Introduction

telark is a protection gate for your Kubernetes workloads. It runs as a single Helm release inside your cluster: discover your applications, then decide what can change them — and when.

Discover → Plan → Enforce → Verify

1. Discover. telark groups raw workloads into applications automatically and keeps that grouping live. You protect "checkout", not seventeen Deployments.
2. Plan. Bind ready-made policy templates to a scope — one or more applications, or one or more namespaces — and to a window. Plans are permanent or time-bounded, and a time-bounded plan arms and disarms itself on schedule.
3. Enforce. While a plan is active, admission decisions protect its scope. Run in audit first so violations are recorded without blocking anything, then flip to enforce when you trust what you see.
4. Verify. Plan health is computed by reading the cluster back — telark confirms the protection you asked for is the protection actually running. Drift, missing policies, and tampering are surfaced rather than assumed away.

What rides along

These are supporting capabilities, not the headline — but they are what makes the gate usable day to day.

• Snapshots and rollback. Every change telark sees is captured before it lands, and one call rewinds an application to a known-good revision.
• Change classification. Each change cycle is labelled by class and severity, so noise and incidents look different in the feed.
• Passkey-first auth and CRD-based RBAC. Users, groups, and roles are custom resources. WebAuthn is the default sign-in flow; Google OIDC is supported.
• AI insights. Optional per-application summaries and risk signals. Off unless you configure a provider.

What it is not

• Multi-cluster. telark is single-cluster, single-tenant today. Federation is not on the near roadmap.
• Hosted. The Elastic License 2.0 forbids us from offering telark as a hosted service. You run it.
• An agent. No sidecars, no DaemonSet that mutates your pods.

Who it is for

Platform engineers and SREs running their own Kubernetes in production who want a time-scoped way to say "not right now" — plus the change history and undo button to back it up — without standing up four separate tools.

Maturity

telark is in early access. There is one released chart version (0.0.1), the custom resources are all v1alpha1, and the chart and APIs may still change. Pin a chart version for production installs.