Guided Ratify install mission in KubeStellar Console

[clubanderson]

We built a guided install mission for Ratify inside KubeStellar Console, a standalone Kubernetes dashboard (unrelated to legacy kubestellar/kubestellar, kubeflex, or OCM — zero shared code).

Open the Ratify install mission

What the mission does

The mission runs against your live cluster via kubeconfig. Each step:

1. Pre-flight — checks prerequisites (helmfile, kubectl, cluster access)
2. Commands — deploys Gatekeeper + Ratify + constraints in one shot via helmfile sync referencing your helmfile.yaml at v1.4.0, deploying to gatekeeper-system
3. Validation — verifies pods are running, then tests with signed (notary-image:signed) and unsigned (notary-image:unsigned) images to confirm admission enforcement
4. Troubleshooting — on failure, reads pod logs, events, and resource status from your cluster and suggests fixes
5. Rollback — includes helmfile destroy to clean up

Works as read-only documentation too — no cluster connection required to browse.

Architecture

graph LR
    A["KubeStellar Console"] --> B["30+ Dashboards<br/>150+ Monitoring Cards"]
    A --> M["Marketplace<br/>(console-marketplace)"]
    A --> D["AI Mission Explorer"]
    D --> E["console-kb"]
    E --> F["186 Install Missions<br/>67 Solution Missions"]
    A --> C["AI Recommendations"]
    A --> H["kc-agent → Codex, Copilot,<br/>Claude CLI, Kube API, MCP"]
    click A href "https://console.kubestellar.io?utm_source=github&utm_medium=issue&utm_campaign=cncf_outreach&utm_term=ratify" _blank
    click M href "https://github.com/kubestellar/console-marketplace?utm_source=github&utm_medium=issue&utm_campaign=cncf_outreach&utm_term=ratify" _blank
    click E href "https://github.com/kubestellar/console-kb/blob/master/fixes/cncf-install/install-ratify.json?utm_source=github&utm_medium=issue&utm_campaign=cncf_outreach&utm_term=ratify" _blank
    click F href "https://console.kubestellar.io/missions/install-ratify?utm_source=github&utm_medium=issue&utm_campaign=cncf_outreach&utm_term=ratify" _blank
    click H href "https://github.com/kubestellar/console/tree/main/cmd/kc-agent?utm_source=github&utm_medium=issue&utm_campaign=cncf_outreach&utm_term=ratify" _blank

Loading

• console-kb — YAML-based knowledge base defining each mission's steps, commands, and validation checks (Ratify installer definition)
• console-marketplace — community-contributed monitoring cards per CNCF project (github.com/kubestellar/console-marketplace)
• kc-agent — bridges coding agents (Codex, Copilot, Claude CLI) to Kube API and MCP servers (kubestellar-ops, kubestellar-deploy) for automated cluster operations

Install

Local (connects to your current kubeconfig context):

curl -sSL https://raw.githubusercontent.com/kubestellar/console/main/start.sh | bash

With GitHub OAuth:

export GITHUB_CLIENT_ID=<your-client-id>
export GITHUB_CLIENT_SECRET=<your-client-secret>
curl -sSL https://raw.githubusercontent.com/kubestellar/console/main/start.sh | bash

Deploy into a cluster:

curl -sSL https://raw.githubusercontent.com/kubestellar/console/main/deploy.sh | bash

---

Mission definitions are open source — PRs to improve the Ratify mission welcome at install-ratify.json. Feel free to close if not relevant.

[yizha1]

Thanks @clubanderson for sharing your integration with Ratify. It's great to see the adoption and the KubeStellar story. Would you mind creating a PR to update the adopter file, which wil be showed on Notary Project adopter page.

[clubanderson]

@yizha1 sure - would you mind updating our adopter file? It will help us with incubation.

[FeynmanZhou]

@clubanderson It sounds good to update the adopter file on both sides as Ratify and KubeStellar work with each other. I can open a PR to add it to adopter file

[clubanderson]

fantastic - Thank you - I will do the same

[clubanderson]

@FeynmanZhou @yizha1 all done - notaryproject/notaryproject.dev#445

looking forward to your PR in KubeStellar adopter file - Thank you

[clubanderson]

@FeynmanZhou @yizha1 ptal

[clubanderson]

@FeynmanZhou @yizha1 — friendly follow-up on this. Our PR adding KubeStellar to the Notary Project adopters page was merged (notaryproject.dev#445) — thank you for that.

When you get a chance, we'd still love the reciprocal PR to our ADOPTERS.md. Happy to open it ourselves if that's easier — just say the word.

We just got back from KubeCon EU where the console received a very positive response. The feature generating the most excitement is Mission Control — operators can compose multi-project solutions and deploy them across clusters in a phased rollout. Ratify fits well as a supply chain verification step alongside projects like Harbor and Sigstore — the dependency connections and phased deployment ordering are handled automatically.

[yizha1]

@clubanderson here it is kubestellar/console#3689, I noticed that the link you added to the Notary Project adoption page is broken.

[clubanderson]

@yizha1 Thank you for the adopter PR — merged! 🎉

I just tested the link and it loads correctly in the browser: https://console.kubestellar.io/missions/install-ratify

It's a single-page app so the content renders client-side — crawlers/bots that don't execute JavaScript may report it as empty, but it works fine for users. Let me know if you're seeing something different and I'll investigate further.

if you click import - it brings you to the full console with instructions on how to use the installer

[yizha1]

Thanks @clubanderson. 🤝

The link works for me now.