- remove some apps (cowsay, transparency, estargz)
- start to move DNS zone management into TF too (optional)
- update GH workflow to deploy using TF
TODO:
- store state in GCS
- define one-time setup to grant GHA SA permissions it needs to deploy
- documentation for Future Jason
- cosign_verify base images
- cosign_sign images and cosign_verify before deploy