malmok — diagnostic code registry
Generated from internal/codes/, which is the single source of truth.
Editing this file has no effect; change the Go definitions and re-run
go generate ./internal/codes/.
Codes are stable identifiers. They are never translated and never reused:
a retired number stays retired, because audit reports and customer tickets
outlive releases.
Summary
| Family |
Codes |
block |
degrade |
warn |
info |
PF |
70 |
37 |
11 |
18 |
4 |
PV |
8 |
4 |
— |
3 |
1 |
UP |
8 |
6 |
— |
1 |
1 |
EX |
9 |
8 |
— |
1 |
— |
MC |
42 |
— |
— |
— |
— |
DG |
5 |
— |
— |
— |
— |
Total: 142 codes.
PF · Preflight
Source: internal/codes/preflight.go
Base
| ID |
Severity |
Check |
Default message |
PF-101 |
block |
OS family and version are supported |
Unsupported OS family or version; no validated profile covers this distribution |
PF-102 |
block |
CPU architecture is amd64 or arm64 |
Unsupported CPU architecture; only amd64 and arm64 are supported |
PF-103 |
info |
Kernel version |
Kernel version recorded for the audit report |
PF-104 |
degrade |
cgroup v2 unified hierarchy is active |
cgroup v2 unified hierarchy is not active |
PF-105 |
warn |
Swap is disabled |
Swap is active; apply disables it unless os.disableSwap is false |
PF-106 |
block |
systemd version is 245 or newer |
systemd is older than the required version 245 |
PF-107 |
warn |
CPU and memory meet the minimum |
Node is below the recommended minimum of 2 cores and 4 GB of memory |
PF-108 |
warn |
Node architectures are homogeneous |
Nodes report differing CPU architectures; images must exist for every one of them |
PF-109 |
info |
Machine UUID |
Machine UUID recorded for the handoff; it is the node's durable identity across reinstalls |
eBPF / dataplane capability
| ID |
Severity |
Check |
Default message |
PF-201 |
degrade |
Kernel exposes CONFIG_BPF_SYSCALL |
Kernel was built without CONFIG_BPF_SYSCALL |
PF-202 |
degrade |
Kernel BTF is present |
Kernel BTF is absent at /sys/kernel/btf/vmlinux |
PF-203 |
degrade |
bpffs can be mounted |
bpffs is neither mounted nor mountable at /sys/fs/bpf |
PF-204 |
degrade |
A minimal eBPF program actually loads |
Loading a minimal eBPF program failed; this node cannot run an eBPF dataplane |
PF-205 |
degrade |
Kernel lockdown and Secure Boot permit eBPF |
Kernel lockdown or Secure Boot restricts eBPF program loading |
PF-206 |
warn |
Active LSM stack |
A third-party LSM is active and may interfere with the eBPF dataplane |
PF-207 |
degrade |
netfilter modules required by the Canal fallback are available |
Required netfilter modules are unavailable; the canal-traefik fallback cannot run |
PF-208 |
warn |
conntrack table size |
nf_conntrack_max is low for the expected connection volume |
PF-209 |
degrade |
Kernel modules can be loaded |
Loading kernel modules is not permitted on this node |
Security posture
| ID |
Severity |
Check |
Default message |
PF-301 |
info |
SELinux mode |
SELinux mode recorded for the audit report |
PF-302 |
block |
rke2-selinux package is obtainable |
SELinux is enforcing on an RHEL-family node but the rke2-selinux package is not available |
PF-303 |
warn |
AppArmor profiles |
AppArmor profiles are active and may constrain container runtimes |
PF-304 |
warn |
Host firewall state |
firewalld or ufw is active; the cluster ports have to be opened in it (PF-601 measures whether they are) |
PF-305 |
info |
CIS profile prerequisites |
CIS prerequisites recorded; missing items become degrade only when the CIS profile is requested |
Storage
| ID |
Severity |
Check |
Default message |
PF-401 |
warn |
/var/lib/rancher is a separate mount |
/var/lib/rancher sits on the root filesystem; image accumulation will eventually fill / |
PF-402 |
block |
Free disk capacity |
Free capacity is below the 20 GB hard minimum (50 GB recommended) |
PF-403 |
warn |
Free inodes |
