Security

• Admission webhook

  The validating webhook for StageSet — the invariants it enforces, why it exists instead of CEL, the failure-policy trade-off, and the two TLS provisioning modes.

• Image verification

  Gate a rollout on container image signatures — cluster ImageVerificationPolicies verify each image with cosign keyless identity and pin it to its digest before a stage applies it.

• ImageUnverified

  A stage referenced an image that fails an ImageVerificationPolicy; the stage is held before apply.

• MigrationSourceNotPinned

  A sourced migration ladder's source is pinned to a mutable tag/branch instead of an immutable digest/commit, and pinning is required.

• MigrationSourceNotVerified

  A sourced migration ladder's source is not signature-verified; the destructive ladder is refused until verification passes.

• Network policy

  The opt-in NetworkPolicy the chart ships — pod-scoped allowlists vs. a namespace-wide default-deny, choosing a policy engine, the ingress and egress traffic the controller needs, and how to tighten each port.

• Production

  A decision-oriented checklist for hardening a stageset-controller install before it manages production releases.

• Secrets encryption

  Decrypt SOPS-encrypted files in a stage's source before they are applied.

• Security & multi-tenancy

  Run the controller safely — SOPS decryption, tenant impersonation, remote clusters, admission validation, network policy, and service mesh.

• Service mesh

  The opt-in service-mesh authorization the chart ships — Istio or Linkerd identity-based authorization and mTLS layered over networkPolicy, per-port allowed mesh identities, the non-mesh carve-outs for the apiserver and kubelet, and native passthrough.

• Versioned migrations

  Run migrations once, when the deployed version crosses a release boundary — inline, or sourced from a Flux artifact and shared across StageSets.

• Webhook cert renewal failing

  The self-signed admission webhook certificate is not being rotated.