Verify the installation

This page lists the checks to run after an installation or an upgrade, from the health of the API to the audit chain. Run them in this order: a check depends on the ones above it.

Checks

Check	Command	Expected result
API alive	curl -fsS <api-url>/healthz	{"status": "ok", "version": "1.0.0"}
API ready	curl -fsS <api-url>/readyz	200, "status": "ready", checks.database and checks.migrations true; redis reports the cache state without making the API not ready
Migrations	navin-platform status (packages) or python -m eai.migrate --status	Every version applied, none pending, changed or unknown
Migration gate	navin-platform-db check or python -m eai.migrate --check	Exit status 0
Production settings	navin-platform check (packages)	navin-platform check: ok
Services (packages)	systemctl status navin-platform.target	API, worker and portal active (running)
Pods (Kubernetes)	kubectl -n enterprise-ai get pods	Control Plane, worker, portal, LiteLLM Running; migration Job Completed
Portal	open <portal-url>	Sign in page; GET /api/health of the portal answers
Metrics	curl -fsS -H "Authorization: Bearer <metrics-token>" <api-url>/metrics	Prometheus text with eai_http_requests_total
Worker	curl -fsS http://127.0.0.1:9464/metrics on the worker host or pod	eai_worker_last_tick_timestamp_seconds recent
Audit chain	curl -fsS -H "Authorization: Bearer <token>" <api-url>/v1/audit/verify	The chain of the tenant is valid
Identity	curl -fsS -H "Authorization: Bearer <token>" <api-url>/v1/identity/whoami	Subject, tenant and roles
Licence	curl -fsS -H "Authorization: Bearer <token>" <api-url>/v1/license	Licence state

<api-url>: public URL of the API (<control-plane-url>, or http://127.0.0.1:8080 on the host). <metrics-token>: EAI_METRICS_TOKEN. <token>: token of an administrator (First configuration).

Kubernetes offline checks

Before a synchronization, check the rendered manifests without a cluster:

helm lint deploy/helm/enterprise-ai -f deploy/helm/enterprise-ai/values-prod.yaml
helm template eai deploy/helm/enterprise-ai -n enterprise-ai -f deploy/helm/enterprise-ai/values-prod.yaml > /tmp/eai.yaml
kubeconform -strict -summary /tmp/eai.yaml

The admission policies are checked with Kyverno and an empty KUBECONFIG, see the Client installation handbook.

Alerts

After fifteen minutes, no alert of the PrometheusRule eai-slo-cost or of the chart should fire. The meaning of each alert and its runbook: Alerting and Runbooks.

Troubleshooting

Symptom	Cause	Fix
/readyz answers 503 with database: false	Database unreachable	Check EAI_DATABASE_URL (or EAI_RUNTIME_DATABASE_URL), the network and TLS
/readyz answers 503 with migrations: false	Schema empty	Run the migrations (navin-platform-db migrate, migration Job)
/metrics answers 401	Token missing or wrong	Use EAI_METRICS_TOKEN
Worker metric absent	Worker stopped, or EAI_WORKER_METRICS_PORT=0	Runbook worker-down