kit/platform/render.sh · audience: customer
When you use this
Reach for this when the team installing Vexa holds a project and somebody else holds the cluster. It renders every cluster-scoped object the kit needs — Argo’s CRDs, Kyverno and the two ClusterPolicies, the read ClusterRole the application-controller cannot sync without, the projects with their memory ceiling and quota — into one file a platform team applies once. You do not need it when the install itself runs with cluster rights, which is the default.Usage
Emitted fromkit/platform/render.sh --help.
usage: render.sh --provider <openshift|kubernetes> --project <name> \
--channel <name> --channel-pubkey <path> [options]
required
--provider openshift | kubernetes. 'kubernetes' is the generic pack
for every other platform (EKS, AKS, GKE, LKE, on-prem):
identical objects, minus the OpenShift SCC annotations.
--project the project/namespace the staging tier deploys into. This
is the name your platform team creates.
--channel channel name, e.g. acme-stable. Recorded on every object
as an annotation so the pack's provenance is readable in
the cluster afterwards.
--channel-pubkey the cosign public key from your onboarding mail. The
signature ClusterPolicy pins it, exactly as install.sh
does; a pack without it could not be applied.
options
--prod-project the production project (default: <project>-prod)
--signature-repository OCI repo the image signatures live in (default:
alongside each image, cosign's own convention)
--uid-range START/SIZE OpenShift only. Pin the project's SCC UID range
instead of letting OpenShift allocate one on creation.
Omitted by default: OpenShift assigns the range itself,
and a range invented here would be a fabricated
constraint. See kit/platform/README.md.
--app-team-subject KIND/NAME bind ONE app-team identity to BOTH projects,
e.g. Group/vexa-app-team, User/…, ServiceAccount/… (which
is taken to live in the staging project unless you write
ServiceAccount/NAMESPACE/NAME). Omitted by default: most
platform teams grant project access through their own
mechanism (`oc adm policy`), and this pack should not
presume it.
--app-team-role the ClusterRole the binding above references (default:
admin — OpenShift's project admin)
--argo-namespace namespace holding the argocd-application-controller
ServiceAccount the read ClusterRole is bound to
(default: <project>, the namespace-scoped Argo shape)
--argo-sa that ServiceAccount's name (default:
argocd-application-controller)
sizing — every number below is derived and printed; --print-plan shows the
arithmetic and writes nothing
--chart-values FILE recompute the ceiling and the quota from a real Vexa
chart values.yaml instead of the recorded figures in
kit/platform/chart-sizing.env (needs PyYAML)
--memory-ceiling SIZE set the LimitRange max.memory outright. It is a
FLOOR, not a target: below the chart's largest container
limit the delivered set is refused at admission.
--concurrent-bots N meeting bots to budget quota for (default 4)
--concurrent-workers N agent workers to budget quota for (default 2)
--quota-memory, --quota-cpu, --quota-pods, --quota-pvc override a computed
ResourceQuota line (e.g. --quota-memory 64Gi)
sources
--argocd-manifest FILE read the pinned Argo CD manifest from a file
instead of fetching it. For air-gapped renders and for
tests; the pinned URL is printed either way.
--kyverno-manifest FILE the same for Kyverno.
output
--out FILE default: platform-<provider>.yaml in the current directory
--print-plan print the object list and the sizing arithmetic, write
nothing, exit 0