Provisioner

The provisioner receives manifests via gRPC streaming and applies them to the cluster using server-side apply. It impersonates the tenant’s provisioner ServiceAccount so that Kubernetes evaluates authorization against the tenant’s permissions, not the platform’s.

Before applying, the provisioner verifies each manifest’s resource type supports the list verb via the Kubernetes discovery API. Resource types that cannot be listed are rejected — the pruner relies on listing by label to calculate prune targets, so any resource that cannot be listed cannot be pruned and would be orphaned.

The provisioner verifies the source target lease before applying.

The provisioner streams applied manifests to the pruner.

The katartismos interface defines the gRPC contract.