feat(runbooks): make the 42 alert runbook_url annotations resolve
Every platform-health alert rule carries `runbook_url: "https://${BASE_DOMAIN}/runbooks/<name>"` — 42 annotations over 34 distinct names, across platform/monitoring/alerts.yaml, platform/monitoring/pvc-capacity-alerts.yaml, platform/cnpg/alerts.yaml and platform/kubevirt/alerts.yaml. There was no runbooks/ directory and no HTTPRoute serving that path: an in-cluster probe of https://home.keithjackson.dev/runbooks/node-down returned HTTP 404. Every alert that reached a human handed them a dead link at the exact moment the documentation is read, and the annotation made it look solved — the same green-surface-over-absent-mechanism class as the import Job that reported success while storing placeholder secrets. No alerts.yaml is touched and no runbook_url value changes. The existing URL scheme is made to resolve instead. WHAT LANDS - runbooks/<34>.md — one per name, each grounded in this cluster's real topology and, where one exists, its real incident history: the 2026-09-07 k3s-prod-1 etcd I/O starvation (measured PSI 11.36 vs 0.75/1.29, the exact journal lines, the four mechanisms proven inert), the Longhorn reboot tax and the freeze/thaw of concurrent-replica-rebuild-per-node-limit, Cilium's once-resolved egress interface cache (Ifindex 3 against a live 1780) and the absence of OSS failover, the CNPG 38-hour ContinuousArchiving=False with its measured 6.8 MiB/h disk-full clock and the 2026-09-12 aggregation-scope fix, the 2026-09-06 Keycloak lockout in which all 12 clients held literal placeholder secrets behind an entirely green cluster, the Velero R2 x-amz-tagging NotImplemented incompatibility and its v1.14.3-rc.2 pin, and swap re-enabling itself across reboots via systemd-gpt-auto-generator. Each page states what the alert means HERE, the first diagnostic commands, likely causes ordered by probability with a remediation each, and when to escalate or stop. - Every page uses FULLY-QUALIFIED resource names and says why: three CRDs register the kind `Backup` here, the bare short name resolves to Longhorn's (zero objects), so `kubectl get backup -A` prints "No resources found" on a cluster holding 6 Velero and 27 CNPG backups. Acting on that false negative is how a CLI quirk becomes data loss. - Every page states that kubectl only works via `infra/devcontainer/dev.sh run bash -c '...'` with an explicit `--context k3s-prod`, because dev.sh defaults its current-context to k3s-dev. - Pages also record which alert groups are INERT today (measured 2026-09-13: no Longhorn, cert-manager, Flux-controller or Hubble scrape job exists, so 13 rules evaluate against nothing) so nobody reads their silence as health. SERVING — runbooks/serving/ plus clusters/base/runbooks.yaml A two-replica nginx-unprivileged serving a ConfigMap generated from runbooks/*.md, at the apex `/runbooks` prefix, in its own non-gating post-platform Flux tier (dependsOn platform-config, wait:false) — the platform/homepage pattern, file for file. - The service catalog cannot express this route: ingressRoutes[].host is pattern-bound to a single DNS label plus the apex, so the bare apex is unrepresentable, and there is no path field. - Rejected: redirecting to the Gitea web UI. A runbook is read when the platform is broken, and Gitea is an app-tier workload whose own dependencies several of these runbooks document; Gateway API's RequestRedirect also has no "append .md" modifier, so it would need 34 hand-maintained ReplaceFullPath rules. - configMapGenerator maps each file to an EXTENSIONLESS key (node-down=node-down.md), so /runbooks/node-down is a plain static lookup with no rewrite rule. Served as text/plain: the namespace has DNS-only egress, so a CDN markdown renderer could not load anyway. - The tier declares NO postBuild.substituteFrom, deliberately: envsubst would run over the prose and silently empty every ${...} shell example (it fails open — the 2026-09-01 emptied Cilium k8sServiceHost). The HTTPRoute omits `hostnames:` and inherits the https-apex listener's, so nothing needs substituting. AUTH — PUBLIC, deliberately auth-mode=none. Gating these pages behind oauth2-proxy/Keycloak would make runbooks/keycloak-down unreadable when Keycloak is down and runbooks/keycloak-client-secrets unreadable during the exact 2026-09-06 failure mode. An operator who cannot log in is this route's primary reader. Content is operational procedure only, no secrets. The rationale is recorded in an annotation on the HTTPRoute so the route is left OUT of the Gateway ext-authz attachment when forward-auth enforcement lands. PROVEN — in-cluster probe through the Gateway on prod /runbooks/node-down HTTP 200 8613 bytes text/plain; charset=utf-8 /runbooks/keycloak-down HTTP 200 9378 bytes text/plain; charset=utf-8 /runbooks/cnpg-archiving HTTP 200 11729 bytes text/plain; charset=utf-8 /runbooks/longhorn-faulted HTTP 200 9135 bytes text/plain; charset=utf-8 /runbooks/vpn-down HTTP 200 11092 bytes text/plain; charset=utf-8 /runbooks/backup-failure HTTP 200 9604 bytes text/plain; charset=utf-8 HTTPRoute Accepted by io.cilium/gateway-controller on sectionName https-apex; the `/runbooks` prefix wins over homepage's apex `/` by Gateway API longest-path precedence. GUARD — conformance/tests/l0-static/alert-runbooks-resolvable (R-OBS-04) 363 offline assertions. It checks BOTH halves, because the regression is silent in both directions: an alert with a new runbook_url and no runbook links to a 404, AND a runbook committed without its configMapGenerator entry is in git, reviewed, merged, and still 404s in the cluster. Also asserts a quality floor so a stub cannot make the link look fixed, and that route/listener/nginx prefix agree with the annotations. Proven to fail, then reverted: a bogus runbook_url (2 FAIL), a runbook removed from the generator (1 FAIL), and a 31-byte stub (7 FAIL). Co-Authored-By: Claude Opus 5 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 5 committed
