1"use strict";(globalThis.webpackChunkc1s_portal_documentation_public=globalThis.webpackChunkc1s_portal_documentation_public||[]).push([[7350],{6652(e,t,s){s.r(t),s.d(t,{assets:()=>o,contentTitle:()=>c,default:()=>h,frontMatter:()=>i,metadata:()=>n,toc:()=>d});const n=JSON.parse('{"id":"databolt/helm-preflight-checks","title":"Verify your cluster build","description":"After setting up your Kubernetes environment, you can validate your configuration by running a preflight checks script. The script performs a series of checks locally, and in-cluster, to validate your environment is ready for Databolt installation.","source":"@site/docs/databolt/helm-preflight-checks.md","sourceDirName":"databolt","slug":"/databolt/helm-preflight-checks","permalink":"/docs/databolt/helm-preflight-checks","draft":false,"unlisted":false,"tags":[],"version":"current","frontMatter":{"title":"Verify your cluster build","last_update":{"date":"08/20/2026","content_owner":"Robert Greer"},"doc_type":"how-to","team":"Platform Product Management"},"sidebar":"docsSidebar","previous":{"title":"Deploy a Kubernetes cluster","permalink":"/docs/databolt/kubernetes-cluster-requirements"},"next":{"title":"Install required components for Databolt","permalink":"/docs/databolt/helm-platform-chart-install"}}');var l=s(4848),r=s(8453);const i={title:"Verify your cluster build",last_update:{date:"08/20/2026",content_owner:"Robert Greer"},doc_type:"how-to",team:"Platform Product Management"},c="Verify your cluster build",o={},d=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Ulimit configuration for Azure and GKE",id:"ulimit-configuration-for-azure-and-gke",level:2},{value:"Kubernetes minimum Role-Based Access Control permissions",id:"kubernetes-minimum-role-based-access-control-permissions",level:2},{value:"Consolidated namespace-scoped role",id:"consolidated-namespace-scoped-role",level:3},{value:"Cluster-scoped ClusterRole",id:"cluster-scoped-clusterrole",level:3},{value:"<code>RoleBinding</code> and <code>ClusterRoleBinding</code>",id:"rolebinding-and-clusterrolebinding",level:2},{value:"Customer-managed vs. Helm-managed RBAC",id:"customer-managed-vs-helm-managed-rbac",level:2},{value:"Customer-managed prerequisites",id:"customer-managed-prerequisites",level:3},{value:"Helm-managed resources",id:"helm-managed-resources",level:3},{value:"Create a preflight configuration file",id:"create-a-preflight-configuration-file",level:2},{value:"Create the preflight script",id:"create-the-preflight-script",level:2},{value:"Execute the preflight script",id:"execute-the-preflight-script",level:2},{value:"Preflight checks reference",id:"preflight-checks-reference",level:2}];function a(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.R)(),...e.components};return(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(t.header,{children:(0,l.jsx)(t.h1,{id:"verify-your-cluster-build",children:"Verify your cluster build"})}),"\n",(0,l.jsx)(t.p,{children:"After setting up your Kubernetes environment, you can validate your configuration by running a preflight checks script. The script performs a series of checks locally, and in-cluster, to validate your environment is ready for Databolt installation."}),"\n",(0,l.jsxs)(t.p,{children:["This guide helps you create and run the preflight checks script. If you want to customize the series of checks, see the ",(0,l.jsx)(t.a,{href:"/docs/databolt/helm-preflight-checks#preflight-checks-reference",children:"Preflight checks reference"})," table."]}),"\n",(0,l.jsx)(t.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,l.jsxs)(t.ul,{children:["\n",(0,l.jsx)(t.li,{children:"A deployed Kubernetes cluster."}),"\n",(0,l.jsxs)(t.li,{children:["An operating system with the following tools installed:","\n",(0,l.jsxs)(t.ul,{children:["\n",(0,l.jsxs)(t.li,{children:[(0,l.jsx)(t.strong,{children:"jq"}),": ",(0,l.jsx)(t.code,{children:"1.7"})]}),"\n",(0,l.jsxs)(t.li,{children:[(0,l.jsx)(t.strong,{children:"curl"}),": ",(0,l.jsx)(t.code,{children:"8.0.0 or above"})]}),"\n",(0,l.jsxs)(t.li,{children:[(0,l.jsx)(t.strong,{children:"Helm"}),": ",(0,l.jsx)(t.code,{children:">= v3.15.X"})]}),"\n",(0,l.jsxs)(t.li,{children:[(0,l.jsx)(t.strong,{children:"kubectl"}),": ",(0,l.jsx)(t.code,{children:"v1.32.x or above"})]}),"\n",(0,l.jsxs)(t.li,{children:[(0,l.jsx)(t.strong,{children:"docker"}),": ",(0,l.jsx)(t.code,{children:"v1.x or above"})]}),"\n",(0,l.jsxs)(t.li,{children:[(0,l.jsx)(t.strong,{children:"bash"}),": ",(0,l.jsx)(t.code,{children:"5.0.0 or above"})]}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(t.li,{children:["A Kubernetes user with permissions to:","\n",(0,l.jsxs)(t.ul,{children:["\n",(0,l.jsxs)(t.li,{children:["Create a ",(0,l.jsx)(t.code,{children:"namespace"}),"."]}),"\n",(0,l.jsxs)(t.li,{children:["Read ",(0,l.jsx)(t.code,{children:".kubeconfig"})," from an EKS cluster. For example, root access to the bastion host."]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(t.li,{children:"An active cloud account and credentials."}),"\n",(0,l.jsxs)(t.li,{children:["A configured ",(0,l.jsx)(t.code,{children:"KUBECONFIG"})," for your target cluster."]}),"\n"]}),"\n",(0,l.jsx)(t.h2,{id:"ulimit-configuration-for-azure-and-gke",children:"Ulimit configuration for Azure and GKE"}),"\n",(0,l.jsx)(t.p,{children:"To prevent potential Out of Memory (OOM) issues during the Databolt installation, you must configure the ulimit memlock settings."