Skip to main content
Built for the shape large organizations actually run it: a shared cluster operated by a platform team, where your team holds a project and deploys through GitOps. Nothing in the install needs cluster-admin, and nothing needs a CLI.

​
Status

Rehearsed against recorded constraints; never installed on an OpenShift cluster. The profile carries PROFILE_TESTED=no, and that is the accurate value: kit/install.sh --provider openshift has not been run against OpenShift, so Argo install, Kyverno install, admission policy and repo secrets are all untried there against real SCC and real RBAC. What has been done is offline — the SCC/PSA/LimitRange logic checked against constraints recorded from a genuine SCC admission rehearsal (MicroShift 4.18, 2026-08-21) and from a subscriber’s own measurements: 25 chart objects admitted stock, zero SCC rejects, random-UID security contexts injected on all 21 pods (parity detail). Vexa has not been observed converging and running on OpenShift, and one known defect is in the way. Under a random UID, HOME is absent from the bot and agent-worker images at the v0.12.23 digests; the minio-init hook fails with mkdir /.mc: permission denied and the Application never converges. HOME=/tmp is the one-variable fix, tracked upstream, not shipped. No preflight check detects it — a P4 PASS means admission will accept the pod, not that the process inside it can run. Two further gaps, stated as gaps: the OpenShift GitOps operator is recommended on evidence about upstream Argo’s images rather than on a run of it with this kit, and bare-metal OpenShift with no LoadBalancer needs a Route, which the chart does not render today.

​
How the install works here

There is no setup script on a no-CLI platform — the script’s work arrives as one merge into your GitOps config repo: an Argo Application carrying the station bundle reference, your contract, and the channel public key. Your Argo does the rest. Your staging tier then follows releases automatically and your production pin moves only when your approver moves it, recorded with the contract identity where your audit can read it.

​
Platform notes

  • Admission injects the security context. The platform assigns a random per-namespace UID and the images run under it; charts and spawned workloads deliberately set no securityContext of their own.
  • Spawned meeting bots inherit your LimitRange defaults today; first-class resource fields on spawned workloads are tracked upstream and the LimitRange is the documented interim.
  • The private-channel lane through a corporate proxy is validated: entries, charts, signatures and attestations flow through a credentialed Harbor proxy-cache, and revoking the subscriber credential fails closed for the verdict-carrying artifacts.
  • Cluster-wide admission hardening at the platform layer is an optional later step; until then the in-project verify gate is the enforcement point.
Next: Install · Preflight · Kubernetes