home-network-k3s-impl

0 Fork 0

Author	SHA1	Message	Date
jakman85	5fa893095b	merge: the placeholder guard test was hiding a RED, not a pass gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details It had been permanently SKIPPED because it expected bootstrap/standup.sh, which never landed on main — planned, never merged, still living only on the unmerged prod-standup branches along with the 2026-09-05 incident it came from. Dropping the real script in and running the old check produced FAIL 2/34: it would have false-blocked the very merge that landed its own input. Now split into the half that needs no guard (no overlay ships a placeholder-shaped effective cluster-vars value; an empty value must be STATED by the overlay, not inherited in silence; a loud base sentinel must be explicitly overridden) and the half that self-activates. The guard is discovered by CONTENT — any tracked *.sh defining <name>_is_placeholder() — so landing one anywhere activates the second half with no edit here, and two definitions is a failure. The check never exits 3 again. Unscoped L0 goes 13 PASS / 1 SKIP -> 14 PASS / 0 SKIP.	2026-09-13 00:14:17 -05:00
jakman85	e49b86eb41	merge: 35 runbooks, served, with a guard that they resolve gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details All 46 runbook_url annotations pointed at https://<apex>/runbooks/<name> and every one returned 404 — there was no runbooks/ directory and no route. Every alert that reached a human handed them a dead link at the moment they needed it. Runbooks are now served from their own non-gating tier at the apex prefix, PUBLIC on purpose: gating them behind Keycloak would make keycloak-down unreadable exactly when Keycloak is down, which is a loop with no exit. The new L0 guard checks both directions — a runbook_url with no file, and a file not wired into the generator — and it caught a live one on contact with main: CNPGPrimariesCoLocated had shipped hours earlier pointing at a runbook that did not exist.	2026-09-13 00:11:03 -05:00
jakman85	d616fd4025	merge: promtool is in the toolchain, so the alert unit tests actually run 324 lines of mutation-checked promtool tests had landed with nothing to execute them: promtool was not in the pinned toolchain, so the coverage was present and enforced by nothing — the failure mode this repo keeps hitting. promtool 3.14.0 is now pinned in both versions.env files (matching prod's Prometheus, verified against the running image) and baked into the container. The two competing harnesses are consolidated into one, and the two competing wirings into one: the bespoke ci/prom-rules.sh stage is deleted in favour of a scope-declaring conformance test, because a hand-written stage running one hardcoded script is exactly the pattern `b9f8807` just removed. Missing promtool is exit 3 — UNWIRED, never green. 51 of 58 alert rules still have no unit test; that gap is a shrink-only ratchet that fails if it grows, rather than a blanket FAIL that would get disabled or a report nobody reads.	2026-09-13 00:11:03 -05:00
jakman85andClaude Opus 5	87c3d83dff	fix(conformance): placeholder-guard-coupling actually RUNS — it was skipping forever `conformance/tests/l0-static/placeholder-guard-coupling` (R-ENV-02, R-STATE-03) exited 3 SKIPPED on every gate run since it landed, because its check keyed its whole existence on `bootstrap/standup.sh`. Measured, not assumed: that file has NEVER been on `main` — there is no deletion commit for it anywhere; it landed only on unmerged prod-standup branches (`work/prod-standup-campaign`, `prod/`, `feat/prod-hardening`). It was planned and never merged, not removed. SKIPPED is not green, and a permanently-skipped incident-derived test is the quiet version of the failure it was written to prevent. The skip was also hiding a RED. Run against the real `standup.sh` from `work/prod-standup-campaign`, the old check FAILED 2 of 34 assertions — false positives from treating the empty string as placeholder-shaped for knobs cluster-vars authors empty on purpose (`BACKUP_CREDENTIALS_SUFFIX`, `VELERO_BACKUP_PREFIX`, both `""` on dev and both documented there as load-bearing). It would have false-blocked the merge landing its own input. NOT deleted — the hazard is not gone. Split into two halves, one of which needs no guard: HALF A (always runs): no environment overlay ships a placeholder-shaped EFFECTIVE cluster-vars value; an empty effective value is STATED by the overlay rather than inherited in silence; a LOUD base sentinel is explicitly overridden by every overlay. This is the 2026-09-05 outcome asserted at the source instead of at the guard — if prod's S3_BACKUP_ENDPOINT is never a placeholder, velero cannot be pointed at a hostname that does not exist. Input surface is `clusters/`, all of it on `main`. HALF B (self-activating): the real predicate extracted and executed against those same values, the consumer trace, and the mid-string anchoring property. The check NEVER exits 3 again, and the guard is DISCOVERED by content rather than hardcoded: any tracked `.sh` defining `<name>_is_placeholder()` is found, so a guard landing at `bootstrap/standup.sh` — or moved into a sourceable library, the remedy the check already recommends — activates HALF B with no edit