How-to guide Operate a cluster

Export audit-preserving YAML

Use the audit export mode when the exported manifests need to retain the Kix metadata that connects resources to packages, dependencies, and an activation. This export is intended as evidence or as input to an audit process.

Create the audit export

Pass --for audit and choose an output directory:

kix-examples/

❱ kix export how-to-application --for audit --out ./audit-export
Building cluster 'how-to-application'...
  Evaluating cluster 'how-to-application'...
  Reading package index...
  Loading store graph...
  Reading 4 packages...
  Computing cross-package dependencies...

  Exported 17 resources to ./audit-export (audit (kix provenance preserved))

Kix evaluates and builds the cluster locally. The export includes every rendered resource, including Activation and PackageInstance custom resources, and preserves its kix.run/* annotations.

Inspect the provenance metadata

Exported manifests preserve their kix.run/identity-hash, kix.run/package, and kix.run/package-namespace annotations (plus kix.run/depends-on on resources that have dependencies), which record resource identity, package membership, and dependency edges. The export also writes Activation and PackageInstance manifests into the directory tree, with the Activation resource under _cluster/ serving as the root of the rendered deployment graph:

kix-examples/

❱ find ./audit-export -name 'Activation-*.yaml' -o -name 'PackageInstance-*.yaml'
./audit-export/how-to-app/PackageInstance-production.yaml
./audit-export/how-to-app/PackageInstance-preview.yaml
./audit-export/kube-system/PackageInstance-platform-dns.yaml
./audit-export/kube-system/PackageInstance-platform-storage.yaml
./audit-export/_cluster/Activation-how-to-application-6rhi3wpk9iml.yaml

Keep audit and handoff exports separate

Do not use the audit export when another deployment system needs ordinary application manifests. Its internal custom resources and Kix annotations are part of the evidence being preserved.

Use the default mode for that workflow:

kix-examples/

❱ kix export how-to-application --out ./handoff