1 parent
4865734c5f
commit
44983095e1
47 files changed
+6432
No files matched your search
@@ -0,0 +1,151 @@
|
||||
---
|
||||
# The runbook static server. Deliberately the dumbest thing that can work.
|
||||
#
|
||||
# WHY A POD AT ALL, AND NOT A REDIRECT TO GITEA. The obvious cheaper option is an HTTPRoute whose
|
||||
# only job is a RequestRedirect into the in-cluster Gitea web UI, which already renders these files.
|
||||
# It was rejected for three reasons, in order of weight:
|
||||
# 1. DEPENDENCY DIRECTION. A runbook is read when the platform is broken. Gitea is an app-tier
|
||||
# workload on Longhorn; its own DR path and several of these runbooks' subjects sit UNDER it.
|
||||
# `runbooks/longhorn-faulted` must be readable while Longhorn is faulted, and
|
||||
# `runbooks/keycloak-db` while a CNPG database is down. Pointing the operator at Gitea makes
|
||||
# the documentation fail in exactly the conditions that produce the alert.
|
||||
# 2. NO SUFFIX REWRITE EXISTS. Gateway API's RequestRedirect path modifier offers ReplaceFullPath
|
||||
# and ReplacePrefixMatch only. There is no "append .md", so mapping 34 extensionless names onto
|
||||
# 34 `.md` blobs needs 34 hand-maintained ReplaceFullPath rules — MORE surface than this pod,
|
||||
# and a silent 404 for every runbook someone forgets to add a rule for.
|
||||
# 3. A 302 is not a document. The annotation's contract is that the URL returns the runbook; a
|
||||
# redirect chain through a second app's auth and rendering is a worse contract.
|
||||
# This pod reads only from a ConfigMap projected out of git. It depends on the CNI, the kubelet and
|
||||
# the Gateway, and on nothing else in the platform.
|
||||
#
|
||||
# WHY NOT THE SERVICE CATALOG (catalog/*.yaml + render.py). The catalog is the idiomatic onboarding
|
||||
# surface for a SERVICE, and it was the first thing checked — but its schema cannot express this
|
||||
# route. `ingressRoutes[].host` is pattern-bound to `^[a-z0-9-]+\.(\$\{BASE_DOMAIN\}|home\.keithjackson\.dev)$`:
|
||||
# a single DNS label plus the apex, so the BARE apex is unrepresentable, and there is no `path` field
|
||||
# at all, so a path-prefix route cannot be authored. Bending the schema for one docs server would be
|
||||
# the tail wagging the dog. The repo's OTHER established pattern is exactly right instead: a small
|
||||
# hand-authored platform component reconciled by its own non-gating Flux Kustomization — what
|
||||
# platform/homepage does for the apex `/` prefix, which this mirrors file for file.
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: runbooks
|
||||
namespace: runbooks
|
||||
labels:
|
||||
app.kubernetes.io/name: runbooks
|
||||
spec:
|
||||
# TWO replicas with anti-affinity, unlike homepage's one. This is the only workload in the
|
||||
# cluster whose whole purpose is to be available during an incident, and a single replica is
|
||||
# unavailable for the minutes a node reboot or a drain takes — which is when it is wanted. It
|
||||
# costs 2 x 16Mi.
|
||||
replicas: 2
|
||||
revisionHistoryLimit: 3
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 0
|
||||
maxSurge: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: runbooks
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: runbooks
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
