# Knative Serving installation

`install.sh` verifies repository-pinned SHA-256 checksums for the upstream
Serving and Kourier v1.22.0 assets before applying them over SSH. It is
idempotent. Kourier is kept `ClusterIP`; public entry through Traefik, DNS, and
TLS requires separate reef admission evidence.

The installer enables only Knative's
`kubernetes.podspec-init-containers` feature. Production workloads use init
containers for fail-closed admission checks such as verifying that egress
policy has reconciled before application code starts.

Run `install.sh railiance01`, then `verify.sh railiance01`.

Before workload admission, rollback deletes Kourier, Serving core, then CRDs
using the same verified assets. After Knative Services exist, removal requires
a workload migration and backup review and is not unattended.