Skip to content

cloudtaser-cli target preflight

Read the target's nodes, installed agents, namespace PSA labels and system pods. Report active LSM/BPF, BTF, cgroup v2, kubelet seccomp root, CNI/NetworkPolicy support, NodeLocal DNSCache and runtime compatibility with evidence and remedies.

Recommend values-gke-cos.yaml, values-k3s.yaml, or unsupported: . Missing host observations require recent --node-evidence from approved node access. An overlay recommendation is a platform candidate, not enforcement certification. No cluster writes, probe pods, exec, secret reads or kubeconfig changes. Exit 0: candidate overlay; 1: observed incompatibility; 2: prerequisites unverified.

Usage

cloudtaser-cli target preflight [flags]

Examples

cloudtaser-cli target preflight --namespace payments --namespace orders
  cloudtaser-cli target preflight --node-evidence nodes.json --json

Flags

Flag Type Default Required Description
--agent-namespace string cloudtaser-system no installed agent namespace; always included in PSA checks
--cluster-timeout duration 1m0s no maximum API observation time
--context string (empty) no kubeconfig context (default current context)
--help, -h bool false no help for preflight
--json bool false no output JSON
--kubeconfig string (empty) no path to kubeconfig file
--namespace, -n stringArray [] no target workload namespace to check PSA (repeatable)
--node-evidence string (empty) no recent JSON from assess node-evidence, bound to Node UID and kernel
--system-namespace string kube-system no namespace to inspect for CNI and NodeLocal DNSCache pods
--timeout duration 20m0s no maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands