akua

Set up a CI gate that runs akua diff on package upgrades and blocks merges that break schema compatibility or violate policy. Use when configuring CI for a platform repo, preventing breaking Helm-chart upgrades, gating Renovate or Dependabot PRs, or enforcing structural-compatibility checks before deployment.

Publish an akua Package to an OCI registry with cosign signature and SLSA v1 attestation. Use when releasing a package version, cutting a new release in CI, shipping to a production registry, meeting supply-chain requirements like SLSA Level 3, or setting up a signed-by-default publishing pipeline.

Set up tests, linting, formatting, coverage, and tracing for an akua workspace — for Packages (KCL) and Policies (Rego) together. Use when bootstrapping CI for a new platform repo, adding test coverage to an untested package, debugging a policy that denies unexpectedly, configuring a format/lint pre-commit hook, or when asked "add tests" / "set up CI gates" / "why is this policy failing?"

Audit a published akua Package or Helm chart before deploying it — schema, sources, cosign signature, SLSA attestation chain, rendered output with sample inputs. Use when evaluating a third-party package, checking signatures, verifying supply-chain provenance, or inspecting a chart from ArtifactHub, GHCR, or any OCI registry.

Convert an existing helmfile.yaml into a typed akua Package written in KCL. Use when migrating from Helmfile to akua, consolidating multi-release orchestration into a single package, replacing Helmfile's untyped templating with a typed schema, or moving a platform repo from helmfile apply to GitOps render-at-CI.

Scaffold a new akua Package in KCL with a typed input schema and Helm/KCL/kro sources. Use when the user wants to start a new cloud-native package, create a new app definition, set up akua for a project, or compose multiple upstream sources into one reusable package.

Rotate a shared secret across every install that references it. Use when a credential is compromised, during scheduled key rotation (e.g., 30-day policy), when an API token expires, or when adopting a new signing key across a fleet. Handles fan-out to all consumers, policy-gated rollout, and audit trail.

Subscribe to a curated policy tier (dev, startup, production, soc2, hipaa, fedramp-moderate) and apply it across a workspace. Use when preparing for a compliance audit, hardening a production environment, standardizing guardrails across teams, onboarding a new environment, or when a user asks "make this SOC2-ready" / "apply production policy".

Run a sub-second hot-reload development loop against a local Kubernetes cluster using `akua dev`. Use when iterating on a Package, debugging rendering, seeing a live diff of manifests as schema or inputs change, demoing an infra change, or when a user asks to preview how a change will affect deployed resources.