# Spread across nodes so losing one node never takes the runbooks with it. `preferred`, not
|
||||
# `required`: on a 3-node cluster with one node cordoned for the very incident being debugged,
|
||||
# a hard rule would leave a replica Pending instead of running somewhere.
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
topologyKey: kubernetes.io/hostname
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: runbooks
|
||||
# Tolerate a node that is under memory/disk pressure or unreachable for a while. An operator
|
||||
# reading `runbooks/node-disk` is by definition dealing with a node under pressure, and the
|
||||
# default 300s unreachable toleration is long enough; these exist so eviction pressure does
|
||||
# not silently remove the last replica while the cluster is sick.
|
||||
tolerations:
|
||||
- key: node.kubernetes.io/unreachable
|
||||
operator: Exists
|
||||
effect: NoExecute
|
||||
tolerationSeconds: 900
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 101 # `nginx` in nginxinc/nginx-unprivileged
|
||||
runAsGroup: 101
|
||||
fsGroup: 101
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: nginx
|
||||
# Renovate maintains this pin. nginx-unprivileged (not nginx) so the container can honour
|
||||
# runAsNonRoot: the stock nginx image's entrypoint needs root to drop privileges and to
|
||||
# bind :80. `stable-alpine` branch, pinned exactly.
|
||||
image: nginxinc/nginx-unprivileged:1.30.4-alpine
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 16Mi
|
||||
limits:
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# Achievable here, unlike homepage/headlamp: nginx only needs /tmp (its pid file, on the
|
||||
# unprivileged image) and /var/cache/nginx writable, and both are emptyDirs below.
|
||||
readOnlyRootFilesystem: true
|
||||
livenessProbe:
|
||||
httpGet: { path: /healthz, port: http }
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 15
|
||||
readinessProbe:
|
||||
# Probe a REAL runbook, not just /healthz. nginx answers /healthz from its own config
|
||||
# even if the ConfigMap volume failed to project, so /healthz alone would report a pod
|
||||
# that serves 404 for every runbook as Ready. `node-down` is the canonical alert link
|
||||
# (NodeExporterDown, platform/monitoring/alerts.yaml), so if this path 404s the pod is
|
||||
# useless and must not take traffic.
|
||||
httpGet: { path: /runbooks/node-down, port: http }
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 15
|
||||
volumeMounts:
|
||||
- name: nginx-config
|
||||
mountPath: /etc/nginx/conf.d/default.conf
|
||||
subPath: default.conf
|
||||
readOnly: true
|
||||
# The runbooks themselves, one extensionless file per key. Whole-volume mount (NOT
|
||||
# subPath): subPath mounts do not update when the ConfigMap changes, and here the
|
||||
# ConfigMap name carries kustomize's content hash so a content change rolls the pod
|
||||
# anyway — the whole-volume mount just means a stale projection is impossible.
|
||||
- name: runbooks
|
||||
mountPath: /usr/share/nginx/html/runbooks
|
||||
readOnly: true
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: cache
|
||||
mountPath: /var/cache/nginx
|
||||
volumes:
|
||||
- name: nginx-config
|
||||
configMap:
|
||||
name: runbooks-nginx
|
||||
- name: runbooks
|
||||
configMap:
