OPERATOR BONIXER CARDS · AUDIT 2026-05-08 05:00 EDT
ISTIO ASM 1.28
UP
PASS
89d
aks-istio-system
Service mesh control plane — mTLS, traffic management, observability
istiod-asm-1-28 2/2 · Kiali scaled to 0 (on-demand viz)
If it fails: All inter-service mTLS fails. Zero-trust mesh collapses. Pod-to-pod traffic unencrypted.
CERT-MANAGER
UP
PASS
89d
cert-manager
Automated TLS certificate provisioning — Let's Encrypt + internal CA
cert-manager + cainjector + webhook all 1/1
If it fails: All TLS certs expire unrenewed. pemos.ca, auth.pemos.me, git.serlf.com go dark.
EXTERNAL-SECRETS
UP
PASS
89d
external-secrets
Syncs secrets from Azure Key Vault into k8s Secrets. ADA vault integration.
external-secrets + cert-controller + webhook all 1/1
If it fails: OAuth secrets, DB passwords, API keys go stale. Pods crash on secret rotation.
MONITORING (GRAFANA STACK)
UP
PASS
89d
monitoring
kube-prometheus-stack — Grafana + Prometheus + kube-state-metrics
grafana + kube-state-metrics + operator all 1/1
If it fails: Blind fleet. No cost alerts, no GPU pool alerts, no pod crash detection.
FLUX (GITOPS)
SCALED-DOWN
WATCH
89d
flux-system
GitOps continuous delivery — watches git repos, applies manifests to AKS
All 8 Flux controllers at 0/0. Known scaled-down — restore when sovereign git is live
If it fails: No GitOps deploys. Manual kubectl apply required for all changes. Sovereign git bonixer merge gate cannot auto-promote.
EXTERNAL-DNS
WATCH
WATCH
89d
external-dns (fleet-captain-build)
Automatically creates DNS records in Azure DNS / GoDaddy from k8s Ingress annotations
0/1 — likely DNS resolution issue or config drift. Needs investigation.
If it fails: New ingress routes don't auto-register DNS. Manual GoDaddy/Azure DNS edits required.
HIVEMIND
WATCH
WATCH
59-60d
hivemind-system
Hive-link, consciousness-index, wiki-sync, chat-history engine, Qdrant vector DB
cert-kv-sync 0/1, chat-history 0/1, mirror-aks 0/0, qdrant 0/0. Partially scaled down.
If it fails: PEMCLAU GraphRAG sync breaks. Wiki updates don't propagate. Chat history lost.
ARGO / CONSUL
NOT DEPLOYED
FAIL
—
N/A
Workflow engine (Argo) + service mesh discovery (Consul) — identified as needed in prior work
Neither Argo nor Consul found in any namespace. P0 gap for sovereign git webhook pipeline.
If it fails: No workflow orchestration. No Consul service discovery. Operators must be built next.