}),"\n",(0,l.jsxs)(t.ol,{children:["\n",(0,l.jsxs)(t.li,{children:["Create a file named ",(0,l.jsx)(t.em,{children:"ulimit.yaml"})," on the bastion host with access to your Kubernetes cluster."]}),"\n",(0,l.jsx)(t.li,{children:"Paste the following configuration into the file:"}),"\n"]}),"\n",(0,l.jsx)(t.pre,{children:(0,l.jsx)(t.code,{className:"language-yaml",children:'apiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: ulimit-config\n namespace: kube-system\nspec:\n selector:\n matchLabels:\n name: ulimit-config\n template:\n metadata:\n labels:\n name: ulimit-config\n spec:\n hostPID: true\n hostIPC: true\n containers:\n - name: ulimit-config\n image: ubuntu\n securityContext:\n privileged: true\n command:\n - sh\n - -c\n - |\n echo "Updating system.conf file"\n echo "DefaultLimitMEMLOCK=infinity" >> /host/etc/systemd/system.conf\n echo "DefaultLimitMEMLOCKSoft=infinity" >> /host/etc/systemd/system.conf\n echo "DefaultLimitMEMLOCKHard=infinity" >> /host/etc/systemd/system.conf\n echo "Restarting systemd and containerd"\n chroot /host /bin/bash -c "systemctl daemon-reexec"\n chroot /host /bin/bash -c "systemctl restart containerd"\n echo "Done. Sleeping."\n sleep infinity\n volumeMounts:\n - mountPath: /host/etc/systemd/system.conf\n name: systemd\n - mountPath: /host\n name: host\n nodeSelector:\n capitalonesoftware.com/tier: databolt\n tolerations:\n - effect: NoExecute\n key: capitalonesoftware.com/tier\n operator: Equal\n value: databolt\n volumes:\n - name: host\n hostPath:\n path: /\n type: Directory\n - name: systemd\n hostPath:\n path: /etc/systemd/system.conf\n'})}),"\n",(0,l.jsxs)(t.ol,{start:"3",children:["\n",(0,l.jsx)(t.li,{children:"Apply the configuration by executing the following command:"}),"\n"]}),"\n",(0,l.jsx)(t.pre,{children:(0,l.jsx)(t.code,{children:"kubectl apply -f ulimit.yaml\n"})}),"\n",(0,l.jsx)(t.h2,{id:"kubernetes-minimum-role-based-access-control-permissions",children:"Kubernetes minimum Role-Based Access Control permissions"}),"\n",(0,l.jsxs)(t.p,{children:["Databolt requires ",(0,l.jsx)(t.strong,{children:"two types"})," of Role-Based Access Control (RBAC) permissions:"]}),"\n",(0,l.jsxs)(t.ol,{children:["\n",(0,l.jsxs)(t.li,{children:[(0,l.jsx)(t.strong,{children:"Namespace-Scoped role"}),": A single consolidated role for all namespace-scoped permissions.","\n",(0,l.jsxs)(t.ul,{children:["\n",(0,l.jsx)(t.li,{children:"Databolt resources, full access for installation"}),"\n",(0,l.jsx)(t.li,{children:"OTEL monitoring resources, read-only for visibility"}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(t.li,{children:[(0,l.jsx)(t.strong,{children:"Cluster-Scoped ClusterRole"}),": A cluster-level resource such as nodes and namespaces."]}),"\n"]}),"\n",(0,l.jsx)(t.p,{children:(0,l.jsx)(t.strong,{children:"Reference table"})}),"\n",(0,l.jsxs)(t.table,{children:[(0,l.jsx)(t.thead,{children:(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Permission Type"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Scope"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Purpose"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Resources"})]})}),(0,l.jsxs)(t.tbody,{children:[(0,l.jsxs)(t.tr,{children:[(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:[(0,l.jsx)(t.strong,{children:"Role"})," (consolidated)"]}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:[(0,l.jsx)(t.code,{children:"databolt"})," namespace only"]}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Install and monitor"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Databolt API (write) and OTEL monitoring (read-only)"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.strong,{children:"ClusterRole"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Cluster-wide"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Cluster resources only"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Nodes, namespaces (limited write)"})]})]})]}),"\n",(0,l.jsx)(t.h3,{id:"consolidated-namespace-scoped-role",children:"Consolidated namespace-scoped role"}),"\n",(0,l.jsxs)(t.p,{children:["The consolidated namespace-scoped ",(0,l.jsx)(t.code,{children:"Role"})," is restricted to the ",(0,l.jsx)(t.code,{children:"databolt"})," namespace and grants the following resource permissions:"]}),"\n",(0,l.jsxs)(t.ul,{children:["\n",(0,l.jsxs)(t.li,{children:["Databolt resources: Full access (",(0,l.jsx)(t.code,{children:"*"}),")"]}),"\n",(0,l.jsxs)(t.li,{children:["OTEL monitoring resources: Read-only access (",(0,l.jsx)(t.code,{children:"get"}),", ",(0,l.jsx)(t.code,{children:"list"}),", ",(0,l.jsx)(t.code,{children:"watch"}),")"]}),"\n"]}),"\n",(0,l.jsx)(t.pre,{children:(0,l.jsx)(t.code,{className:"language-yaml",children:"apiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: databolt-installer\n namespace: databolt # Change to your release namespace\nrules:\n # Core resources\n - apiGroups: ['']\n resources:\n - serviceaccounts\n - secrets\n - configmaps\n - services\n verbs: ['*']\n\n # RBAC resources (namespace-scoped)\n - apiGroups: ['rbac.authorization.k8s.io']\n resources:\n - roles\n - rolebindings\n verbs: ['*']\n\n # Apps\n - apiGroups: ['apps']\n resources:\n - deployments\n - daemonsets\n - replicasets\n - statefulsets\n verbs: ['*']\n\n # Batch (for