Identity
Human sessions, machine API keys, agent identity, and operation-scoped target credentials are separate contracts.
Security & customer control
Operational authority stays inside a boundary you define.
ClusterPilot is self-hosted by design and treats identity, release integrity, credentials, authorization, execution, audit, and destructive operations as first-class system boundaries.
Clear claim boundary. ClusterPilot provides technical controls and evidence. It does not claim that deployment alone creates regulatory compliance, complete sovereignty, or production approval.
Customer-hosted by architecture.
The customer operates the control plane, persistence, agents, registry connection, credentials, and target environments.
Approved operator networkUsers · API clients · IdP boundary
Customer control planeAPI · Workers · PostgreSQL · ArtifactsAuthentication · Plans · Policy · Evidence
Execution boundaryLifecycle agents · Secret materializationVersioned work · Isolated commands · Cleanup
Customer target estateProviders · Hosts · Registries · Kubernetes clusters
Control families
Defense across the whole operation.
Security is not a single “secure” toggle. Each transition has a distinct control and evidence owner.
Authorization
RBAC, tenant/workspace scope, feature gates, admission, destructive confirmation, and environment approval remain independent.
Secrets
Customer-managed protection key and typed SecretRefs keep credential values outside plans, logs, URLs, audit, and support bundles.
Supply chain
Checksums, signatures, immutable digests, compatibility metadata, SBOM, vulnerability evidence, and provenance identify the release.
Execution
Compatible agents receive bounded typed work; contract versions, leases, ordering, timeouts, redaction, and cleanup constrain execution.
Evidence
Actors, decisions, plans, events, command results, artifacts, checksums, correlation, and retention form the review trail.
Software supply chain
Deploy an identified release—not a moving tag.
The self-hosted release contract binds runtime subjects, exact digests, signed compatibility and release metadata, SBOM, provenance, and verification evidence.
Registry and air-gap operations →Checksums, signatures, build identity
Preserve subject, digest, metadata, evidence
Apply customer policy and record approval
Confirm runtime digest and retained proof
Fail-closed defaults
Unsafe production shortcuts become explicit failures.
- Production startup rejects missing durable database, artifact, or key settings
- Multi-replica operation requires leader election and shared artifacts
- Tag-only and unverified runtime artifacts are unsupported
- Sensitive Kubernetes mutations remain disabled/contract-only in v0.0.1
- Agent placement, trust, clock, runtime, and version are negotiated before work
- Secrets are excluded from ProblemDetails and evidence contracts
Mandatory SaaSNoneCustomer hosts the control plane
Default high-risk gatesDisabledApproval is capability and environment specific
Current certification claimNoneEvidence supports customer assessment
v0.0.1 statusRelease candidateProduction readiness remains gated
Talk to ClusterPilot
Review the trust and execution boundary with us.
Bring your identity, network, registry, evidence, and operational-approval requirements to a focused technical conversation.
hello@clusterpilot.de