[bmscomp]

Why

The first live run of kates compliance check on an admin-less cluster: the fanon kind lab, Kates installed with rbac.scope=namespace by an account that isn't cluster admin. Its service account may list neither nodes nor PodMonitors cluster-wide; it may list EndpointSlices and PodMonitors in kafka.

• With the default zoneLabel, all 37 rules read: 36 PASS, 0 UNKNOWN. Zones came from the EndpointSlices (alpha: 1, gamma: 1, sigma: 1), and monitoring.podMonitor passed on kafka/krafter-kafka.
• With zoneLabel: example.com/zone, brokers.zones, brokers.skew, controllers.zones and controllers.skew were UNKNOWN, as designed. But:
  1. The reason named the refused node list and not the fix.
  2. The table cut it at the terminal width: ...may not list nodes, which are cluster-scop....
  3. Separately, monitoring.podMonitor's source said PodMonitors in any namespace when only kafka was read.

What changed

• ComplianceCheck: the four "may not list nodes" reasons end with The chart's rbac.nodeReads=true lets it list nodes (feat(chart): opt-in rbac.nodeReads for conformity zones #538's opt-in ClusterRole). The custom-label one also says a zoneLabel that is the rack key reads the brokers' racks instead (feat(conformity): zones from broker racks when nodes are refused #537).
• ComplianceCheck: monitoring.podMonitor takes its source through the existing Supplier<String> overload of rule(), so it reads Kubernetes: PodMonitors in kafka after the namespace fallback.
• cli/output: a table note line wraps instead of being cut, three lines at most, the third ending in … when there is more. TableNotes is only used by kates compliance check, so no other table changes.
• docs/book/compliance.md, the limits list: rbac.nodeReads=true lifts the UNKNOWN for another zoneLabel.

No MCP ref points into ComplianceCheck.java or output.go.

Tests

• ComplianceCheckTest: the two zone-reason assertions carry the new text; the PodMonitor fallback test asserts the source for both the UNKNOWN and the PASS case.
• TestTableNotes: a 400-character subject list wraps to three lines that each fit, the last ending in an ellipsis. New TestTableNotesWrapAReason: a 150-character reason comes out whole.
• On fanon, this branch's CLI against the published Kates API prints each UNKNOWN reason whole on two lines. The new backend text is covered by the unit tests only; fanon runs the published image.

Local runs:

• cd kates && ./mvnw test -Dquarkus.grpc.codegen.skip=true -Dquarkus.http.test-port=0: BUILD SUCCESS, 1790 tests, 0 failures, 0 errors, 3 skipped
• spotless:check (JDK 25): clean
• cd cli && go vet ./output ./cmd, go test -count=1 ./...: all pass
• go test -count=1 ./cmd -run 'TestMCPCaveat|Anchor': pass
• golangci-lint run --new-from-rev=origin/main ./...: 0 issues
• scripts/check-book-style.sh: OK

Only CI can run the integration tests, including ComplianceNamespacedLiveTest, the native image, Docker, CodeQL and the Quarto book render.

Deliberately not done

• No grant for PodMonitors in a third namespace (a central monitoring one): that reason has no chart fix to point to, and Kates' own admin-less deploy keeps its PodMonitors in kafka.
• The same run found topics.minInsyncReplicas failing on strimzi.cruisecontrol.metrics, which Strimzi creates with min.insync.replicas 1. That isn't admin-less and gets its own change (an exclude in the examples, or the chart's Cruise Control topic config).
• The feat(conformity): zones from broker racks when nodes are refused #537 rack path is still not run live: it needs the nodes labelled and the Kafka CR's rack key changed.