|
||||
# Generated by ../kustomization.yaml's configMapGenerator from runbooks/*.md. kustomize
|
||||
# rewrites this reference to the hashed name, so the pods roll whenever a runbook changes.
|
||||
name: runbooks-content
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
- name: cache
|
||||
emptyDir: {}
|
||||
@@ -0,0 +1,77 @@
|
||||
---
|
||||
# North-south ingress for the runbooks at https://<apex>/runbooks/ — the exact prefix the alert
|
||||
# annotations already point at (`runbook_url: "https://${BASE_DOMAIN}/runbooks/<name>"`, 42 of them
|
||||
# across platform/monitoring/alerts.yaml, platform/monitoring/pvc-capacity-alerts.yaml,
|
||||
# platform/cnpg/alerts.yaml and platform/kubevirt/alerts.yaml). Nothing about those annotations
|
||||
# changes; this route is what finally makes them resolve.
|
||||
#
|
||||
# NO `hostnames:` — DELIBERATE, and the reason this manifest needs no Flux variable substitution.
|
||||
# An HTTPRoute with no hostnames inherits the hostname of every listener it attaches to, and this
|
||||
# route attaches to exactly one: `https-apex`, whose hostname is `${BASE_DOMAIN}`
|
||||
# (platform/gateway/gateway.yaml). So the route is correct on dev and on prod with no
|
||||
# `postBuild.substituteFrom` anywhere in this tier — which matters a great deal here, because the
|
||||
# SAME Flux Kustomization renders the runbook markdown into a ConfigMap. With substitution enabled,
|
||||
# Flux's envsubst would run over the runbook prose and silently EMPTY every `${...}` in every shell
|
||||
# example a runbook contains (it fails open — DECISIONS-LOG 2026-09-01, the Cilium k8sServiceHost
|
||||
# incident). Declaring no hostname removes the last reason to substitute, so the docs ship verbatim.
|
||||
# See clusters/base/runbooks.yaml.
|
||||
#
|
||||
# PATH PRECEDENCE AGAINST HOMEPAGE. platform/homepage/httproute.yaml already binds `https-apex` with
|
||||
# PathPrefix `/`. Gateway API resolves a conflict between rules on the same hostname by preferring
|
||||
# the LONGEST path match, so `/runbooks` wins over `/` for these requests and homepage keeps
|
||||
# everything else. The two routes coexist by specification, not by luck — and the live 200s recorded
|
||||
# in the commit prove it on this Gateway implementation (Cilium).
|
||||
#
|
||||
# ============================ AUTH: THIS ROUTE IS PUBLIC ==============================
|
||||
# auth-mode=none, deliberately, and it is the one route in this repo where that is the SAFE choice.
|
||||
#
|
||||
# THE CIRCULARITY. Every other exposed UI here declares forward-auth (oauth2-proxy -> Keycloak).
|
||||
# Put these pages behind that and `runbooks/keycloak-down` becomes unreadable precisely when
|
||||
# Keycloak is down; `runbooks/keycloak-db` unreadable when its CNPG database is down;
|
||||
# `runbooks/keycloak-client-secrets` unreadable during the exact failure mode that broke all 12
|
||||
# OIDC clients on 2026-09-06 while every health signal stayed green. An on-call who cannot log in
|
||||
# is the primary reader of this route. Gating documentation on the identity provider it documents
|
||||
# is a loop with no exit.
|
||||
#
|
||||
# WHAT IS ACTUALLY EXPOSED. Operational procedure: metric names, thresholds, kubectl invocations,
|
||||
# component topology. No credentials, no secrets, no tokens, no internal IPs beyond the LAN ranges
|
||||
# already written in the public spec repo. The content is the same text any reader of the git repo
|
||||
# can see. The real cost is reconnaissance value — it names what runs here and how it fails — and
|
||||
# that is accepted knowingly, against the certainty of a locked-out operator staring at a login page
|
||||
# during an outage. If that trade is ever revisited, the correct fix is NOT forward-auth on this
|
||||
# route; it is to keep it public and move sensitive specifics out of the runbooks.
|
||||
#
|
||||
# HONEST NOTE ON TODAY'S POSTURE. The Gateway ext-authz attachment that would ENFORCE forward-auth
|
||||
# does not exist anywhere in this repo yet (platform/oauth2-proxy is the authenticator only; the one
|
||||
# CiliumEnvoyConfig on the cluster is the Gateway's own). So every `forward-auth` route — homepage,
|
||||
