Security & multi-tenancy

How to run StageSet without granting it broad cluster power, keep secrets encrypted, and constrain what it can reach. The controller applies as a tenant ServiceAccount, so a StageSet can do exactly what its RBAC allows and no more.

• Secrets encryption — decrypt SOPS-encrypted files in memory during apply.
• Multi-cluster and tenancy — apply as a tenant ServiceAccount or to a remote cluster.
• Admission webhook — validate StageSets at admission time.
• Network policy — lock the controller’s traffic down to what it needs.
• Service mesh — run the controller inside a mesh.