pre/post-install jobs)\n - apiGroups: ['batch']\n resources:\n - jobs\n - cronjobs\n verbs: ['*']\n\n # Networking (if ingress enabled)\n - apiGroups: ['networking.k8s.io']\n resources:\n - ingresses\n verbs: ['*']\n\n # Cert-Manager (if enabled)\n - apiGroups: ['cert-manager.io']\n resources:\n - certificates\n verbs: ['*']\n\n # Autoscaling (if HPA enabled)\n - apiGroups: ['autoscaling']\n resources:\n - horizontalpodautoscalers\n verbs: ['*']\n\n # Policy (if PDB enabled)\n - apiGroups: ['policy']\n resources:\n - poddisruptionbudgets\n verbs: ['*']\n\n # ============================================\n # OpenTelemetry Monitoring (read-only)\n # ============================================\n # These permissions allow the user to create the OTel Role/RoleBinding\n # and provide visibility into monitoring resources\n\n # C
1ore resources (read-only for monitoring)\n - apiGroups: ['']\n resources:\n - pods\n - pods/status\n - pods/log\n - events\n - replicationcontrollers\n - replicationcontrollers/status\n - resourcequotas\n verbs: ['get', 'list', 'watch']\n\n # Extensions (read-only for monitoring)\n - apiGroups: ['extensions']\n resources:\n - daemonsets\n - deployments\n - replicasets\n verbs: ['get', 'list', 'watch']\n\n # Events (events.k8s.io) (read-only for monitoring)\n - apiGroups: ['events.k8s.io']\n resources:\n - events\n verbs: ['list', 'watch']\n"})}),"\n",(0,l.jsx)(t.p,{children:(0,l.jsx)(t.strong,{children:"Databolt resources with full access"})}),"\n",(0,l.jsx)(t.p,{children:"See the table below for a list of resources, why they're needed, and when they're used."}),"\n",(0,l.jsxs)(t.table,{children:[(0,l.jsx)(t.thead,{children:(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Resource"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Need"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Use"})]})}),(0,l.jsxs)(t.tbody,{children:[(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"serviceaccounts"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Creates ServiceAccounts for pre-install, post-install hooks, OTEL, and main application"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"secrets"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Pre-install hook generates TLS key pairs and stores them as secrets"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation and runtime"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"configmaps"})}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Post-install hook creates ",(0,l.jsx)(t.code,{children:"installation-id ConfigMap"})]}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation and runtime"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"services"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Helm creates Kubernetes services to expose the Databolt API"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"roles"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Creates namespace-scoped roles for hooks and OTEL, created by Helm"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"rolebindings"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Binds ServiceAccounts to roles, created by Helm"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"deployments"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Deploys the main Databolt API application"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation and runtime"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"daemonsets"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Deploys OpenTelemetry Collector DaemonSet"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"replicasets"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Manages by deployments"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation and runtime"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"statefulsets"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"If needed, for stateful components"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"jobs"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Runs pre-install and post-install hooks as Jobs"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"cronjobs"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"If needed, for scheduled tasks"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"ingresses"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"(Optional) Creates Ingress for external access"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"certificates"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"(Optional) Creates cert-manager Certificates for TLS"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"horizontalpodautoscalers"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"(Optional) Creates HPA for auto-scaling"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"poddisruptionbudgets"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"(Optional) Creates PDB for high availability"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"})]})]})]}),"\n",(0,l.jsx)(t.p,{children:(0,l.jsx)(t.strong,{children:"OpenTelemetry monitoring resources with read-only access"})}),"\n",(0,l.jsxs)(t.table,{children:[(0,l.jsx)(t.thead,{children:(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Resource"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Need"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Use"})]})}),(0,l.jsxs)(t.tbody,{children:[(0,l.jsxs)(t.tr,{children:[(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:[(0,l.jsx)(t.code,{children:"pods"}),", ",(0,l.jsx)(t.code,{children:"pods/status"})]}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Monitor