check

kix check evaluates a cluster and reports the result of each validation step in a table. It does not contact a cluster. Use it as the local and CI gate before a deploy.

This page is hand-maintained. Check cli/kix-cli/src/cli.rs and cli/kix-cli/src/commands/check.rs when in doubt.

Synopsis

kix check <CLUSTER> [--sarif] [-o text|json|yaml] [--flake <FLAKE>]
          [--override-input <INPUT> <URL>]... [--no-cache]

Argument or flag	Default	Meaning
<CLUSTER>		Cluster name to evaluate.
--sarif	Off	Print SARIF 2.1.0 JSON instead of the table. Overrides -o.
-o, --output	text	text prints a TOOL, RESULT, DETAILS table. json and yaml print an array of { tool, result, details }.
--flake <FLAKE>	.	Flake to evaluate.
--override-input <INPUT> <URL>	None	Override a flake input for the evaluation. Repeatable.
--no-cache	Off	Evaluate from Nix instead of reading the eval cache.

Steps

Tool	What it reports
eval	pass with the number of manifests, or fail with the evaluation error. Evaluation runs the constructor validators, the cross-resource checks, and every error-severity scorecard rule, so a failure in any of them appears here.
scorecard	The counts of error, warning, and info findings. fail when there is at least one error, skip when the cluster does not enable the scorecard.

When eval fails, the scorecard step does not run.

kix check runs constructor validators, cross-resource checks, and scorecard rules. It does not validate rendered manifests against external Kubernetes OpenAPI schemas or check for deprecated API versions.

SARIF output

With --sarif, each scorecard finding becomes a SARIF result with its rule ID, level (error, warning, or note), message, and a logical location of the form namespace/instance/resource. A cluster with no findings, or with the scorecard disabled, produces an empty run.

An error-severity finding stops evaluation, so there is no report to convert. Kix then writes the evaluation failure as one error result. Its rule ID is scorecard/<rule> when the error message names a scorecard rule, and kix/eval-failure otherwise.

Examples

❱ kix check demo

❱ kix check demo --sarif > kix-results.sarif

Exit status

Code	Meaning
0	No step reported fail
1	A step reported fail, or the cluster was not found. With --sarif, a failed step exits 1 after printing the SARIF document, whereas an unknown cluster errors on stderr before printing any SARIF.

Reference

See Finding schema for the fields each scorecard finding carries.

Use it in a task

See Run kix check --sarif in CI for a CI job that uploads the SARIF file.