- Use Podman (daemonless) instead of Docker for building images - kubeconfig stored as Gitea secret KUBECONFIG_B64 - RBAC: hugo-deployer SA for k8s API access - Gitea Registry enabled for container storage