pod health and status for observability"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Runtime"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"pods/log"})}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["View pod logs for troubleshooting with ",(0,l.jsx)(t.code,{children:"kubectl"})," logs"]}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Runtime and debugging"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"events"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Collect Kubernetes events for troubleshooting"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Runtime"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:[(0,l.jsx)(t.code,{children:"replicationcontrollers"}),", ",(0,l.jsx)(t.code,{children:"replicationcontrollers/status"})]}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Monitor legacy workload resources"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Runtime"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"resourcequotas"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Monitor namespace resource usage"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Runtime"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"extensions/*"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Monitor workloads via extensions API (legacy)"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Runtime"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"events.k8s.io/events"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Collect events via new events API"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Runtime"})]})]})]}),"\n",(0,l.jsx)(t.admonition,{type:"note",children:(0,l.jsxs)(t.p,{children:["OpenTelemetry monitoring permissions are read-only (",(0,l.jsx)(t.code,{children:"get"}),", ",(0,l.jsx)(t.code,{children:"list"}),", ",(0,l.jsx)(t.code,{children:"watch"}),") and restricted to the target namespace. Helm configures a Role and RoleBinding with these permissions to give OTEL visibility into namespace monitoring resources."]})}),"\n",(0,l.jsx)(t.h3,{id:"cluster-scoped-clusterrole",children:"Cluster-scoped ClusterRole"}),"\n",(0,l.jsx)(t.p,{children:"This ClusterRole targets only cluster-scoped resources, specifically nodes and namespaces. Write permissions are restricted to specific resource names."}),"\n",(0,l.jsx)(t.pre,{children:(0,l.jsx)(t.code,{className:"language-yaml",children:"apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: databolt-installer-cluster\nrules:\n # ClusterRole/ClusterRoleBinding management for hooks - limited to specific names\n - apiGroups: ['rbac.authorization.k8s.io']\n resources:\n - clusterroles\n - clusterrolebindings\n verbs: ['get', 'list', 'create', 'patch', 'update', 'delete']\n resourceNames:\n - c1s-product-pre-install-role\n - c1s-hooks-product-pre-install\n - c1s-product-post-install-role\n - c1s-hooks-product-post-install\n\n # ClusterRole/ClusterRoleBinding management for OpenTelemetry Collector\n # Note: OTel now uses a namespace-scoped Role for most resources\n - apiGroups: ['rbac.authorization.k8s.io']\n resources:\n - clusterroles\n - clusterrolebindings\n verbs: ['get', 'list', 'create', 'patch', 'update', 'delete']\n resourceNames:\n - databolt-opentelemetry-collector\n\n # Allow creating ClusterRoles/ClusterRoleBindings without resourceNames restriction\n # This is needed because Helm creates them before they exist\n - apiGroups: ['rbac.authorization.k8s.io']\n resources:\n - clusterroles\n - clusterrolebindings\n verbs: ['create']\n\n # Namespace management (for creation and labeling)\n - apiGroups: ['']\n resources:\n - namespaces\n verbs: ['get', 'list', 'create', 'patch', 'update']\n\n # Node read access (for post-install cloud detection and OTel monitoring)\n # This MUST be cluster-scoped as nodes are cluster-level resources\n - apiGroups: ['']\n resources:\n - nodes\n - nodes/spec\n - nodes/stats\n verbs: ['get', 'list', 'watch']\n\n # Namespace read access for OTel monitoring\n # This MUST be cluster-scoped as namespaces are cluster-level resources\n - apiGroups: ['']\n resources:\n - namespaces\n - namespaces/status\n verbs: ['get', 'list', 'watch']\n"})}),"\n",(0,l.jsx)(t.p,{children:(0,l.jsx)(t.strong,{children:"Write permissions with limited access"})}),"\n",(0,l.jsxs)(t.table,{children:[(0,l.jsx)(t.thead,{children:(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Resource"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Need"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Use"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Security note"})]})}),(0,l.jsxs)(t.tbody,{children:[(0,l.jsxs)(t.tr,{children:[(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:[(0,l.jsx)(t.code,{children:"clusterroles"})," (specific names)"]}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Create ClusterRoles for pre-install and post-install hooks"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Limited to 5 specific resource names"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:[(0,l.jsx)(t.code,{children:"clusterrolebindings"})," (specific names)"]}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Bind hook ServiceAccounts to ClusterRoles"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Limited to 5 specific resource names"})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:[(0,l.jsx)(t.code,{children:"clusterroles"})," (create only)"]}
