Configuration trust and drift protection
Nexo 0.2.0 validates registered resource fields, references, and managed-resource signatures while resolving the desired graph. Kubernetes ownership and Operator reconciliation keep generated resources tied to their owning Nexo custom resources.
Desired-state chain
- An authorized user changes configuration through the supported console.
- Manager receives approved desired state for its environment.
- Operator resolves registered references and applies its 0.2.0 validation.
- Operator renders namespaced Kubernetes resources.
- Proxy activates the supported graph and reports status.
Record both desired state and the active graph revision. A CRD object existing in the cluster does not prove that the pinned Operator reconciles it or that the Proxy executes its phase.
No signed step-provenance enforcement
:::warning Unavailable in 0.2.0
The pinned 0.2.0 Operator does not verify DSSE/SLSA step attestations or enforce the later per-step provenance trust model.
:::
Use only artifacts supplied by the approved 0.2.0 release bundle. Do not substitute an independently built image and infer trust from a matching component name.
Ownership and drift
Generated Deployments, Services, ConfigMaps, and Secret copies are managed by Operator. Do not manually patch them as a normal deployment mechanism. Reconciliation can replace the patch and separate the running state from the approved configuration history.
Management interruption
Monitor the last successful acknowledgement and confirm the graph that remains active. Do not bypass policy or hand-edit managed workloads while Control Plane or Manager connectivity is unavailable.
Admission and drift details
See Admission and drift behavior for the controls available in 0.2.0 and the later webhook, Manager drift detector, Kyverno, and integrity features that are explicitly outside this snapshot.