Keep Your Data Plane Patched and Provably Up to Date

Running Tetrate-distributed components means owning their patch posture: knowing what runs, what is vulnerable, and how fast fixes land. Tetrate Patch Service gives you an always-current inventory of the container images running in your clusters, their exposure to known Common Vulnerabilities and Exposures (CVE), and, for organizations on the managed data plane, a Git-based path that rolls fixes out to your clusters as reviewable pull requests.

How It Works

The Patch Service answers three questions, in order:

1. What is running? A lightweight agent in each of your clusters reports the container images Tetrate publishes that are actually running there. It recognizes them against Tetrate's release catalog, so nothing needs labeling and your own applications are never reported. Every report is evidence from the cluster itself, not a record of what was supposed to be deployed.
2. What is vulnerable? Tetrate scans every distinct observed image for known CVEs nightly and categorizes each finding against its release catalog, so every finding tells you who acts on it and which release fixes it.
3. How does it get fixed? Customers on the managed data plane receive upgrades as pull requests to a private GitOps repository. Someone in your organization releases one with a comment, ArgoCD rolls the change out, and the agent's next report proves the new images are running.

Benefits

• Evidence, Not Assumption: Every number in the console comes from what agents observe running. An upgrade counts as done when the new images are seen in the cluster, not when it is merged.
• Exposure You Can Act On: Findings are scoped to the images your clusters run right now, not a generic advisory feed, and each one carries a severity, a category, and an upgrade target where one exists.
• Fail Visibly: Missing scan data shows as missing, never as clean. A quiet dashboard is one backed by a recent scan, not one hiding an outage.
• Tetrate Owns Remediation: Patched releases ship from Tetrate and arrive as reviewable pull requests. Your part is visibility and approval, not building upgrade pipelines.
• Nothing to Hand Over: The Patch Service stores no cluster credentials and no cloud secrets. Git is the only channel into managed clusters, and cloud discovery works through a role you can revoke at any time.

Key Features

Fleet Visibility

• Zero-Touch Discovery: The agent matches what your workloads run against the release catalog, so a connected cluster reports Tetrate's images with no labeling, and a product installed later is picked up on its own.
• Cluster Inventory: Every connected cluster with its agent version, last report time, and open CVE counts.
• Container Drill-Down: Every observed container with its namespace, workload, image, and version.
• Version and Status Badges: Each image marked as up to date, carrying open CVEs, or not yet scanned, alongside a status naming its open severities and the newer release to move to.
• Products per Cluster: On the managed data plane, each cluster line shows the products its agent found installed, so what is running managed is answered by observation rather than by an install record.

CVE Intelligence

• Nightly Scans: Every distinct image observed across the fleet is scanned every night, and new images are scanned as soon as they first appear.
• Categories That Assign Action: Findings are actionable (an upgrade fixes them), pending (the fix arrives in Tetrate's next release), or third party (informational).
• Triage Order Built In: Findings arrive sorted by severity, then by how long they have gone unfixed, so the top of the list is where to start.
• Freshness Warnings: The console warns when scan data is stale and never presents an unscanned image as clean.

Managed Upgrades

• Per-Customer GitOps Repository: Your data plane's desired state lives in a private repository that ArgoCD reconciles into your clusters.
• One Pull Request per Layer: Upgrades arrive per environment, so staging before production is the natural motion.
• Human in the Loop: The automation opens pull requests and never commits; nothing changes in a cluster until someone in your organization approves one.
• Upgrades in One Place: An Upgrades view lists every product with the clusters it reaches and the pull requests open against its defaults and each environment, each with the size of its version jump and where it stands with approval.
• Evidence-Based Completion: The rollout is confirmed by the agent observing the new images and the next scan resolving the old findings.

Fleet Onboarding

• The tetrate CLI: One command plans across every kubeconfig context and connects the clusters you pick.
• Copy-Paste Setup: The console renders the same credentials and commands for machines where the CLI cannot run.
• Names That Stay Unique: Every cluster carries its own identity, so names are settled for you and two clusters can never share one record.
• Cloud Account Discovery: Connect an AWS account through a role you create, review every cluster it holds, and install across the fleet in one action.

Tetrate Patch Service turns patch posture from a spreadsheet exercise into a live, evidence-backed loop: observe, scan, upgrade, prove.