1),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Initial creation before resources exist"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:'Only "create" verb, Kubernetes RBAC requirement'})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"namespaces"})}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Create namespace with ",(0,l.jsx)(t.code,{children:"--create-namespace"}),", label for Istio/Sigstore"]}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Installation"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Can't delete namespaces"})]})]})]}),"\n",(0,l.jsx)(t.p,{children:(0,l.jsx)(t.strong,{children:"ClusterScoped read-only permissions"})}),"\n",(0,l.jsx)(t.p,{children:"These permissions are cluster-scoped because they apply to non-namespaced resources:"}),"\n",(0,l.jsxs)(t.table,{children:[(0,l.jsx)(t.thead,{children:(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Resource"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Need"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Scope"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Supports namespace scope"})]})}),(0,l.jsxs)(t.tbody,{children:[(0,l.jsxs)(t.tr,{children:[(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:[(0,l.jsx)(t.code,{children:"nodes"}),", ",(0,l.jsx)(t.code,{children:"nodes/spec"}),", ",(0,l.jsx)(t.code,{children:"nodes/stats"})]}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Read node metadata for cloud provider detection and OTEL metrics"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Cluster"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"No. Nodes are cluster-level resources."})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:[(0,l.jsx)(t.code,{children:"namespaces"}),", ",(0,l.jsx)(t.code,{children:"namespaces/status"})]}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Read namespace metadata for OTEL metrics"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Cluster"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"No. Namespaces are cluster-level resources."})]})]})]}),"\n",(0,l.jsxs)(t.h2,{id:"rolebinding-and-clusterrolebinding",children:[(0,l.jsx)(t.code,{children:"RoleBinding"})," and ",(0,l.jsx)(t.code,{children:"ClusterRoleBinding"})]}),"\n",(0,l.jsx)(t.p,{children:"Bind the user or service account to the namespace-scoped or cluster-scoped roles."}),"\n",(0,l.jsx)(t.pre,{children:(0,l.jsx)(t.code,{className:"language-yaml",children:"---\n# Namespace-scoped RoleBinding for databolt-installer Role\n# This single RoleBinding covers all namespace-scoped permissions\n# (Databolt API + OTel monitoring)\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: databolt-installer-binding\n namespace: databolt\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: databolt-installer\nsubjects:\n - kind: User\n name: <your-username> # Replace with actual username\n apiGroup: rbac.authorization.k8s.io\n # OR for ServiceAccount:\n # - kind: ServiceAccount\n # name: <serviceaccount-name>\n # namespace: databolt\n\n---\n# Cluster-scoped ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: databolt-installer-cluster-binding\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: databolt-installer-cluster\nsubjects:\n - kind: User\n name: <your-username> # Replace with actual username\n apiGroup: rbac.authorization.k8s.io\n # OR for ServiceAccount:\n # - kind: ServiceAccount\n # name: <serviceaccount-name>\n # namespace: databolt\n"})}),"\n",(0,l.jsx)(t.h2,{id:"customer-managed-vs-helm-managed-rbac",children:"Customer-managed vs. Helm-managed RBAC"}),"\n",(0,l.jsx)(t.p,{children:"RBAC responsibilities are divided between pre-installation administrative requirements and resources managed directly by Helm."}),"\n",(0,l.jsx)(t.h3,{id:"customer-managed-prerequisites",children:"Customer-managed prerequisites"}),"\n",(0,l.jsx)(t.p,{children:"Apply the following RBAC resources, manually or via the setup script, before installing the Helm chart:"}),"\n",(0,l.jsx)(t.pre,{children:(0,l.jsx)(t.code,{className:"language-yaml",children:"# 1. Role (namespace-scoped)\nRole: databolt-installer\n - Databolt API resources (full access)\n - OTel monitoring resources (read-only)\n - Includes roles/rolebindings permissions (to allow Helm to create OTel RBAC)\n\n# 2. RoleBinding (namespace-scoped)\nRoleBinding: databolt-installer-binding\n - Binds databolt-installer Role to customer user\n\n# 3. ClusterRole (cluster-scoped)\nClusterRole: databolt-installer-cluster\n - Nodes, namespaces (cluster-level resources)\n - ClusterRoles/ClusterRoleBindings (limited names)\n\n# 4. ClusterRoleBinding (cluster-scoped)\nClusterRoleBinding: databolt-installer-cluster-binding\n - Binds databolt-installer-cluster ClusterRole to customer user\n"})}),"\n",(0,l.jsx)(t.h3,{id:"helm-managed-resources",children:"Helm-managed resources"}),"\n",(0,l.jsx)(t.p,{children:"During chart deployment, Helm automatically creates the following RBAC resources:"}),"\n",(0,l.jsx)(t.pre,{children:(0,l.jsx)(t.code,{className:"language-yaml",children:"# 1. OTel