kit/install.sh instead. Either way preflight, smoke and the station report shell out to kubectl, from a machine with access to your namespace — not to your cluster. A team with no CLI anywhere can subscribe and stay current; it cannot preflight, smoke-test or report.
The one-time acts that do need cluster-admin belong to your platform team, and they are one file, applied once — six objects, listed below with what each is for. Every one was measured on 2026-09-06 by a namespace-scoped tenant attempting the verb and being refused, never by asking auth can-i (parity detail). That rig was kind v1.30.0 under PSA restricted with Kyverno emulating restricted-v2 — not OpenShift, which the Status section below states in full.
Status
Rehearsed against recorded constraints; never installed on an OpenShift cluster. The profile carriesPROFILE_TESTED=no, and that is the accurate value: kit/install.sh --provider openshift has not been run against OpenShift, so Argo install, Kyverno install, admission policy and repo secrets are all untried there against real SCC and real RBAC. What has been done is offline — the SCC/PSA/LimitRange logic checked against constraints recorded from a genuine SCC admission rehearsal (MicroShift 4.18, 2026-08-21) and from a subscriber’s own measurements: 25 chart objects admitted stock, zero SCC rejects, random-UID security contexts injected on all 21 pods (parity detail).
Vexa has not been observed converging and running on OpenShift. One suspected defect is written up here and has still not been reached: under a random UID, HOME is absent from the bot and agent-worker images at the v0.12.23 digests, and a mkdir /.mc: permission denied in the minio-init hook was expected to stop the Application converging. At chart 0.12.35 no minio-init hook is rendered at all, and the run that got closest was stopped earlier by admission — so this is neither reproduced nor refuted at the current chart. HOME=/tmp is the one-variable fix if it reappears, tracked upstream, not shipped. No preflight check detects the class — a P4 PASS means admission will accept the pod, not that the process inside it can run. Two further gaps, stated as gaps: the OpenShift GitOps operator is recommended on evidence about upstream Argo’s images rather than on a run of it with this kit, and bare-metal OpenShift with no LoadBalancer needs a Route, which the chart does not render today.
One-time platform-team asks — one file, applied once
You are meant to deliver a generic environment, a transcription endpoint, a mailbox and the ports below. The machinery installs itself. When the install runs once with cluster rights,kit/install.sh creates everything it needs — that is how our own cluster went in, and there is no separate ask at all.
Where the app team holds a project and a separate department runs the cluster, six objects are your platform team’s and a tenant is refused on each. Four are cluster-scoped by construction; the last two are namespaced objects a project admin is deliberately read-only on. Every one was measured on 2026-09-06 by attempting the verb, not assumed:
They arrive as one file.
kit/platform/render.sh --provider openshift --project <name> --channel <name> --channel-pubkey channel.pub renders platform-openshift.yaml; your platform team applies it once with oc apply --server-side --force-conflicts -f platform-openshift.yaml. The Argo CD and Kyverno halves are the pinned upstream manifests verbatim; the memory ceiling is read from the chart rather than chosen. kit/platform/README.md explains every object and is written for the platform engineer, not for us.
After that the app team runs kit/install.sh --cluster-scope platform-pack, which creates no namespace and installs nothing cluster-scoped — and refuses, naming the pack, if the pack is not there. From then on they subscribe, upgrade, smoke-test and report inside their own two projects.
How the install works here
There is no setup script on a no-CLI platform — the script’s work arrives as one merge into your GitOps config repo: an Argo Application carrying the station bundle reference, your contract, and the channel public key. Your Argo does the rest. Your staging tier then follows releases automatically and your production pin moves only when your approver moves it, recorded with the contract identity where your audit can read it.Platform notes
- Admission injects the security context. The platform assigns a random per-namespace UID and the images run under it; charts and spawned workloads deliberately set no
securityContextof their own. - Spawned meeting bots inherit your LimitRange defaults today; first-class resource fields on spawned workloads are tracked upstream and the LimitRange is the documented interim.
- The private-channel lane through a corporate proxy is validated: entries, charts, signatures and attestations flow through a credentialed Harbor proxy-cache.
- A
WaitForFirstConsumerStorageClass deadlocks the sync. Argo counts aPendingPVC as un-Healthy and will not start the wave holding the workloads that would consume it, so the chart’s standaloneagent-workspacesPVC waits for a consumer that waits for the PVC. Many OpenShift default CSI classes bind on first consumer; give the project a class that bindsImmediate, or pre-bind the volume. - Cluster-wide admission hardening at the platform layer is an optional later step; until then the in-project verify gate is the enforcement point.