Free inode count is low for a container image store |
PF-404 |
block |
Longhorn prerequisite: iscsid |
Storage driver longhorn requires iscsid, which is absent or inactive |
PF-405 |
degrade |
Longhorn prerequisite: NFS client |
nfs-common/nfs-utils is absent; Longhorn RWX volumes will be unavailable |
PF-406 |
block |
multipathd does not claim Longhorn devices |
multipathd is active and will claim Longhorn block devices, causing volume attach to fail; blacklist them first |
PF-407 |
warn |
Filesystem type |
Filesystem is neither ext4 nor xfs |
Time
| ID |
Severity |
Check |
Default message |
PF-501 |
block |
Clock is NTP-synchronised |
System clock is not synchronised to any time source |
PF-502 |
block |
Clock skew between nodes |
Clock skew between nodes exceeds 5 seconds |
PF-503 |
block |
Configured NTP servers are reachable |
None of the configured NTP servers is reachable; required in airgap where no public pool exists |
PF-504 |
warn |
Timezones are consistent across nodes |
Nodes report differing timezones; correlating logs across them will be error-prone |
Network
| ID |
Severity |
Check |
Default message |
PF-601 |
block |
Inter-node port matrix |
A required inter-node port is unreachable (6443, 9345, 2379-2380, 10250, 4240, 8472/udp, 51871/udp) |
PF-602 |
degrade |
Path MTU between nodes |
Path MTU is smaller than expected; overlay MTU must be adjusted |
PF-603 |
block |
registrationAddress resolves |
registrationAddress does not resolve from this node |
PF-604 |
block |
Hostnames are unique and fully qualified |
Duplicate or unqualified hostname; nodes would collide on join |
PF-605 |
warn |
Required sysctl values |
Required sysctl values are unset; apply will configure them |
PF-606 |
block |
VIP address is unused |
The configured VIP already answers ARP; another host holds this address |
PF-607 |
degrade |
VIP interface can be determined automatically |
No interface matches the VIP subnet; specify topology.vip.interface explicitly |
PF-608 |
block |
Proxy passes CONNECT |
The configured proxy did not complete a CONNECT to the required endpoints |
PF-609 |
warn |
nodeIP is unambiguous on multi-homed nodes |
Node has two or more NICs and no nodeIP is pinned; the advertised address may be the wrong one |
PF-610 |
warn |
systemd-resolved stub resolver |
/etc/resolv.conf points at the 127.0.0.53 stub resolver |
PF-611 |
block |
Pod and service CIDRs do not collide |
Pod or service CIDR overlaps a node subnet or an existing route |
PF-612 |
warn |
Gateway external address is pinned |
A customer-facing profile leaves gateways[].address unset; the DNS record cannot be requested before install |
Registry / PKI
| ID |
Severity |
Check |
Default message |
PF-701 |
block |
Registry is reachable |
systemDefaultRegistry did not answer on TCP or did not serve /v2/ |
PF-702 |
block |
Registry TLS verifies against the supplied CA |
Registry TLS certificate does not verify against the supplied CA |
PF-703 |
block |
Registry credentials authenticate |
Registry login failed with the supplied credentials |
PF-704 |
block |
Intermediate certificate is valid |
Intermediate certificate does not chain to the supplied root, or expires too soon |
PF-705 |
block |
Certificate notBefore is not in the node's future |
Certificate notBefore is later than the node clock; cross-check PF-501 |
PF-706 |
block |
No root private key in the supplied PKI material |
A root private key was found in the supplied material; the offline root key must never leave its custody |
PF-708 |
block |
ACME prerequisites |
ACME DNS-01 token is invalid or the zone is not writable |
PF-709 |
block |
RKE2 release artifacts on the node |
kubernetes.artifactPath does not hold the release artifacts for the version this document asks for |
PF-710 |
block |
Chart archives present for an air-gapped install |
registry.chartDir does not hold the chart archives this document installs |
