Gate
llms.txtlists every page for an agent
Optional: hand this page to your coding agentThe steps work by hand too.Show the whole prompt
Follow https://intentius.io/choudoufu/kubernetes/gate/. Draft the ClusterRole and binding granting one team this estate and show them to me.
Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.On Kubernetes 1.30 or later, an admin first grants use on its estate to every identity that already writes labelled objects, one binding each:
curl -fsSL https://raw.githubusercontent.com/INTENTIUS/choudoufu/main/live/kubernetes/estate-grant.yaml \
| sed 's/PRINCIPAL_NAMESPACE/ci/g; s/PRINCIPAL/deployer/g; s/ESTATE/my-estate/g' | kubectl apply -f -Then the admin installs the admission policy once:
kubectl apply -f https://raw.githubusercontent.com/INTENTIUS/choudoufu/main/live/kubernetes/estate-boundary.yamlA write passes when the caller holds use on estates.choudoufu.intentius.io/<estate>.
What that buys
Section titled “What that buys”A grant is a ClusterRole and binding (estate-grant.yaml). Handing over moves the binding. kubectl meets the same policy.
Guarding the marker
Section titled “Guarding the marker”Keep cluster-admin to the admins who install the policy (GATE.md).