Where to go from here
You’ve run the pilot and read your first finding. This is what to reach for next, and what the pilot deliberately leaves out.
Broaden coverage
Section titled “Broaden coverage”- Connect Kubernetes — Helm release drift on AKS / EKS / GKE. One kubeconfig integration is self-contained (no separate cross-check credential needed).
- Connect AWS (security groups) and GCP (firewall rules) — the same independent cross-check, other clouds.
- CI/CD gates — block drift pre-merge with a policy gate, and trigger a scan right after a deploy.
Tune the signal
Section titled “Tune the signal”- Why drift is scored, not just reported — the severity model that keeps the feed actionable.
- Route findings to a team — Slack or webhook, filtered by severity, category, and owner. See ownership routing and Settings → Notification rules.
- Silence known noise — ignore rules for a class of resource, maintenance windows for a planned change.
Act on findings
Section titled “Act on findings”- Bring an unmanaged resource under Terraform — generate the import block for something running in no state file.
- See who changed a resource — attribution from the cloud’s own activity log.
What this pilot does not include
Section titled “What this pilot does not include”- No SSO/SAML — email/password with role-based access control today.
- No billing — nothing to pay, nothing to configure.
- TLS is your call — the chart takes a TLS secret; it doesn’t provision certs. A stable hostname/TLS is the production installation path.
- Cloudkeel-DD never writes to your cloud — remediation is a PR you review and merge yourself. Read-only credentials are enough, everywhere.