Kubernetes evaluator

A validating admission webhook that asks Evaluate before annotated workloads are admitted. It is not the Kubernetes exporter. Install it as its own Deployment — an exporter outage must not disable the gate, and a gate outage must not stop evidence from landing.

Code: Evitrus/exporter → admission/.

Independence

Component	Job
Kubernetes exporter	Watch rollouts, emit deploy.succeeded / operate.config.changed
This evaluator	POST /compliance/evaluate; deny records deploy.blocked

Do not merge them into one binary or one Kubernetes Deployment.

Setup

1. Mint an API key with evaluate (and ingest if denies should be stored as deploy.blocked).
2. Deploy admission/ with TLS (cert-manager in the sample manifest).
3. Point EVITRUS_EVALUATE_URL / EVITRUS_INGEST_URL at your Evitrus API. Set EVITRUS_ENVIRONMENT to the environment this cluster ships (default prod). Staging clusters should set staging (or similar) so a prod break-glass window cannot admit here.
4. Label namespaces that should be gated: evitrus.dev/enforce=true.
5. Annotate workloads with evitrus.dev/commit (opt-in). Objects without that annotation are not gated. Optional evitrus.dev/environment (or an environment / env label) overrides EVITRUS_ENVIRONMENT per workload so Evaluate can match a break-glass window.

Sample manifests: exporter/admission/deploy/deployment.yaml. failurePolicy: Ignore on the webhook is fail-open at the apiserver if the evaluator is down.

Failure semantics

Evaluate outcome	Admission	Evidence
pass / overridden / breakglass / na	allow	none extra
fail	deny	deploy.blocked
timeout / 5xx	allow (fail-open)	none
Evaluator down (failurePolicy: Ignore)	allow	none

na (dark evidence) does not block. Pack-on includes the gate unless disabled in product.

See also the Kubernetes exporter.