Kubernetes
Review declared Kubernetes resources alongside the live objects your connection is allowed to read.
Keep manifests and live objects distinct
Proofline reads Kubernetes YAML and JSON declarations from configured sources, including files at a pinned GitHub commit. Live collection uses read-only discovery and list operations over an explicit resource-type allowlist.
A manifest describes the intended resource. A live object has its own cluster identity. Keeping those records distinct lets a review inspect the declaration and the observed object without conflating them.
Inspect a workload’s cloud identity
A ServiceAccount annotation can declare a binding to a Google Cloud service account or AWS IAM role. The Kubernetes record preserves that declared relationship.
The annotation alone does not establish that the cloud side permits the binding. Live collection does not execute in containers, mutate objects, or ingest arbitrary custom resources.
Connect a GKE cluster
The console setup accepts a GKE cluster, repository, and namespaces. Review the generated setup script, supply the cluster identity, and verify the connection. For other cluster arrangements, discuss the collection scope with us.
Get started with GitHub