operator-incident-evidence

Capture immutable postmortem evidence by tracing affected resources, comparing live state to governed intent, and generating fingerprinted receipts. This process produces bundle and snapshot outputs that preserve what was observed at capture time for later audit validation.

Offline replay for GitOps incident artifacts works by using bundle and snapshot outputs to preserve the observed cluster state. Reviewers can inspect these captured artifacts later, even after the Kubernetes cluster has moved on and changed states.

Attribute field-level changes by composing a three-way trace, explain, and compare analysis for affected resources. This connects operator-visible events to governed intent using ChangeSets, history, and audit trails to determine exactly what happened.

Validate incident receipts after the cluster state changes by running a receipt validate command on the previously saved artifacts. This proves the evidence integrity of the immutable package generated during the initial capture.

You can generate immutable incident evidence using read-only cub-scout commands. These commands safely trace resources and produce fingerprinted receipts without modifying the live Kubernetes cluster state.

Assemble an audit-ready evidence package for Kubernetes when an incident peak has passed and you need to write a postmortem with confidence. It provides structured artifacts covering a time window, multiple resources, and connected-mode timelines for ownership and attribution.