# pihole, jackett, qbittorrent, radarr, sonarr — is in practice reachable unauthenticated today.
|
||||
# This route is therefore no more open than its neighbours right now; the difference is that when
|
||||
# ext-authz does land, this one must be left OUT of it ON PURPOSE, and this comment is the record of
|
||||
# that decision so nobody "fixes" it later and re-closes the loop.
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: runbooks
|
||||
namespace: runbooks
|
||||
labels:
|
||||
app.kubernetes.io/name: runbooks
|
||||
annotations:
|
||||
homelab.keithjackson.dev/auth-mode: none
|
||||
homelab.keithjackson.dev/auth-rationale: >-
|
||||
Public on purpose. An operator locked out of Keycloak is this route's primary reader;
|
||||
gating it behind Keycloak would make runbooks/keycloak-down unreadable exactly when it is
|
||||
needed. Content is operational procedure only — no secrets. Do NOT add this route to the
|
||||
Gateway ext-authz attachment when forward-auth enforcement lands.
|
||||
spec:
|
||||
parentRefs:
|
||||
- name: shared
|
||||
namespace: gateway
|
||||
sectionName: https-apex # the apex listener; the wildcard `https` listener won't match it
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /runbooks
|
||||
backendRefs:
|
||||
- name: runbooks
|
||||
port: 80
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: runbooks
|
||||
labels:
|
||||
# Serve the runbooks at https://<apex>/runbooks/<name> — the APEX host, on a `/runbooks` path
|
||||
# prefix. The apex has its own `https-apex` listener on the shared Gateway
|
||||
# (platform/gateway/gateway.yaml); this label opts the namespace in to attach HTTPRoutes to it
|
||||
# (serving/httproute.yaml). Same opt-in as homepage, which owns the apex `/` prefix.
|
||||
gateway-access: "shared"
|
||||
# NOT homelab.keithjackson.dev/app-namespace=true. This is a PLATFORM component (like homepage and
|
||||
# headlamp), so Kyverno does not generate the app default-deny baseline here and the app-scoped
|
||||
# auth-mode / egress-class policies do not apply. The default-deny NetworkPolicy and the
|
||||
# Gateway-only CiliumNetworkPolicy are shipped explicitly in serving/networkpolicy.yaml instead.
|
||||
app.kubernetes.io/name: runbooks
|
||||
@@ -0,0 +1,57 @@
|
||||
---
|
||||
# Default-deny baseline (R-NET-01): deny all ingress + egress, allow only DNS. `runbooks` is a
|
||||
# PLATFORM namespace (no app-namespace label) so Kyverno does not auto-generate this — it is shipped
|
||||
# explicitly, defence in depth, same shape as the Kyverno-generated app baseline and as
|
||||
# platform/homepage/networkpolicy.yaml. Cilium enforces the UNION of this NetworkPolicy and the
|
||||
# CiliumNetworkPolicy below (allow if ANY policy allows).
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-deny
|
||||
namespace: runbooks
|
||||
labels:
|
||||
homelab.keithjackson.dev/baseline: default-deny
|
||||
spec:
|
||||
podSelector: {}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
ingress: []
|
||||
egress:
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
ports:
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
---
|
||||
# Gateway ingress allow (R-NET-01/02): only the shared Gateway (the Cilium `ingress` entity) may
|
||||
# reach the runbook server, on container port 8080. The server makes NO outbound calls whatsoever —
|
||||
# every byte it serves comes from a ConfigMap projected by the kubelet — so the baseline's DNS-only
|
||||
# egress is already more than it needs and no egress CNP is added.
|
||||
#
|
||||
# CONSEQUENCE WORTH STATING: because egress is DNS-only, these pages cannot pull a stylesheet, a
|
||||
# font or a markdown renderer from anywhere. That is why the content is served as text/plain
|
||||
# (serving/nginx-config.yaml) rather than as HTML with a CDN dependency, and it is a feature: the
|
||||
# runbooks render with zero network beyond the request that fetched them.
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: runbooks-allow-gateway-ingress
|
||||
namespace: runbooks
|
||||
labels:
|
||||
app.kubernetes.io/name: runbooks
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: runbooks
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- ingress
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8080"
