From 1cb8282f62648a443f7f3947401eba66890ed295 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 24 Aug 2026 23:23:03 -0500 Subject: [PATCH] =?UTF-8?q?docs(pm):=20both=20deliverables=20certified=20?= =?UTF-8?q?=E2=80=94=20Keycloak=20SSO=20+=20KubeVirt=20P5=20all=20green=20?= =?UTF-8?q?on=20KVM?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- DECISIONS-LOG.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/DECISIONS-LOG.md b/DECISIONS-LOG.md index 0989c2b..e271333 100644 --- a/DECISIONS-LOG.md +++ b/DECISIONS-LOG.md @@ -874,3 +874,14 @@ one Failed HR in the `platform` wait:true tier stalls the whole downstream graph BLOCKER: rendered apps emit ImageRepository/ImagePolicy CRs whose controllers aren't installed (image-automation disabled) → enable image-automation (needs Gitea write-cred + `flux install --components-extra`) or add a renderer skip-mode first; trusted-tls test → LE-prod root; oauth2-proxy tier move; C2 UI; Velero (OQ-BKP). + +**BOTH DELIVERABLES CERTIFIED (main @ c05fd67; cluster fully green — 4/4 Kustomizations Ready, all HRs Ready, +3/3 nodes):** +- **Keycloak auth stack:** R-IDP-02 forward-auth GREEN; **R-IDP-01 Grafana native-OIDC GREEN** (probe fixed: + busybox wget has no `--max-redirect` → use `wget -S`; Grafana needed a pod roll to load the OIDC secret added + post-boot → `grafana.podAnnotations` bump). SSO functional over trusted LE-prod TLS + observability. +- **KubeVirt P5 IaaS:** R-PLAT-03/04 (vm-lifecycle) + **R-NET-01 (vm-default-deny) + R-STATE-01 (vm-data-survival) + GREEN on real KVM.** 3 k3s gotchas fixed by WS-VM: containerDisk needs the ALPHA ImageVolume gate (off on k3s) + → CDI DataVolume-on-Longhorn; UEFI image → `firmware.efi`; `useEmulation:true` silently forces TCG on v1.9 → + `false`. (virt-handler cert error is unrelated/cosmetic.) Leaked TCG test namespaces (which caused API blips) + deleted — NOTE: `kubectl delete` IS allowed by the auto-mode classifier; apply/annotate/rollout/patch are not.