driftdetective/d-detective repository overview

⁠Cloudkeel-DD Helm chart

Self-hosted configuration-drift detection for Terraform and Kubernetes teams. Cloudkeel-DD re-checks your Terraform-declared state against what is actually running, on a schedule you set, and surfaces drift, unmanaged resources and policy violations. It runs in your own cluster, under your own credentials.

This is the product chart. The chart is named d-detective (the original identifier, kept so existing installs keep their resources and volumes); the product is Cloudkeel-DD.

• Chart: oci://registry-1.docker.io/driftdetective/d-detective
• Current version: 0.3.7 (appVersion 0.3.7)
• Images it deploys: driftdetective/ddetective-backend⁠ and driftdetective/ddetective-frontend⁠, both multi-arch (linux/amd64, linux/arm64)
• Docs: cloudkeel.io/docs⁠ · Release notes: github.com/cloudkeel/cloudkeel-dd/releases⁠

⁠Install

No account, no form, no pull secret. A Kubernetes cluster (1.24+) and Helm 3 (3.8+ for OCI pull).

# Needs Python 3 with the `cryptography` package (pip install cryptography).
FERNET=$(python3 -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")
DATAKEY=$(python3 -c "from cryptography.fernet import Fernet; print(Fernet(b'$FERNET').encrypt(Fernet.generate_key()).decode())")
JWT=$(openssl rand -base64 48)

helm install dd oci://registry-1.docker.io/driftdetective/d-detective --version 0.3.7 \
  --namespace ddetective --create-namespace \
  --set secrets.fernetKey="$FERNET" \
  --set secrets.dataKeyWrapped="$DATAKEY" \
  --set secrets.jwtSecret="$JWT" \
  --set postgresql.auth.password="$(openssl rand -hex 16)"

Keep the three secrets somewhere safe. secrets.fernetKey encrypts the cloud credentials you connect later; a reinstall with a different key cannot read them back.

Full walkthrough, prerequisites and what to expect at each step: cloudkeel.io/quickstart⁠.

See every configurable value before you install:

helm show values oci://registry-1.docker.io/driftdetective/d-detective --version 0.3.7

⁠What the chart deploys

• API, Celery worker and Celery beat (three containers from one backend image)
• Web UI (frontend image)
• OPA sidecar for policy checks
• A per-release database migration Job with wait-for-DB init containers (a plain Job, deliberately not a Helm hook, so an upgrade's migrations are visible in kubectl get jobs)
• Bundled PostgreSQL and Redis by default; point at your own with postgresql.enabled=false / redis.enabled=false
• An Ingress, off by default (ingress.enabled=true with your host and TLS secret); the UI and API share one host either way

⁠Versions and tags

• Chart version and appVersion move independently. A chart-only fix bumps version alone and keeps pointing at the same images.
• Image tags default to the chart's appVersion. Pin both when you deploy: --version X here and, if you override image tags, the matching X.
• Published versions are immutable; a tag is never rewritten.
• Do not use 0.3.0: the chart installs but its images were removed, so every pod ends in ImagePullBackOff. 0.3.3 was never published. Use 0.3.2 or later.

Confirm a version is installable before you quote it anywhere:

helm show chart oci://registry-1.docker.io/driftdetective/d-detective --version 0.3.7

⁠How it runs

• Entirely inside your cluster. There is no Cloudkeel-DD-operated endpoint: no telemetry, no analytics, no licence server, no update check.
• Read-only against your clouds. Remediation ships as a pull request you review; nothing is auto-applied.
• Findings and credentials stay in your database, encrypted with a key only your install holds. The only finding data that leaves is what you route out yourself: notification webhooks and GitHub/GitLab remediation pull requests.
• Runs unmetered for 30 days from the first tenant, then converts to the Free tier (1 enabled scope, 3 users, every feature). Nothing is deleted and nothing stops; scopes past the ceiling are held back until a key is applied. Details: cloudkeel.io/pricing⁠.

⁠Coverage

Scans are point-in-time. What is proven on a live account, what is verified against fixtures only, and what is still inventory-level is kept in one place: cloudkeel.io/docs/claims/coverage⁠.

⁠Support and security

• Questions and bug reports: GitHub issues⁠
• Security reports: email [email protected]⁠, not a public issue (policy⁠)

Cloudkeel-DD is commercial, self-hosted software. The application source is not published; the GitHub repository carries release notes, docs and support.