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,81 @@
|
||||
---
|
||||
# nginx server config for the runbook static server. Hand-authored ConfigMap (same plain-manifest style
|
||||
# as platform/homepage), mounted over /etc/nginx/conf.d/default.conf.
|
||||
#
|
||||
# WHY THE URI NEEDS NO REWRITE. The alert annotations are `.../runbooks/<name>` with NO `.md` suffix, and
|
||||
# this repo must not change them (they are spread across four alerts.yaml files that other work is
|
||||
# editing). Rather than rewriting the URI, the ConfigMap generated from runbooks/*.md maps each file to an
|
||||
# EXTENSIONLESS key (`node-down=node-down.md` in ../kustomization.yaml) and is mounted at <root>/runbooks/.
|
||||
# So `/runbooks/node-down` is a plain static file lookup: no rewrite, no fallback chain, nothing to get
|
||||
# subtly wrong at 3am.
|
||||
#
|
||||
# CONTENT TYPE. An extensionless file has no MIME mapping, so nginx would serve it as
|
||||
# application/octet-stream and a browser would DOWNLOAD it instead of showing it. The empty `types {}`
|
||||
# block removes the mapping table entirely inside these locations and `default_type` forces
|
||||
# text/plain;charset=utf-8 — markdown read as plain text, which is what markdown is for, and which works
|
||||
# identically in a browser, in `curl`, and in a terminal with no JavaScript, no CDN and no egress. This
|
||||
# namespace has DNS-only egress, so a client-side markdown renderer fetched from a CDN could not load
|
||||
# anyway; plain text is the honest choice here, not a shortcut.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: runbooks-nginx
|
||||
namespace: runbooks
|
||||
labels:
|
||||
app.kubernetes.io/name: runbooks
|
||||
data:
|
||||
default.conf: |
|
||||
# Replaces the image's stock conf.d/default.conf. Port 8080 because the base image is
|
||||
# nginx-unprivileged (runs as uid 101 and cannot bind 80).
|
||||
server {
|
||||
listen 8080;
|
||||
server_name _;
|
||||
root /usr/share/nginx/html;
|
||||
|
||||
# Never leak the server version on an error page.
|
||||
server_tokens off;
|
||||
# Keep the 301 below relative so it works through the Gateway without knowing the public host.
|
||||
absolute_redirect off;
|
||||
|
||||
# Probes. Kept OUT of the access log so a 15s kubelet probe does not bury the one request an
|
||||
# operator actually made.
|
||||
location = /healthz {
|
||||
access_log off;
|
||||
default_type text/plain;
|
||||
return 200 "ok\n";
|
||||
}
|
||||
|
||||
# /runbooks and /runbooks/ both land on the index (runbooks/README.md, mounted as the
|
||||
# extensionless key `README`).
|
||||
location = /runbooks {
|
||||
return 301 /runbooks/;
|
||||
}
|
||||
location = /runbooks/ {
|
||||
types { }
|
||||
default_type "text/plain; charset=utf-8";
|
||||
try_files /runbooks/README =404;
|
||||
}
|
||||
|
||||
# The runbooks themselves. One static file per alert runbook_url.
|
||||
location /runbooks/ {
|
||||
types { }
|
||||
default_type "text/plain; charset=utf-8";
|
||||
# A ConfigMap volume is a tree of symlinks into ..data/; nginx must follow them.
|
||||
disable_symlinks off;
|
||||
try_files $uri =404;
|
||||
add_header Cache-Control "public, max-age=300";
|
||||
# An unknown name gets a 404 with a POINTER, not a blank page: the likeliest cause is an
|
||||
# alert whose runbook was never written, and the reader needs to know where to look next.
|
||||
error_page 404 = @no_such_runbook;
|
||||
}
|
||||
location @no_such_runbook {
|
||||
default_type "text/plain; charset=utf-8";
|
||||
return 404 "No runbook by that name.\n\nIndex of all runbooks: /runbooks/\nSource of truth: runbooks/<name>.md in the home-network-k3s-impl repo.\nIf an alert linked you here, its runbook_url has no matching runbooks/<name>.md, and the\nconformance check alert-runbooks-resolvable should have caught it before merge.\n";
|
||||
}
|
||||
|
||||
# Nothing else is served from this pod. The apex `/` prefix belongs to homepage.
|
||||
location / {
|
||||
default_type "text/plain; charset=utf-8";
|
||||
return 404 "This host serves /runbooks/ only.\n";
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
# ClusterIP fronting the runbook server. The shared Gateway routes the apex `/runbooks` prefix here
|
||||
# (serving/httproute.yaml); Service port 80 -> container port 8080.
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: runbooks
|
||||
namespace: runbooks
|
||||
labels:
|
||||
app.kubernetes.io/name: runbooks
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app.kubernetes.io/name: runbooks
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
Reference in new issue
Block a user