Built-in add-ons
Plan curated add-ons from immutable artifacts, run preflight, install through the agent, and require semantic health evidence.
Exact release scope. This page documents the reviewed v0.0.1 source at fcc5871. Check release status before enabling a gated capability.
v0.0.1 catalog
| Category | Catalog entries |
|---|---|
| Delivery and certificates | Argo CD 2.13.1 · Flux 2.4.0 · cert-manager 1.16.2 |
| Policy | OPA Gatekeeper 3.17.1 · Kyverno 1.12.6 |
| Ingress | ingress-nginx 1.11.3 · Traefik 3.2.1 |
| Observability | Prometheus 2.55.1 · Grafana 11.3.1 · Loki 3.2.1 · OpenSearch 2.17.1 |
| Registry, storage, recovery | Harbor 2.12.2 · Rook Ceph 1.15.7 · Velero 1.15.0 |
| Generic installers | Helm · manifest · operator |
These are catalog baselines, not automatic production approval. The exact chart, manifest, bundle, tool, and image digests in the generated artifact lock are authoritative.
Installation workflow
- 01
Select and configure
Choose the catalog entry, namespace, approved options, dependencies, storage, DNS, and secret references.
- 02
Resolve immutable artifacts
Create a plan with digest-pinned images, chart/bundle locks, tool versions, and registry promotion evidence.
- 03
Run preflight
Validate cluster version, conflicts, capacity, CRDs, storage classes, DNS, ingress, registry access, and required features.
- 04
Install
The agent acquires and verifies artifacts before namespace/workload mutation, then applies the ordered plan.
- 05
Run health gates
Require resource readiness and, where defined, a semantic smoke test.
- 06
Accept or repair
Record evidence, expose dashboard posture only when healthy, or repair the failed gate and retry the eligible plan.
Conflicts and prerequisites
| Add-on | Important rule |
|---|---|
| ingress-nginx / Traefik | Catalog conflict: do not install both as the managed ingress controller without an approved coexistence design. |
| Rook Ceph | Requires the storage-devices capability and a reviewed disk ownership/destruction plan. |
| Velero | Requires an object-storage profile; backup/restore smoke is meaningful only with an available BackupStorageLocation. |
| Harbor | Requires registry credentials through a typed SecretRef and push/pull health evidence. |
| OpenSearch | Role-split releases have explicit cluster-manager/data/optional ingest and Dashboards readiness checks. |
Semantic health gates
Health gates go beyond “pods are running.” Examples include Harbor push/pull, Velero backup/restore, Rook Ceph health and PVC bind, Prometheus target discovery, cert-manager request signing, and policy-engine admission denial.
| Error code | Meaning | Next action |
|---|---|---|
CLUSTER_ADDON_HEALTH_GATE_CHECKER_MISSING | The plan requested an unsupported semantic checker. | Upgrade the control plane or change the approved policy. |
CLUSTER_ADDON_HEALTH_GATE_SECRET_REF_REQUIRED | A required secret reference is absent. | Provide the typed SecretRef; never inline credentials. |
CLUSTER_ADDON_HEALTH_GATE_FAILED | The agent ran the gate and it failed. | Inspect redacted command evidence and fix the underlying service. |
Upgrade and uninstall status
When an add-on must be removed or upgraded during evaluation, follow an explicitly approved add-on-specific runbook and retain reconciliation evidence. Do not patch chart-owned workloads manually and then assume ClusterPilot state is current.