Residue / conflict
| ID |
Severity |
Check |
Default message |
PF-801 |
warn |
Pre-existing docker or containerd |
An existing docker or containerd installation was found |
PF-802 |
block |
Pre-existing k3s or RKE2 installation |
An existing k3s or RKE2 installation was found; clean it up explicitly before proceeding |
PF-803 |
block |
Control-plane ports are free |
Port 6443 or 9345 is already bound by another process |
PF-804 |
warn |
No leftover CNI interfaces |
Leftover CNI interfaces are present (cni0, flannel.1, cilium_host) |
PF-805 |
warn |
No leftover packet filter rules |
Leftover iptables or nftables rules from a previous installation are present |
PF-806 |
block |
An existing etcd member matches the address this document advertises |
A previous installation registered this node in etcd under a different address; rke2 will not start until the datastore is reset |
Certificate material
| ID |
Severity |
Check |
Default message |
PF-901 |
block |
Private key matches the leaf certificate |
Private key does not match the leaf certificate's public key |
PF-902 |
block |
Certificate chain is complete |
Chain is incomplete; an issuer certificate is missing and cannot be fetched over AIA in an airgap |
PF-903 |
block |
Listener hostname is covered by the leaf SAN |
No leaf certificate covers the listener hostname under RFC 6125 wildcard rules |
PF-904 |
block |
Certificate is not expired or expiring |
Certificate has expired, or expires within expiryWarningDays |
PF-905 |
block |
Key algorithm and size are supported by the GatewayClass |
Key algorithm or size falls outside what the selected GatewayClass supports |
PF-906 |
block |
Encrypted private key can be decrypted |
Private key is encrypted and the supplied passphrase did not decrypt it |
PF-910 |
block |
No root private key in the certificate bundle |
A root private key was found in the certificate bundle and the input is rejected |
PF-911 |
block |
Certificate notBefore is not in the node's future |
Certificate notBefore is later than the node clock; cross-check PF-501 |
PF-912 |
block |
No duplicate leaf claiming the same SAN |
Two or more leaf certificates claim the same SAN; the correct one cannot be chosen automatically |
Sub-codes
| ID |
Reasons |
PF-204 |
EBPF_LOAD_DENIED, EBPF_NO_BTF, EBPF_VERIFIER_REJECT, EBPF_PERM |
PF-902 |
CHAIN_INCOMPLETE |
PF-904 |
CERT_EXPIRED, CERT_EXPIRING |
PV · Post-apply verification
Source: internal/codes/verify.go
TLS wire verification
| ID |
Severity |
Check |
Default message |
PV-001 |
block |
Served chain is captured |
Could not capture the certificate chain the server actually sends |
PV-002 |
block |
Chain verifies without AIA fetching |
Served chain does not reach a trust anchor on its own; browsers pass by fetching the missing issuer over AIA, JSSE, Go and curl fail |
PV-003 |
block |
No expired certificate in the served chain |
Served chain contains an expired certificate, possibly a leftover cross-signed intermediate |
PV-004 |
warn |
Revocation distribution points are reachable |
OCSP or CRL distribution points are unreachable; expected in an airgap, but it must be stated in the audit report and the handover |
PV-005 |
warn |
Certificate returned when SNI is absent |
The default certificate returned for connections without SNI is unexpected |
PV-006 |
info |
Behaviour on direct IP access |
Response to direct IP access recorded for the audit report |
PV-007 |
block |
Each listener hostname returns its own certificate |
A listener hostname returns a certificate that does not match it |
PV-008 |
warn |
Negotiable TLS versions and cipher suites |
Supported TLS versions or cipher suites may exclude older JDK clients still in use at the site |
Sub-codes
| ID |
Reasons |
PV-002 |
CHAIN_NOT_SELF_SUFFICIENT, ROOT_NOT_TRUSTED |
Source:
These codes carry no severity — see internal/codes/codes.go.
