Kubernetes evaluator

A validating admission webhook. It asks Evaluate before annotated workloads are admitted. It is not the Kubernetes exporter. Install it as its own Deployment. An exporter outage must not disable the gate, and a gate outage must not stop evidence.

Code: Evitrus/exporter → admission/.

Requirements

• A tenant API key with the evaluate scope
• The ingest scope as well, if a deny should be stored as deploy.blocked
• TLS for the webhook (cert-manager in the sample manifest)
• Namespaces you intend to gate, and workloads annotated with evitrus.io/commit

Install guide

Sample manifests: admission/deploy/deployment.yaml.

1. Deploy admission/ with the API key in a Secret (api-key).
2. Point the evaluator at the managed API:

Variable	Value
EVITRUS_EVALUATE_URL	https://api.evitrus.io/compliance/evaluate
EVITRUS_INGEST_URL	https://api.evitrus.io/ingest
EVITRUS_API_KEY	Tenant key
EVITRUS_ENVIRONMENT	Environment this cluster ships. Default prod. Set staging on non-prod clusters so a prod break-glass window cannot admit there

3. Label namespaces that should be gated: evitrus.io/enforce=true.
4. Annotate workloads with evitrus.io/commit. Objects without that annotation are not gated. Optional evitrus.io/environment (or an environment / env label) overrides EVITRUS_ENVIRONMENT for that workload.

failurePolicy: Ignore on the webhook is fail-open at the apiserver when the evaluator is down.

The Kubernetes exporter is a separate install. Do not merge them into one Deployment.

How it enforces

The webhook calls POST /compliance/evaluate on create and update of Deployments, StatefulSets, DaemonSets, Jobs, and CronJobs in labeled namespaces. A deny rejects admission. If Evaluate cannot be reached, admission is allowed.

Evaluate outcome	Admission	Evidence
pass / overridden / breakglass / na	allow	none extra
fail	deny	deploy.blocked when the key has ingest
timeout / 5xx	allow (fail-open)	none
Evaluator down (failurePolicy: Ignore)	allow	none

na does not block. Pack-on includes the gate unless the tenant disables enforcement in the product.