Read reports

A report is JSON. The fields to look at first:

Field	Use
decision.level	The verdict — SAFE / WARNING / CRITICAL.
decision.allow	Boolean gate — false means blocked.
decision.blockers	Every reason it's CRITICAL. Fix them all.
scores.total	The readiness gauge (0–100). Not the gate.
risk.byNamespace	Where propagated risk concentrates.
workloads.*	The inventory: deployments, PVCs, standalone pods, deprecated APIs.

From the CLI

# a report file on your own machine / CI runner
mirops scan --source ./report.mirops

# machine-readable
mirops scan --source ./report.mirops --output json | jq '.decision'

note

--source ./report.mirops reads a file on the CLI's own filesystem — not the operator's pod. A file-destination report lives inside the pod and is served over HTTP; read it with --source http://… (see below) or use a remote destination for CI outside the cluster.

From a remote destination

The CLI reads S3, Azure Blob, and HTTP directly (credentials resolve automatically):

# S3 (IRSA / env vars / static keys)
mirops scan --source s3://my-bucket/clusters/prod.mirops

# Azure Blob (az login / Workload Identity)
mirops scan --source azure://mystorageacct/reports/prod.mirops

# the operator's in-cluster HTTP endpoint
mirops scan --source http://<reports-service>:8084/reports/to-1-34.mirops

Azure Blob source format: azure://<storageaccount>/<container>/<blob>. S3: s3://<bucket>/<key>.

Configure with environment variables

Every flag has an environment-variable equivalent, so you can run a bare mirops scan — handy in CI, where you set the config once instead of repeating flags. Flags take precedence over env vars.

Env var	Flag	Default	Example
MIROPS_SOURCE	--source	—	s3://my-bucket/prod.mirops
MIROPS_OUTPUT	--output	table	table | json
MIROPS_ENFORCE	--enforce	false	true
MIROPS_ENFORCE_LEVEL	--enforce-level	critical	critical | warning
MIROPS_TARGET_VERSION	--target-version	—	1.34

export MIROPS_SOURCE="s3://my-bucket/prod.mirops"
export MIROPS_ENFORCE=true
mirops scan          # no flags needed

For remote sources, the usual cloud-credential env vars apply too — AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY for S3, or AZURE_CLIENT_ID / AZURE_TENANT_ID / AZURE_CLIENT_SECRET for Azure Blob. Or use IRSA / Workload Identity and set nothing.

From Kubernetes status

You don't always need the full report — the verdict lives on the CR:

kubectl get upgradeanalysis to-1-34 \
  -o jsonpath='{.status.decision} {.status.totalScore}{"\n"}'

In the Web UI

The Web UI renders the whole report — graph, findings, risk heatmap — reading it back through the operator's endpoint.