Zastava - Retired Kubernetes Runtime Direction

Status

Zastava’s Kubernetes admission-webhook and DaemonSet direction is retired for active Stella Ops product work.

Stella Ops does not support Kubernetes or Helm deployments. Runtime posture work has been re-scoped — first into RuntimeInstrumentation host agents for non-Kubernetes Linux and Windows container estates, and then unified into the deployment agent (StellaOps.Agent.Host). See “Replacement Direction” below.

The original StellaOps.Zastava.* source tree (Agent, Observer, Webhook, Core, tests, and the module solution) was archived on 2026-05-12 (SPRINT_20260512_018) to docs-archive/code-snapshots/zastava-2026-05-12-retired/. The zastava-webhook compose service and its Dockerfile stages are decommissioned. No live solution references StellaOps.Zastava.* projects. See architecture.mdfor the full retirement record, including the CRI digest-resolution design that was archived with the Observer.

Naming caveat — “Zastava” is reused for a live, non-Kubernetes concept

The Kubernetes Zastava product is retired, but the name survives in two unrelated places in src/. Do not confuse either with the retired admission-webhook product, and do not treat their presence as evidence the Kubernetes direction is alive.

1. Live: the registry-webhook SBOM source type (NOT Kubernetes)

SbomSourceType.Zastava = 0 is an active Scanner ingestion source type — a container-registry push-webhook source that triggers scans when images are pushed. It has nothing to do with Kubernetes admission. This is consistent with the non-Kubernetes product direction.

Ground-truth code (under src/Scanner/__Libraries/StellaOps.Scanner.Sources/):

Both the handler and the connection tester are DI-registered in StellaOps.Scanner.Sources/DependencyInjection/ServiceCollectionExtensions.cs (AddSbomSources):

services.AddScoped<ISourceTypeConnectionTester, ZastavaConnectionTester>();
services.AddScoped<ISourceTypeHandler, ZastavaSourceHandler>();

Authoritative dossier for this source type is the Scanner sources documentation, not this retirement record. This README only notes the name collision so a reader who greps for Zastava in the code is not misled by the live source-type symbols.

2. REMOVED: the Kubernetes admission-webhook CLI stub

src/Cli/StellaOps.Cli/Commands/ZastavaCommandGroup.cs used to define a stella zastava command group (install, configure, status, logs, uninstall) targeting a Kubernetes admission webhook. It was never wired in — BuildZastavaCommand had no caller anywhere in src/, so the command never appeared in stella --help — yet it still compiled into the shipped CLI assembly, and every subcommand emitted hardcoded mock output: canned admission statistics (TotalRequests = 15847, Allowed = 15702, Denied = 143) presented as live telemetry, and simulated kubectl-style success lines (✓ Namespace created) for a cluster apply that never happened.

It was deleted in SPRINT_20260712_005 (DEAD-4) after a triple-check gate (build verified; stella --help confirmed to contain zero zastava entries before and after — it was unreachable either way). It is a remnant of the retired Kubernetes direction and must not be reintroduced into the CLI surface. Recoverable from git history if ever needed as a design reference.

Still present (out of the DEAD-4 gate’s scope, flagged for a follow-up): ConfigCatalog.cs retains four zastava.* config entries (zastava.agent, zastava.observer, zastava.runtime, zastava.webhook), and three zastava:* scopes remain in the canonical catalog (below). These describe a retired module and are candidates for removal, but they were not part of the triple-checked candidate and were left untouched.

Scopes

Three Zastava scopes are defined in the canonical catalog (src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/StellaOpsScopes.cs):

NOT ENFORCED. These constants are defined in the scope catalog but are not referenced by any endpoint, handler, or policy elsewhere in src/ (verified by source search). They are orphaned from the retired Kubernetes direction; the live registry-webhook source type above is administered through the Scanner source-management surface, not these scopes.

Replacement Direction

Runtime posture and workload observation were re-scoped into non-Kubernetes host agents and then unified into the deployment agent StellaOps.Agent.Host (Sprint 20260512_020), which carries the runtime.observe.container capability and emits RuntimeEvidenceEnvelope payloads. The standalone host-agent product is now partially superseded by that unification.

Reference docs (historical host-agent story, partially superseded):

Any future Zastava concepts that remain useful must be reintroduced through the host-agent / deployment-agent model and must not depend on Kubernetes admission resources, DaemonSets, Helm charts, or kubectl.