Kubernetes Resource Audit
A local-first Kubernetes inventory bundle with declared capability coverage, sensitive-data handling, and a separate review path.
Public preview · version 0.2.0
Context
Platform teams need a usable inventory of workload, scheduling, storage, network, security, image, and optional usage signals before recommendations can be trusted.
Constraint
Cluster metadata is customer-confidential. Secret objects and values, environment values, arbitrary annotations, filesystem contents, and live traffic must never be collected.
Work
TacitSoft built a versioned collector, bundle contract, sanitization rules, synthetic fixtures, checksum-published release, and fail-closed worker validation path.
Architecture
- Local collection through the operator-selected kubectl context
- Explicit capabilities and handling state in the bundle contract
- Metadata sanitization that excludes Kubernetes Secrets and values
- Manifest and checksum chain with controlled, separate upload
Verified current state
Version 0.2.0 is a public preview with a published checksum, synthetic full-capability fixtures, and automated canonical-source parity validation.
- Evidence strength
- Checksum-published public preview
- Evidence basis
- Versioned source and archive, published SHA-256, synthetic fixtures, collector catalog contract, and focused bundle validation tests.
Operating responsibility
TacitSoft publishes and validates the collector contract. Operators retain control of cluster access, local inspection, and whether a bundle is uploaded.
What remains private
No live cluster was contacted and no customer bundle is shown. Raw output remains customer-confidential even after operator review.