Version skew
| ID |
Item |
Default message |
UP-001 |
Target version is well formed |
The target version is not an RKE2 version. It has the form v..+rke2r |
UP-002 |
Target is newer than what runs |
The target is not newer than the version already running. Kubernetes and etcd have no supported downgrade: the API server writes storage the older one cannot read, and restoring a snapshot is the only way back |
UP-003 |
One minor version at a time |
The target skips a minor version. The control plane supports one minor step, and skipping one leaves API objects stored in a version the new server never learned to convert |
UP-004 |
No node is ahead of the target |
A node already runs a version newer than the target, so the upgrade would move it backwards |
UP-005 |
No agent leads its servers |
An agent runs a newer version than the servers. A kubelet may lag its API server and must never lead it; this cluster is already outside the supported skew and the servers have to be brought up first |
Cluster readiness
| ID |
Item |
Default message |
UP-101 |
Every node is Ready before starting |
A node is not Ready. An upgrade restarts each node in turn, and starting one while another is already down is how a cluster loses quorum during a maintenance window |
UP-102 |
Workloads have somewhere to go |
There is one node, so there is nowhere to drain to. Its workloads restart in place while it is upgraded |
UP-103 |
etcd has a recent snapshot |
No etcd snapshot was taken recently. A failed control plane upgrade is recovered by restoring one, and the time to find out there is none is not afterwards |
EX · Execution failures
Source: internal/codes/execution.go
Step execution
| ID |
Severity |
Check |
Default message |
EX-001 |
block |
Step observation failed |
Could not observe the step's current state; the target state is unknown |
EX-002 |
block |
Step application failed |
The step ran and returned an error |
EX-003 |
block |
Target state not reached after applying |
The step reported success but re-observation shows the target state was not reached |
EX-004 |
block |
Retry budget exhausted |
The step failed on every attempt allowed by its retry budget |
EX-005 |
block |
One-shot step needs explicit confirmation |
A one-shot step was left in a non-successful state; re-running it is not automatically safe |
Phase and run control
| ID |
Severity |
Check |
Default message |
EX-101 |
block |
Phase halted by a failed step |
The phase stopped because one of its steps failed |
EX-102 |
block |
Node traversal halted |
A node failed, so the remaining nodes in this phase were not attempted |
EX-103 |
block |
Run halted by a failed phase |
The run stopped; later phases were not entered |
EX-104 |
warn |
Run cancelled |
The run was cancelled before completing |
MC · Maintenance checks
Source: internal/codes/maintenance.go
These codes carry no severity — see internal/codes/codes.go.
Certificates
| ID |
Item |
Default message |
MC-101 |
Series A: days remaining, per listener |
Service domain certificate is approaching expiry |
MC-102 |
Series A: served chain still complete |
Served chain no longer verifies without AIA fetching; re-run of PV-002 |
MC-111 |
Series B: days remaining, per node and service |
RKE2 internal certificate is approaching expiry on one or more nodes |
MC-112 |
Series B: renewal window entered |
RKE2 internal certificates are inside the 120-day renewal window; a restart will now rotate them |
MC-113 |
Series B: on-disk certificate matches the rke2-serving Secret |
On-disk certificate and the rke2-serving Secret disagree; a node restart can fail in this state |
MC-121 |
Series C: days remaining on the RKE2 CA |
RKE2 CA expiry recorded; ten years usually outlives the contract, so it must appear in every report and in the handover |
MC-131 |
Series D: days remaining on the private intermediate |
Private CA intermediate is approaching expiry |
Cluster state
| ID |
Item |
Default message |
MC-201 |
Node readiness and last restart |
A node is NotReady, or restarted unexpectedly during the period |
MC-202 |
System pod health |
System pods are in CrashLoopBackOff or Pending |
MC-203 |
Top pod restart counts for the period |
Pod restart counts increased notably during the period |
MC-204 |
Node conditions |
A node reports DiskPressure, MemoryPressure or PIDPressure |
MC-205 |
Workload replicas: desired versus actual |
Actual replica count differs from the desired count |
MC-206 |
Kubernetes and RKE2 version, EOL horizon |
