choudoufu

Platform

Kubernetes

Every object-metadata type plans, carries the estate label, is swept for orphans, and is fenced by one admission policy that reads it; the gauntlet runs its stages on a kind cluster in a lane of its own, where the first estate clears every applicable stage, migration from a stock state included (#1073).

Every Kubernetes type with object metadata, and every custom resource through kubernetes_manifest, plans, carries the estate label on create, is swept for orphans by that label, and is fenced by one admission policy that reads it. These five pages say what is proven on a real cluster and what is refused by name, slot by slot, rather than saying “AWS only”.

The research is #1016. Everything below cites it or says it is unverified.

Every object in the estate also has a record. One operator can leave them in the implied local store; a team needs a shared one, either record_store "kubernetes", one Secret per record and no AWS account anywhere, or record_store "s3". Operate has the block.

  1. Adopt One label is the marker, objects bind by namespace and name, and a stock state file migrates with one command.
  2. Gate One admission policy on the label fences every write, and granting an estate is an ordinary ClusterRole.
  3. Operate Rename is a config edit, records live in the cluster, and removal skips anything a controller made.
  4. Compatibility Every type with object metadata plans, custom resources included, and a short list is refused by name.
  5. Proof Which claims are proven on a real cluster, and how to run them.

Everything on these five pages links down into the evidence: the runnable claims, the gauntlet, the measurements, and the per-type lookup.