Skip to main content
logoTetrate Patch ServiceVersion: alpha

Keep Your Data Plane Patched and Provably Up to Date

Running Tetrate-distributed components means owning their patch posture: knowing what runs, what is vulnerable, and how fast fixes land. Tetrate Patch Service gives you an always-current inventory of the container images running in your clusters, their exposure to known Common Vulnerabilities and Exposures (CVE), and, for organizations on the managed data plane, a Git-based path that rolls fixes out to your clusters as reviewable pull requests.

How It Works​

The Patch Service answers three questions, in order:

  1. What is running? A lightweight agent in each of your clusters reports every container image actually running there. Every report is evidence from the cluster itself, not a record of what was supposed to be deployed.
  2. What is vulnerable? Tetrate scans every distinct observed image for known CVEs nightly and categorizes each finding against its release catalog, so every finding tells you who acts on it and which release fixes it.
  3. How does it get fixed? Customers on the managed data plane receive upgrades as pull requests to a private GitOps repository. Someone in your organization releases one with a comment, ArgoCD rolls the change out, and the agent's next report proves the new images are running.

Benefits​

  • Evidence, Not Assumption: Every number in the console comes from what agents observe running. An upgrade counts as done when the new images are seen in the cluster, not when it is merged.
  • Exposure You Can Act On: Findings are scoped to the images your clusters run right now, not a generic advisory feed, and each one carries a severity, a category, and an upgrade target where one exists.
  • Fail Visibly: Missing scan data shows as missing, never as clean. A quiet dashboard is one backed by a recent scan, not one hiding an outage.
  • Tetrate Owns Remediation: Patched releases ship from Tetrate and arrive as reviewable pull requests. Your part is visibility and approval, not building upgrade pipelines.
  • Nothing to Hand Over: The Patch Service stores no cluster credentials and no cloud secrets. Git is the only channel into managed clusters, and cloud discovery works through a role you can revoke at any time.

Key Features​

Fleet Visibility​

  • Cluster Inventory: Every connected cluster with its agent version, last report time, and open CVE counts.
  • Container Drill-Down: Every observed container with its namespace, workload, image, and version.
  • Version Badges: Each image marked as up to date, carrying open CVEs, or not yet scanned, with an orange marker naming the newer release when an upgrade is available.

CVE Intelligence​

  • Nightly Scans: Every distinct image observed across the fleet is scanned every night, and new images are scanned as soon as they first appear.
  • Categories That Assign Action: Findings are actionable (an upgrade fixes them), pending (the fix arrives in Tetrate's next release), or third party (informational).
  • Triage Order Built In: Findings arrive sorted by severity, then by how long they have gone unfixed, so the top of the list is where to start.
  • Freshness Warnings: The console warns when scan data is stale and never presents an unscanned image as clean.

Managed Upgrades​

  • Per-Customer GitOps Repository: Your data plane's desired state lives in a private repository that ArgoCD reconciles into your clusters.
  • One Pull Request per Layer: Upgrades arrive per environment, so staging before production is the natural motion.
  • Human in the Loop: The automation opens pull requests and never commits; nothing changes in a cluster until someone in your organization approves one.
  • Evidence-Based Completion: The rollout is confirmed by the agent observing the new images and the next scan resolving the old findings.

Fleet Onboarding​

  • The tetrate CLI: One command plans across every kubeconfig context and connects the clusters you pick.
  • Copy-Paste Setup: The console renders the same credentials and commands for machines where the CLI cannot run.
  • Names That Stay Unique: Every cluster carries its own identity, so names are settled for you and two clusters can never share one record.
  • Cloud Account Discovery: Connect an AWS account through a role you create, review every cluster it holds, and install across the fleet in one action.

Tetrate Patch Service turns patch posture from a spreadsheet exercise into a live, evidence-backed loop: observe, scan, upgrade, prove.