tare precheck

Validate the live cluster and every container image an Agent Router install
or upgrade needs before running the deploy.

Precheck verifies Helm and kubectl, API-server reachability, the release's
Kubernetes floor and ceiling, the upgrade path from the installed release
(supported sources, required intermediate releases, downgrades), values the
target release removed, rollout capacity (ResourceQuota and schedulable
nodes), GitOps (ArgoCD/Flux) ownership, management-plane egress and
NetworkPolicy, service-mesh compatibility, and image
repository/tag/digest/platform completeness. Each result is a hard block or a
constraint, producing an overall proceed / proceed-with-constraints / blocked
verdict.

This is the same check 'tare install' and 'tare upgrade' run automatically;
run it standalone to validate a registry mirror after an image sync, or to
debug an install that failed pulling images.

Examples:
  # Validate the default Tetrate registry
  tare precheck identity.json

  # Validate a private mirror you synced images into
  tare precheck identity.json --image-registry acme.registry.com

  # Require multiple platforms
  tare precheck identity.json --platform linux/amd64 --platform linux/arm64

Usage:
  tare precheck <identity-file> [flags]

Flags:
      --argocd-namespace string      Namespace where ArgoCD Applications live, for the GitOps-ownership check. Set to empty to disable ArgoCD detection. (default "argocd")
      --dataplane-namespace string   Dataplane namespace to inspect. (default "tars-dataplane")
      --image-registry string        Registry to validate. Defaults to REGISTRY_URL env, then registry.tetrate.ai.
      --platform stringArray         Required platform(s) every image must provide, repeatable (e.g. --platform linux/amd64). Default: linux/amd64.
      --progress string              Progress display: auto|tty|plain|none. (default "auto")
      --release-name string          Helm release name to inspect. (default "tars")
      --system-namespace string      System namespace to inspect. (default "tars-system")

Global Flags:
  -q, --quiet     Suppress progress output; only errors and the final summary go to stderr
  -v, --verbose   Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr