Troubleshoot Clawdlinux Operator

Inspect Resource State

kubectl -n agentic-system get deployments,pods
kubectl -n agentic-system get agentworkloads
kubectl -n agentic-system describe agentworkload <name>
kubectl -n agentic-system get events --sort-by=.lastTimestamp
kubectl -n agentic-system get deployments --show-labels
kubectl -n agentic-system logs deployment/<operator-deployment>

Replace placeholders with actual names. Use the workload's namespace when it differs from agentic-system.

Workload Stuck Or Failed

Check provider Secret names and keys, endpoints, model mappings, and spec.orchestration.type. Check CLAWDLINUX_AGENT_IMAGE for pod and kagent adapters. Confirm Argo or kagent is installed when selected. Inspect status.conditions, status.argoWorkflow, and status.argoPhase.

Tenant Stuck In Provisioning

The Tenant controller copies <provider>-token Secrets from agentic-system into the tenant namespace. Check those Secrets and operator permissions for namespaces, ServiceAccounts, Roles, RoleBindings, Secrets, and ResourceQuotas.

Policy Denied Or Approval Pending

Inspect status.proposedActions and status.conditions for PolicyDenied or PendingApproval. opaPolicy selects the legacy in-process Go evaluator, not Rego execution. Direct MCP approval continuation is not connected end to end.

Cost Shows Zero

The default NoOpCostReporter records nothing. AGENTIC_COST_TRACKING=memory enables local-evaluation reporting but resets on restart. Do not use it for billing.

gVisor Pod Does Not Start

kubectl get runtimeclass gvisor
kubectl -n <namespace> describe pod <pod>

Nodes need runsc and a matching RuntimeClass. Strict admission also requires a Ready node capable of running that class. Without a scheduling selector, confirm the node readiness label described in configuration.

NetworkPolicy Does Not Block Traffic

Confirm the policy namespace, matching pod labels, and an enforcing CNI. For Cilium FQDN policy, confirm Cilium and explicit chart enablement. Policy-object presence alone does not prove packet enforcement.

Audit Output Missing

audit-verify supports JSONL; its ClickHouse source adapter is a stub. Automatic complete per-run signed evidence is not connected. Prior-run fixtures do not prove capture from your current workload. See evidence boundaries.