coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

build: add guarded Kubernetes plane executor

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448
This commit is contained in:
tegwick 2026-08-22 11:23:38 +02:00
parent 1dd98b4f27
commit 2b318634b6
13 changed files with 1240 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
README.md
View file

@ -19,3 +19,13 @@ so that ops-warden always has something real to route to.
See `INTENT.md` for the full responsibility boundary against ops-warden,
OpenBao, flex-auth, and key-cape.
## Guarded Kubernetes planes
Small Kubernetes security foundations can use the fail-closed `ops-mason
plane` workflow. It pins source manifests and object identities, validates
cluster context/RBAC/dependencies/drift, requires an approved construction
plan plus exact digest for apply, and produces metadata-only evidence and a
non-executing rollback plan.
See [docs/kubernetes-plane.md](docs/kubernetes-plane.md).