PASS, WARN or FAIL with a remedy line. Non-zero exit if anything failed; --json emits the same report machine-readably.
- P1 · Taints and tolerations — workloads that cannot schedule sit Pending forever. Covers the dynamically spawned bot pods, which appear in no manifest.
- P2 · Resources vs LimitRange — a LimitRange silently defaults undeclared containers to 64Mi; verifies the delivered declarations fit your min/max.
- P3 · ResourceQuota headroom — quota that cannot fit the declared totals refuses pods at the margin.
- P4 · Pod security admission — OpenShift SCC
restricted-v2rejects explicit UIDs outside the namespace range; PodSecurityrestrictedneedsrunAsNonRoot, seccomp, capability drops. Names the workload that would be refused. - P5 · NetworkPolicy reachability — default-deny egress with no DNS allowance, or no route to the registry. Static, or proven with
--live-probes. - P6 · Shared-memory sizing — the bot’s memory-backed
/dev/shmcounts against its memory limit; checks your LimitRange max and node capacity hold it. - P7 · Image pull — pulls a release image by digest with this namespace’s secrets; warm node caches hide broken credentials until the first new release.
- P8 · Storage — a default StorageClass exists if the delivered set carries volume claims.
- P9 · Version floor — Kubernetes is at or above the tested floor.
restricted compliant, so preflight works inside hardened namespaces.
Air-gapped clusters: dump on a connected workstation with cluster access, then analyse anywhere with --snapshot cluster.json. Live probes need cluster access; everything else works from the snapshot.
vexa_validate.py runs both in order and packages the receipts together.
Next: Install · Operations