 is not among them yet. When it is, it will be a table like the others, written by someone who knows the standard.

Quick start

Three commands, and the schema builds itself.

The chart brings its own PostgreSQL, or takes a DSN to one you already run. Either way the operator creates and migrates its tables on first start, so there is no SQL for you to run and no migration step to forget on upgrade.

shell · any conformant Kubernetes 1.27+
# 1 — add the chart
helm repo add portiger https://charts.portiger.com
helm repo update

# 2 — install into a namespace you own
helm install kapan portiger/portiger-kapan \
  --namespace portiger-kapan --create-namespace \
  --set clusterName=production-eu --wait

# 3 — open the console
kubectl -n portiger-kapan port-forward svc/kapan 8080:8080
Pricing · billed annually

Every security feature is in the free edition.

Scanning, signature verification, admission enforcement and evidence packages are not held back. What a key buys is scale: more clusters, more frameworks, a larger image allowance, and the two capabilities a regulated estate needs.

Community $0forever
  • 1 cluster · 1 framework
  • 15 image names per month
  • All scanning and admission features
Team $4,800per year
  • 50 image names per month
  • Single sign-on (OIDC)
  • Strict admission — deny until scanned
most chosen Business $14,400per year
  • 3 clusters · 3 frameworks
  • 200 image names per month
  • Priority e-mail support
Enterprise $30,000per year, from
  • Unlimited clusters and frameworks
  • Support terms set in the agreement
  • Onboarding help from the people who build it
See the full comparison 30-day trial of the full Enterprise feature set. Cancel before day 31 and nothing is billed.
Straight answers

Including the ones that are not flattering.

Does Kapan send anything to Portiger?

Three values, once a day, for licensing: the licence identifier, a fingerprint of the cluster, and the operator version. No image names, no findings, no workload names, no cluster topology, nothing from your database. The image and framework limits your plan sets are counted inside your own cluster, so those counts never leave it.

What happens when the licence expires?

The installation falls back to Community Edition. It does not stop, it does not lock you out, and it does not start denying deployments. Scanning and admission carry on under the free limits. A security control that switches itself off over a billing date is a worse outcome than an unpaid invoice.

Can one console show all my clusters at once?

Not in this release. Each cluster runs its own operator with its own database and its own console. They are independent by design, which is why nothing has to cross a cluster boundary. A fleet view is on the roadmap. No date on it yet.

Can one key run on more than one cluster?

Up to the number your plan pays for. That is what the cluster count on the price list means. Every activation spends a slot, your account shows which clusters hold them and how many are free, and beyond that number an activation is refused rather than quietly allowed. How licensing works has the rest.

Do I have to run a database for it?

The Helm chart brings its own PostgreSQL, or takes a DSN to one you already run. Either way the operator creates and migrates its own tables on first start, so there is no SQL for you to run and no migration step to forget on upgrade.

Where do I report a bug?

In the public issue tracker at github.com/portiger/kapan-k8s. Reports are handled there in the open, and fixed security issues are published as advisories on the same repository.

All questions

Install it into a namespace you own.

Community Edition is free and unlimited in time. The trial adds the Enterprise feature set for 30 days, and falls back rather than shutting anything off.

Start 30-day trial Read the documentation

No account is created in your cluster. No agent registers with us.

dev