Role (namespace-scoped) - for OTel ServiceAccount\nRole: databolt-opentelemetry-collector\n - Pods, services, deployments, etc. (read-only)\n - Scoped to databolt namespace only\n\n# 2. OTel RoleBinding (namespace-scoped)\nRoleBinding: databolt-opentelemetry-collector\n - Binds databolt-opentelemetry-collector Role to OTel ServiceAccount\n\n# 3. OTel ClusterRole (cluster-scoped) - for OTel ServiceAccount\nClusterRole: databolt-opentelemetry-collector\n - Nodes, namespaces (read-only)\n\n# 4. OTel ClusterRoleBinding (cluster-scoped)\nClusterRoleBinding: databolt-opentelemetry-collector\n - Binds databolt-opentelemetry-collector ClusterRole to OTel ServiceAccount\n\n# 5. OTel ServiceAccount\nServiceAccount: databolt-opentelemetry-collector\n - Used by OTel DaemonSet pods at runtime\n\n# 6. Pre-install job cluster role and cluster role binding\nClusterRole: c1s-product-pre-install-role\nClusterRoleBinding: c1s-hooks-product-pre-install\n -\n# 7. Post-install job cluster role and cluster role binding\vClusterRole: c1s-product-post-install-role\nClusterRoleBinding: c1s-hooks-product-post-install\n\n# 8. Pre-install job role and role binding\nRole: {{- .Release.Name -}}-pre-install-role\nRoleBinding: {{- .Release.Name -}}-pre-install-binding\n\n# 9. Post-install job role and role binding\nRole: {{- .Release.Name -}}-post-install-role\nRoleBinding: {{- .Release.Name -}}-post-install-binding\n\n# 10. service accounts creations for pre-install post-install jobs and databolt-api deployment\n"})}),"\n",(0,l.jsx)(t.h2,{id:"create-a-preflight-configuration-file",children:"Create a preflight configuration file"}),"\n",(0,l.jsxs)(t.p,{children:["Start by creating a configuration file to pass to your ",(0,l.jsx)(t.em,{children:"preflight.sh"}),"."]}),"\n",(0,l.jsx)(t.admonition,{type:"info",children:(0,l.jsx)(t.p,{children:"If you copy the command from the UI, note that your credentials unmask once you paste the command to your terminal."})}),"\n",(0,l.jsxs)(t.ol,{children:["\n",(0,l.jsx)(t.li,{children:"Open a terminal window."}),"\n",(0,l.jsxs)(t.li,{children:["Create a file named ",(0,l.jsx)(t.em,{children:"preflight.conf"}),"."]}),"\n",(0,l.jsx)(t.li,{children:"Copy and paste the preflight code from the self-service installer into your file."}),"\n"]}),"\n",(0,l.jsx)(t.pre,{children:(0,l.jsx)(t.code,{className:"language-shell",children:'REGISTRY_URI_PREFIX="oci://"\nDEFAULT_REGISTRY_HOST="registry.capitalonesoftware.com"\nDEFAULT_CHART_PATH="/manchester-dtc-prod/c1s-preflight"\n\nHELM_CHART_NAME="c1s-preflight"\nHELM_RELEASE_NAME="c1s-preflight"\n\n# Container image (override when mirroring artifacts)\nIMAGE_REPOSITORY="artifacts.capitalonesoftware.com/proxy/manchester-dtc-prod/442042517452.dkr.ecr.us-east-1.amazonaws.com/c1s-preflight-image"\nIMAGE_TAG="1.4.13"\n\n# Credentials (omit for --job-mode)\nHELM_USER_NAME="*******"\nHELM_PASSWORD="*******"\n\n# Network endpoints tested for reachability\nREQUIRED_ENDPOINTS=(\n "https://artifacts.capitalonesoftware.com"\n "https://registry.capitalonesoftware.com"\n "https://api.capitalonesoftware.com"\n "https://replicated.app"\n)\n'})}),"\n",(0,l.jsx)(t.h2,{id:"create-the-preflight-script",children:"Create the preflight script"}),"\n",(0,l.jsx)(t.p,{children:"To get started, confirm you have access to your designated Kubernetes cluster, and follow the steps below."}),"\n",(0,l.jsx)(t.admonition,{type:"info",children:(0,l.jsxs)(t.p,{children:["If preferred, you can also download the preflight checks script from the ",(0,l.jsx)(t.a,{href:"https://it.capitalonesoftware.com/installation/download-center",children:"Capital One Software Download center"}),"."]})}),"\n",(0,l.jsxs)(t.ol,{children:["\n",(0,l.jsx)(t.li,{children:"Open a terminal window."}),"\n",(0,l.jsxs)(t.li,{children:["Create a file named ",(0,l.jsx)(t.em,{children:"preflight.sh"}),"."]}),"\n",(0,l.jsx)(t.li,{children:"Copy and paste the preflight code from the self-service installer into your file."}),"\n"]}),"\n",(0,l.jsx)(t.h2,{id:"execute-the-preflight-script",children:"Execute the preflight script"}),"\n",(0,l.jsx)(t.p,{children:"Run the following command to execute your preflight check. Replace the username and password with your specific credentials."}),"\n",(0,l.jsx)(t.admonition,{type:"note",children:(0,l.jsxs)(t.p,{children:["The ",(0,l.jsx)(t.em,{children:"preflight.sh"})," script only checks for enabled components. If the component isn't enabled, the preflight script skips the respective test."]})}),"\n",(0,l.jsx)(t.pre,{children:(0,l.jsx)(t.code,{className:"language-shell",children:"chmod +x preflight.sh && ./preflight.sh <username> <password>\n"})}),"\n",(0,l.jsx)(t.p,{children:"Your terminal returns a pass or fail status:"}),"\n",(0,l.jsxs)(t.p,{children:[(0,l.jsx)(t.strong,{children:"Pass"}),": Requirements are fully met",(0,l.jsx)(t.br,{}),"\n",(0,l.jsx)(t.strong,{children:"Fail"}),": Critical requirement not met"]}),"\n",(0,l.jsx)(t.p,{children:"If there is a failure when running the script, address the failed requirement and run the script again."}),"\n",(0,l.jsxs)(t.p,{children:["Once all checks pass, you can ",(0,l.jsx)(t.a,{href:"/docs/databolt/helm-platform-chart-install",children:"install the required components"})," for Databolt by clicking ",(0,l.jsx)(t.strong,{children:"Continue"}),"."]