Security
A safety envelope you can audit in the source.
Air-gap, sovereign, workload-identity, whitelisted fixers, signed approval URLs. Every guardrail is in code you can read before you install.
The eight safety guarantees.
Air-gap by master switch
Set cloud.enabled=false and CHA runs entirely in your cluster with zero external dependency. The K8s-native value (probes, fixers, ticketing) is unchanged. Verifiable in helm template output.
Sovereign-deployable
No vendor SaaS. No telemetry exfiltration. CHA runs the same way in EU sovereign clouds, FedRAMP-trackable workloads, and on-prem regulated environments as it does on public EKS / GKE / AKS.
Cloud probes are read-only by design
Every M1 / M2 cloud probe uses workload-identity-scoped read-only IAM. Cloud-resource mutation is deliberately deferred to M4 with a separate signed-approval envelope. Read the IAM policies in the Helm chart.
Whitelisted fixer set
The OSS fixer set is exactly five named actions: StaleErrorPods, StuckJobsWithBadSecretRef, StuckRSPods, StuckCertificateRequests, TLSSecretMismatch. Each fixer is opt-in via Helm flag. Protected namespaces are allowlisted out by default.
Signed-JWT click-to-fix URLs (paid tiers)
AI-tier fix proposals require human approval via signed-JWT URLs delivered to Slack or ticket. The approval-server enforces signature, expiry, and one-time-use. Without the click, nothing mutates.
Dry-run mode
Run --dry-run to log every fix CHA would have applied without applying it. The fix log is identical to production mode minus the mutation. Use this in your eval cycle before flipping fixers on.
Auditable by default
Apache-2.0 source. Helm-rendered RBAC visible before install. DriftReport CRs are first-class audit objects. Loki / OTLP sinks for compliance pipelines (paid).
Workload-identity auth
IRSA on EKS, Workload Identity on GKE, AAD Workload Identity on AKS. No long-lived cloud credentials in CHA. Same IAM your cluster already uses — same audit trail.
Compliance & supply chain.
Apache-2.0 OSS license
Audit every line of the safety envelope before installing.
SBOM (paid)
CycloneDX SBOM published per release for Enterprise + Federal tiers.
Signed images (paid)
Cosign-signed container images with attestation in Enterprise + Federal.
No telemetry by default
OSS tier ships with zero outbound telemetry. Opt in to phone-home, never the reverse.
Found something? Tell us.
Security issues should go to security@bionicaisolutions.com. We acknowledge within one business day.