cloudtaser-cli assess¶
Read-only assessment using Kubernetes node metadata and installed agents. Agent observations take precedence over the versioned platform table. Labels are expectations, never feature or confidential-computing proof. UNKNOWN never counts as pass. Confidential-compute labels are hints; attestation is not verified.
Exit codes: 0 all assessable pools meet --min-tier; 1 observed below; 2 could not assess. Per-node platform checks report PASS/FAIL/UNKNOWN with remedies separately from the kernel tier. Missing host evidence stays UNKNOWN; supply --node-evidence from approved node access when needed. No writes, privileged pods, workload exec or secret reads.
Usage¶
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--all-contexts |
bool | false |
no | assess every kubeconfig context |
--cluster-timeout |
duration | 1m0s |
no | maximum API observation time per cluster |
--component |
string | (empty) |
no | also check a component's ENV-REQUIRE / ENV-COMPAT requirements |
--context |
stringArray | [] |
no | assess a named context (repeatable; default current context) |
--file |
string | (empty) |
no | local requirements.json for the component |
--help, -h |
bool | false |
no | help for assess |
--json |
bool | false |
no | write the versioned JSON assessment |
--kubeconfig |
string | (empty) |
no | path to kubeconfig file |
--min-tier |
int | 2 |
no | required kernel tier (1 strict; 2 accepts Tier 1 or Tier 2) |
--namespace, -n |
string | cloudtaser-system |
no | namespace containing the agent and target of the PSA check |
--node-evidence |
string | (empty) |
no | JSON from assess node-evidence, collected on each target host within 15 minutes |
--secretstore-address |
string | (empty) |
no | secret store HTTPS address for optional read-only component checks |
--timeout |
duration | 20m0s |
no | maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env) |
--verbose |
bool | false |
no | include per-node observations and approved node-check commands |
--version |
string | (empty) |
no | component release version |