}),"\n",(0,l.jsx)(t.h2,{id:"preflight-checks-reference",children:"Preflight checks reference"}),"\n",(0,l.jsx)(t.p,{children:"Refer to the table below for the full series of tests the preflight script performs."}),"\n",(0,l.jsxs)(t.table,{children:[(0,l.jsx)(t.thead,{children:(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Test name"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Description"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Execution location"}),(0,l.jsx)(t.th,{style:{textAlign:"left"},children:"Notes"})]})}),(0,l.jsxs)(t.tbody,{children:[(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_dependencies"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Verifies installation of required CLI tools"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"LOCAL"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Runs where the script executes.",(0,l.jsx)("br",{})," Checks for ",(0,l.jsx)(t.strong,{children:"kubectl"})," ",(0,l.jsx)(t.code,{children:"v1.32.0+"}),", ",(0,l.jsx)(t.strong,{children:"jq"})," ",(0,l.jsx)(t.code,{children:"v1.7+"}),", ",(0,l.jsx)(t.strong,{children:"Helm"})," ",(0,l.jsx)(t.code,{children:"v3.15.0+"})," and < ",(0,l.jsx)(t.code,{children:"4.0.X"}),",",(0,l.jsx)("br",{})," and ",(0,l.jsx)(t.strong,{children:"curl"})," ",(0,l.jsx)(t.code,{children:"v8.0.0+"}),".",(0,l.jsx)("br",{})," Manually verify by running version commands for each tool."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_docker_runtime"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Confirms Docker installation"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"LOCAL"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Checks for Docker where the script executes.",(0,l.jsx)("br",{})," Verify with ",(0,l.jsx)(t.code,{children:"docker --version"})," to confirm ",(0,l.jsx)("br",{})," Docker installation."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_k8s_version"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Validates Kubernetes cluster version"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"BOTH"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Checks the Kubernetes API server version. ",(0,l.jsx)("br",{})," Cluster version should be ",(0,l.jsx)(t.code,{children:"\u22651.3"}),". Use ",(0,l.jsx)("br",{})," ",(0,l.jsx)(t.code,{children:"kubectl version --short"})," ",(0,l.jsx)("br",{})," to validate."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_k8s_authentication"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Verifies authentication to Kubernetes cluster"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"LOCAL"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Tests authentication to the cluster. ",(0,l.jsx)("br",{})," Run ",(0,l.jsx)(t.code,{children:"kubectl get nodes"})," to verify you can ",(0,l.jsx)("br",{}),"connect and authenticate with the cluster."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_managed_provider"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Identifies cloud-managed Kubernetes provider"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"CLUSTER"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Examines node labels to identify cloud provider. ",(0,l.jsx)("br",{}),"Looks for EKS or AKS specific node labels. ",(0,l.jsx)("br",{}),"Use ",(0,l.jsx)(t.code,{children:"kubectl get nodes --show-labels"})," to check ",(0,l.jsx)("br",{})," for provider-specific labels."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_supported_distribution"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Verifies cluster distribution compatibility"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"CLUSTER"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Determines if running on AKS or EKS by ",(0,l.jsx)("br",{}),"examining node labels and annotations. ",(0,l.jsx)("br",{}),"Use ",(0,l.jsx)(t.code,{children:"kubectl get nodes --show-labels"})," ",(0,l.jsx)("br",{}),"for provider-specific identifiers."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_node_architecture"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Validates node CPU architecture"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"CLUSTER"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"}
1,children:["Checks if nodes are running on supported CPU architecture ",(0,l.jsx)("br",{})," (amd64). ",(0,l.jsx)("br",{}),"Use ",(0,l.jsx)(t.code,{children:"kubectl get nodes -o"})," ",(0,l.jsx)("br",{}),(0,l.jsx)(t.code,{children:"custom-columns=NAME:"}),(0,l.jsx)("br",{}),(0,l.jsx)(t.code,{children:".metadata.name,ARCH:"}),(0,l.jsx)("br",{}),(0,l.jsx)(t.code,{children:".status.nodeInfo.architecture"})," to verify."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_node_count"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Confirms minimum cluster size"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"CLUSTER"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Counts worker nodes in the cluster. ",(0,l.jsx)("br",{}),"Requires at least 3 worker nodes. Use ",(0,l.jsx)(t.code,{children:"kubectl get nodes"})," to count manually."