The running version is approaching or past end of life |
etcd
| ID |
Item |
Default message |
MC-301 |
Snapshot freshness |
The most recent successful etcd snapshot is older than the agreed maximum age |
MC-302 |
Snapshot retention and off-cluster copy |
Snapshot retention is below target, or no copy exists outside the cluster |
MC-303 |
Database size against quota |
etcd database size is approaching its quota |
MC-304 |
Defragmentation needed |
etcd fragmentation is high enough to warrant a defragmentation |
MC-305 |
Member health and leader changes |
An etcd member is unhealthy, or leader elections are unexpectedly frequent |
MC-306 |
Date of the last restore rehearsal |
No restore rehearsal within the agreed interval; an untested backup is not a backup |
Resources / storage
| ID |
Item |
Default message |
MC-401 |
CPU and memory usage per node, mean and peak |
Node CPU or memory usage exceeded the agreed threshold during the period |
MC-402 |
/var/lib/rancher usage |
/var/lib/rancher usage exceeded its threshold; this is the most frequent on-prem outage cause and carries its own limit |
MC-403 |
Free disk and inodes |
Free disk space or inode count is below the agreed threshold |
MC-404 |
PersistentVolume usage |
One or more PersistentVolumes exceed their usage threshold |
MC-405 |
Longhorn volume and replica health |
A Longhorn volume is degraded or has fewer healthy replicas than configured |
MC-406 |
Longhorn backup freshness |
The most recent Longhorn backup is older than the agreed maximum age |
MC-407 |
Image cache growth and garbage collection |
Container image cache keeps growing; garbage collection may not be running |
Network / access
| ID |
Item |
Default message |
MC-501 |
Gateway and HTTPRoute acceptance |
A Gateway or HTTPRoute is not in the Accepted state |
MC-502 |
Load balancer IP reachability |
A load balancer address is unreachable |
MC-503 |
Service domain DNS resolution |
A service domain no longer resolves |
MC-504 |
End-to-end HTTPS response per service |
A service did not return a healthy HTTPS response end to end |
MC-505 |
Inter-node port matrix versus build time |
The inter-node port matrix changed since the cluster was built; a firewall policy may have been altered |
MC-506 |
Registry reachability and authentication |
The registry is unreachable, or the stored credentials no longer authenticate |
Workload / service
| ID |
Item |
Default message |
MC-601 |
Per-service health endpoint |
A service health endpoint reported unhealthy |
MC-602 |
Response time P50 and P95 for the period |
P95 response time exceeded the agreed threshold |
MC-603 |
5xx rate for the period |
The 5xx rate exceeded the agreed threshold |
MC-604 |
Alerts raised during the period |
Alerts were raised during the period and are summarised in the report |
MC-605 |
Deployment and change history for the period |
Deployments and changes applied during the period, by GitOps revision and Helm release |
Security / configuration
| ID |
Item |
Default message |
MC-701 |
CIS scan delta since build |
CIS scan results regressed relative to the build-time baseline |
MC-702 |
Secrets and tokens nearing expiry |
A Secret or token is approaching expiry |
MC-703 |
Image vulnerability scan |
Image vulnerability findings; in an airgap the scanner database must be refreshed for this to mean anything |
MC-704 |
Drift from the cluster.yaml used at build time |
The live cluster has drifted from the cluster.yaml it was built from |
MC-705 |
RBAC change history |
RBAC bindings changed during the period |
DG · Downgrade reasons
Source: internal/codes/downgrade.go
These codes carry no severity — see internal/codes/codes.go.
Downgrade reasons
| ID |
Item |
Default message |
DG-001 |
CNI downgraded because eBPF is unusable |
Requested Cilium dataplane replaced by the fallback preset; record the triggering probe IDs and the affected nodes |
DG-002 |
Gateway implementation downgraded |
Cilium Gateway replaced by Traefik; record the triggering probe IDs and the affected nodes |
DG-003 |
Requested configuration kept by excluding nodes |
The requested configuration is retained by excluding the nodes that cannot support it; record which nodes and why |
DG-010 |
No load balancer IP source available |
No LB-IPAM pool and no external load balancer; the Gateway will not obtain an external address without manual action |
DG-020 |
Storage driver downgraded |
Requested storage driver replaced by local-path; replicated volumes are lost and the customer must be told |