- The default cluster is one local kind control-plane node; it is not resilient or production-sized.
- Local images and the development PostgreSQL password are for the disposable demo only.
- Staging and production-like overlays intentionally start with zero digests and no committed Secret. They cannot deploy until a verified promotion and external secret injection occur.
- Keyless release and admission verification require network access to GHCR and Sigstore services. The local negative test accepts a fail-closed verification timeout when the kind node is offline; a tagged GitHub release is the authoritative online proof.
- Preview environments live only for the workflow duration and do not expose a public URL.
- GitHub rulesets, protected environments, required reviewers, artifact retention policy, and GHCR visibility are repository settings documented here but not provisioned by the project.
- Prometheus persistence and long-term evidence storage are disabled to keep the local footprint small.
- Database backup, restore, encryption at rest, migration rollback, multi-region registry replication, and disaster recovery are out of scope.
- Kyverno
ClusterPolicyremains supported by the pinned 1.18 release but is a legacy API. A future iteration should migrate to CEL-basedValidatingPolicyandImageValidatingPolicybefore legacy removal.