> ## Documentation Index
> Fetch the complete documentation index at: https://delivery.vexa.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# render.sh

> Render the cluster-scoped objects as one file a platform team applies once.

Source: `kit/platform/render.sh` · audience: customer

## When you use this

Reach for this when the team installing Vexa holds a project and somebody else holds the cluster. It renders every cluster-scoped object the kit needs — Argo's CRDs, Kyverno and the two ClusterPolicies, the read ClusterRole the application-controller cannot sync without, the projects with their memory ceiling and quota — into one file a platform team applies once. You do not need it when the install itself runs with cluster rights, which is the default.

## Usage

Emitted from `kit/platform/render.sh --help`.

```text theme={null}
usage: render.sh --provider <openshift|kubernetes> --project <name> \
                 --channel <name> --channel-pubkey <path> [options]

required
  --provider        openshift | kubernetes. 'kubernetes' is the generic pack
                    for every other platform (EKS, AKS, GKE, LKE, on-prem):
                    identical objects, minus the OpenShift SCC annotations.
  --project         the project/namespace the staging tier deploys into. This
                    is the name your platform team creates.
  --channel         channel name, e.g. acme-stable. Recorded on every object
                    as an annotation so the pack's provenance is readable in
                    the cluster afterwards.
  --channel-pubkey  the cosign public key from your onboarding mail. The
                    signature ClusterPolicy pins it, exactly as install.sh
                    does; a pack without it could not be applied.

options
  --prod-project    the production project (default: <project>-prod)
  --signature-repository  OCI repo the image signatures live in (default:
                    alongside each image, cosign's own convention)
  --uid-range START/SIZE  OpenShift only. Pin the project's SCC UID range
                    instead of letting OpenShift allocate one on creation.
                    Omitted by default: OpenShift assigns the range itself,
                    and a range invented here would be a fabricated
                    constraint. See kit/platform/README.md.
  --app-team-subject KIND/NAME  bind ONE app-team identity to BOTH projects,
                    e.g. Group/vexa-app-team, User/…, ServiceAccount/… (which
                    is taken to live in the staging project unless you write
                    ServiceAccount/NAMESPACE/NAME). Omitted by default: most
                    platform teams grant project access through their own
                    mechanism (`oc adm policy`), and this pack should not
                    presume it.
  --app-team-role   the ClusterRole the binding above references (default:
                    admin — OpenShift's project admin)
  --argo-namespace  namespace holding the argocd-application-controller
                    ServiceAccount the read ClusterRole is bound to
                    (default: <project>, the namespace-scoped Argo shape)
  --argo-sa         that ServiceAccount's name (default:
                    argocd-application-controller)

sizing — every number below is derived and printed; --print-plan shows the
arithmetic and writes nothing
  --chart-values FILE  recompute the ceiling and the quota from a real Vexa
                    chart values.yaml instead of the recorded figures in
                    kit/platform/chart-sizing.env (needs PyYAML)
  --memory-ceiling SIZE  set the LimitRange max.memory outright. It is a
                    FLOOR, not a target: below the chart's largest container
                    limit the delivered set is refused at admission.
  --concurrent-bots N     meeting bots to budget quota for (default 4)
  --concurrent-workers N  agent workers to budget quota for (default 2)
  --quota-memory, --quota-cpu, --quota-pods, --quota-pvc  override a computed
                    ResourceQuota line (e.g. --quota-memory 64Gi)

sources
  --argocd-manifest FILE   read the pinned Argo CD manifest from a file
                    instead of fetching it. For air-gapped renders and for
                    tests; the pinned URL is printed either way.
  --kyverno-manifest FILE  the same for Kyverno.

output
  --out FILE        default: platform-<provider>.yaml in the current directory
  --print-plan      print the object list and the sizing arithmetic, write
                    nothing, exit 0
```