Praxis datasheet
What Praxis is made of, what it needs from your environment and what it never does. The step-by-step installation guide, release downloads and your licence are in the customer portal.
The facts your platform and security teams will ask for
| Category | Policy prioritization on top of your CNAPP: one ranked, explainable list of the controls to switch on first |
|---|---|
| Deployment | On your own infrastructure: a collector per Kubernetes cluster (Helm chart) and, for Enterprise, one server for the fleet (Helm chart) |
| Collector permissions | Read-only ClusterRole: get, list and watch only, no write verbs, no access to Secrets |
| Schedule | Kubernetes CronJob, hourly by default (configurable); a failed report fails the Job, so it shows up |
| Collector footprint | Requests 100m CPU / 128 Mi memory, limits 500m CPU / 512 Mi memory |
| Image platform | linux/amd64 |
| Scoring | Deterministic and documented: the same input always gives the same ranking, with the reasons for every score |
| Policy changes | None. Praxis generates policy files for your team to review; it has no permission to apply them |
| Data flow | Findings stay inside your environment: collectors report to your own Praxis server. No telemetry, no licence call-home |
| Disconnected networks | Supported: a signed offline bundle with images, Helm charts, SBOM and checksums |
| Compliance mapping | PCI-DSS v4.0 and ISO/IEC 27001:2022 requirements; BDDK and KVKK article references |
| Optional AI rationale | A local model, your own endpoint, or none. It explains a score; it can never change one |
Three pieces, all running where you run them
Collector
Runs in each cluster on a schedule. Reads Kubernetes topology, RBAC and workload security settings, plus your CNAPP's view where one is connected, maps it onto the canonical control model and scores it.
Enterprise server
Runs once, in a cluster you choose. Fleet view across clusters, users with roles, per-cluster scope and MFA, run history and drift, evidence reports (PDF, HTML, CSV, JSON), signed audit packages, a tamper-evident audit log and SIEM export (syslog, JSON webhook).
Offline bundle
How every release is delivered: container images, Helm charts, an SPDX SBOM and SHA-256 checksums signed with our release key. You verify it before anything is loaded.
Sources Praxis reads today
| Aqua SecurityREST API | Validated |
| AccuKnox / KubeArmorKubernetes-native policy objects | Validated |
| Prisma CloudREST API | Connector ready |
| Kubernetes itselfTopology, RBAC, workload security settings | Validated |
What your environment needs
| Kubernetes access | kubectl (or oc on OpenShift) with rights to install a Helm release and create a namespace |
|---|---|
| Helm | Helm 3; 3.14 or newer for upgrades (--reset-then-reuse-values) |
| Container registry | An internal registry the clusters can pull from; images are loaded from the bundle with docker or podman |
| Nodes | amd64 nodes for the Praxis pods |
| Enterprise server | One persistent volume (single replica; there is no high availability) and TLS terminated at your ingress or route |
| Verification | OpenSSL 3 to check the bundle's signature (SHA-256 tools for the checksums) |
Installation guide, releases and your licence
Licensed customers sign in with the email address registered on their licence. We send a one-time code; there is no password to manage.
- Step-by-step installation and upgrade guide
- Signed release bundles, with their SHA-256
- Your licence file, its expiry and what it covers
- Every download is recorded for your audit trail
See your own clusters ranked
Bring one cluster. We run the read-only collector with you and walk through the list it produces.