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_node_resources"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Validates node resource capacity"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"CLUSTER"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Examines allocatable resources on cluster nodes. ",(0,l.jsx)("br",{}),"Requires at least 1 node with ",(0,l.jsx)(t.code,{children:">4 CPUs"})," and ",(0,l.jsx)(t.code,{children:">8 GB RAM"}),". ",(0,l.jsx)("br",{}),"Use ",(0,l.jsx)(t.code,{children:"kubectl describe nodes"})," and check the Allocatable section for each node."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_aws_instance_types"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Validates EC2 instance types (EKS only)"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"CLUSTER"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Checks instance types when running on AWS EKS. Requires minimum instance specs of ",(0,l.jsx)(t.code,{children:"c5.2xlarge"})," or equivalent. Use ",(0,l.jsx)(t.code,{children:"kubectl get nodes -o wide"})," and cross-reference with AWS console."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_product_taint"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Verifies node taint configuration"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"CLUSTER"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Checks for specific taints on cluster nodes. Looks for nodes with ",(0,l.jsx)(t.code,{children:"capitalonesoftware.com/"}),(0,l.jsx)("br",{}),(0,l.jsx)(t.code,{children:"tier=databolt:NoExecute"})," taint. Use ",(0,l.jsx)(t.code,{children:"kubectl get nodes -o custom-columns=NAME:"}),(0,l.jsx)("br",{}),(0,l.jsx)(t.code,{children:".metadata.name,TAINTS:.spec.taints"})," to verify."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_endpoint_reachability"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Tests network connectivity to critical endpoints"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"LOCAL"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Tests connectivity from where the script executes to the following addresses: ",(0,l.jsx)(t.a,{href:"https://registry.capitalonesoftware.com/",children:"https://registry.capitalonesoftware.com"}),", ",(0,l.jsx)(t.a,{href:"https://artifacts.capitalonesoftware.com/",children:"https://artifacts.capitalonesoftware.com"}),", ",(0,l.jsx)(t.a,{href:"https://api.capitalonesoftware.com/",children:"https://api.capitalonesoftware.com"})," ",(0,l.jsx)(t.a,{href:"https://replicated.app/",children:"https://replicated.app"}),". ",(0,l.jsx)("br",{}),"Use ",(0,l.jsx)(t.code,{children:"curl -kL https://[endpoint]"})," to test manually."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_registry_login"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Validates registry access"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"LOCAL"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Tests registry sign in from where the script executes. Verifies successful sign in to registry.capitalonesoftware.com with replicated credentials. Use ",(0,l.jsx)(t.code,{children:"helm registry login registry.capitalonesoftware.com --username [username] --password [password]"})," with your credentials. Use the replicated license ID as the password."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_chart_pull"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Verifies chart retrieval capability"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"LOCAL"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Tests chart pull from where the script executes. Verifies ability to pull Helm chart from OCI registry. Use ",(0,l.jsx)(t.code,{children:"helm pull oci://registry.capitalonesoftware.com/"}),(0,l.jsx)("br",{}),(0,l.jsx)(t.code,{children:"manchester-dtc-prod/c1s-preflight"})," after signing in."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_chart_install"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Tests chart deployment"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"CLUSTER"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"},children:["Tests installation into the cluster. Verifies successful dry-run and installation of c1s-preflight chart. Use ",(0,l.jsx)(t.code,{children:"helm install preflight-test oci://registry.capitalonesoftware.com/"}),(0,l.jsx)("br",{}),(0,l.jsx)(t.code,{children:"manchester-dtc-prod/c1s-preflight"}),(0,l.jsx)("br",{}),(0,l.jsx)(t.code,{children:"-n preflight-system --dry-run"})," to test without actual installation. This creates and runs the preflight job on the cluster."]})]}),(0,l.jsxs)(t.tr,{children:[(0,l.jsx)(t.td,{style:{textAlign:"left"},children:(0,l.jsx)(t.code,{children:"check_preflight_job_output"})}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"Verifies preflight job execution"}),(0,l.jsx)(t.td,{style:{textAlign:"left"},children:"CLUSTER"}),(0,l.jsxs)(t.td,{style:{textAlign:"left"}
1,children:["Checks the output of the preflight job. Verifies successful execution of the preflight checks job. Use ",(0,l.jsx)(t.code,{children:"kubectl get jobs -n c1s-preflight-system"})," and ",(0,l.jsx)(t.code,{children:"kubectl logs job/c1s-preflight-checks -n c1s-preflight-system"}),"."]})]})]})]})]})}function h(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,l.jsx)(t,{...e,children:(0,l.jsx)(a,{...e})}):a(e)}},8453(e,t,s){s.d(t,{R:()=>i,x:()=>c});var n=s(6540);const l={},r=n.createContext(l);function i(e){const t=n.useContext(r);return n.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(l):e.components||l:i(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.