This was a bug in the store reload path, fixed in Cerbos v0.42.0, upgrade and /admin/store/reload reloads schemas too. If you run a lambda or automation that calls the admin reload endpoint on updates, no config change is needed beyond the upgrade. Source: https://github.com/cerbos/cerbos/issues/251…

Populate the container's known_hosts from ssh-keyscan before Cerbos starts: create a ConfigMap with the output of `ssh-keyscan github.com` and mount it at /etc/ssh/ssh_known_hosts for all Cerbos pods (or do the same in an init container). The reporter confirmed this fixed the clone failure. Also mak…

The checkout directory contains unstaged content, usually inherited from the source git repository itself (e.g. a .gitignore added later or stray files committed in history), the underlying git library cannot pull over it. Fix: point the git storage driver at a clean, dedicated repository containing…