How It All Composes

Security is expressed in the same katalog.yaml as the operator itself. No separate security stack to install or maintain.

Deletion protection labels managed CRs and CRDs, then a validating webhook blocks any kubectl delete. When enabled it also protects the Orkestra Deployment, Service, and webhook configuration itself.

Admission rules — declared in validation.rules and mutation.rules. Enforced at SSA time by the webhook. ork serve play runs the same rules offline — no mock.

Token model — per-CRD, per-alias, per-operation. Supports static bearer, GitHub Actions OIDC, GitLab CI OIDC, HashiCorp Vault, and generic OIDC. No static secrets in pipelines.

The lifecycle of a pattern — from first write to deletion — is expressed in the same artifact language as the operator itself. No external lifecycle system, no separate controllers.

No build step. The operator is a YAML file. ork validate checks it offline. ork simulate reconciles it in-memory. ork e2e tests it in a real cluster.

Upgrade is a line in a file. A version bump in the Komposer goes through code review. Never automatic, never silent.

Deprecate — metadata.deprecation with a timeline. ork run and ork gate refuse to start without explicit accept flags. The decision to run a deprecated pattern is a reviewable record.