feat: Audit only, the right (but harder) way

[sunib]

Important simplification in how gitops-reverser gets its audit events: it's now a requirement that you configure the Kubernetes API Server to push audit events through a webhook. This is annoying, but it's the only way to get the commit author 100% right. It all boils down to not being able to guarantee a validation webhook wasn't stopped for whatever reason after you processed it. The real audit event only triggers after everything is successfully stored.

Working list:

• Adjust documentation, and honestly note that it's not possible to run this controller directly on managed clusters. Perhaps document a potential workaround where we leave out the name of the actor (technically that should also be doable with watch streams only).
• See if we need more tests
• What do we do with the current approach to secrets? Is it good enough to merge like this? All advice is now adjusted to install your own password-protected Redis instance, which makes it acceptable in my opinion.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (20 files)

• .claude/settings.local.json - New permissions for make targets
• .devcontainer/devcontainer.json - Added postStartCommand
• .devcontainer/post-create.sh - Refactored to use sync-signing-key.sh
• .devcontainer/sync-signing-key.sh - New script for SSH key management
• Makefile - Added kustomization filtering for Flux setup
• charts/gitops-reverser/templates/admission-webhook.yaml - Replaced correlation webhook with GitTarget validator
• charts/gitops-reverser/values.yaml - Removed validating config, added caBundle
• cmd/main.go - Removed correlation store, added audit consumer
• config/webhook.yaml - Replaced correlation webhook with GitTarget validator
• Documentation files (4 new design docs)

The PR properly removes the correlation webhook infrastructure and replaces it with the audit stream consumer approach as documented in the design files. The GitTarget validator webhook is correctly preserved for preventing duplicate target configurations.

---

_{Reviewed by minimax-m2.5 · 605,297 tokens}