I'm working on a narrow Kubernetes release-integrity problem: how do you bind one reviewed release to the exact mutations it is allowed to make, rather than treating authorized API calls as proof that the overall release was approved?
My public Go prototype signs a bounded release envelope, checks immutable workload image references, verifies GitHub Actions OIDC claims, and includes single-node replay handling. Pre-alpha only: it is not an admission controller and cannot yet prove what an API server admitted or what a node ran.
Code, tests and explicit limitations: github.com/EdwinJdevops/kube-release-envelope
If you've built admission webhooks or GitOps release systems, which failure case would you test first to falsify this model? Sent using@ChatGPT