to the test. Two files defining it is a FAIL. When no guard exists the gap is printed loudly every run instead of swallowed as a skip. LOUD vs EMPTY is the correction that makes it honest in both modes: a loud placeholder is always a defect in an overlay, while `""` is held to the explicitness rule instead — and still counts as a placeholder for a knob a guard covers, because a `""` case-arm is the guard author's declaration that empty is not a usable target. Proof, all reverted: 84 assertions and exit 0 on `main`; prod S3_BACKUP_ENDPOINT set to the literal `https://TBD-R2-ACCOUNT-ID.r2.cloudflarestorage.com` FAILS (A1); deleting dev's explicit VELERO_BACKUP_PREFIX op so it inherits `""` FAILS (A2); a LOUD base BULK_NFS_SERVER with prod's override deleted FAILS 2/86 (A1+A3); and with the real `standup.sh` present, reverting `s3_is_placeholder` to the `TBD-` PREFIX glob FAILS 12/110 (B3 anchoring). With the pristine `standup.sh` the check PASSES at 110 assertions where the old one failed 2 of 34. L0 layer: 14 checks, 14 PASS, 0 SKIP, 0 FAIL (was 13 PASS / 1 SKIP). Coverage unchanged — R-ENV-02 and R-STATE-03 both still list this test, 49/51 with the same 2 gaps. Also: `ci/touched-requirements.sh` — `bootstrap/` -> R-STATE-03 R-GITOPS-01 is KEPT, its stale comment corrected. It claimed standup.sh "carries the placeholder guards", describing a file that is not here; R-STATE-03 there is ANTICIPATORY. Deleting the entry would leave the change that lands a placeholder guard selected by nothing. `ci/tests/touched-requirements.test.sh` — new path-map section (12 assertions, was 8) locking `bootstrap/` and `clusters/`, so removing either entry is a test failure rather than a silent loss of selection. All three ci/tests pass (12 + 31 + 15). * `docs/BULK-NFS-STORAGE.md` §7 — its "nothing in the gate currently refuses a placeholder-shaped overlay value" is no longer true; corrected. * Scope re-audited: still deliberately requirement-scoped, not whole-repo. Every path that can break it attributes a requirement it declares. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-13 00:10:37 -05:00
jakman85andClaude Opus 5	bce8778096	docs(runbooks): forward-auth IS enforced — correct the posture note The serving route's comment claimed that because no Gateway ext-authz attachment exists, every forward-auth route is 'in practice reachable unauthenticated today'. That is wrong, and wrong in a dangerous direction for a document an operator reads during an incident. Enforcement here is PER-POD, not gateway-level: each of the five services declaring auth: forward-auth (pihole, jackett, qbittorrent, radarr, sonarr) publishes both its app port and 4180 on its Service, and its HTTPRoute targets :4180 — the oauth2-proxy sidecar. Verified on prod. The app port remains reachable in-cluster on purpose, which is how sonarr/radarr drive qBittorrent's API, and Cilium default-deny governs that path. The public-by-design decision for this route is unchanged and still correct; what changes is that it is genuinely the exception rather than one open route among many. Headlamp's exclusion is likewise deliberate (native OIDC with per-user id_token forwarding and no ServiceAccount cluster rights). Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-13 00:10:24 -05:00
jakman85andClaude Opus 5	78d0f1b0f6	feat(ci): promtool in the pinned toolchain, one alert-rule harness, and the gaps declared The CNPG alert unit tests (324 lines, mutation-checked) were run by NOTHING. promtool was not in the baked toolchain, no gate stage evaluated any .promtool-test.yaml, and the only runner `curl \| tar -xz`'d a promtool release from GitHub at TEST-RUN time if one was missing. Hours later a second, independent harness landed for the Velero rules (platform/monitoring/tests/) with its own fallback — a `podman run` of quay.io/prometheus/prometheus. So the repo had two harnesses, two acquisition paths, and coverage that looked present and was enforced nowhere: the exact failure mode that had just produced a permanently-firing CNPG alert and a structurally inert Velero alert. PROMTOOL IS NOW PINNED LIKE EVERY OTHER TOOL. PROMTOOL_VERSION=3.14.0 in infra/devcontainer/versions.env and ci/versions.env (the two stay in lockstep, per the repo's rule), baked by the Containerfile from the prometheus release tarball (promtool ships inside it), recorded in /etc/dev-toolchain-versions, passed by dev.sh, and installed for the l0 stage by .gitea/workflows/scripts/install-tools.sh so the CI runner is not permanently SKIPPED. The pin is not free-floating: promtool IS the rule engine, so it tracks the Prometheus prod actually runs — verified against the live cluster, not assumed: kubectl --context k3s-prod get prometheus -n monitoring -o jsonpath='{.items[].spec.version}' -> v3.14.0-distroless (image quay.io/prometheus/prometheus:v3.14.0-distroless) ONE HARNESS. platform/cnpg/run-alert-tests.sh is folded into platform/monitoring/tests/run.sh, which now covers every PrometheusRule in the repo that has tests, via two conventions it discovers automatically: `<manifest>.promtool-test.yaml` beside its manifest (cnpg), and `<component>/tests/.test.yaml` over that component's manifests (monitoring). It writes the flattened rules under whatever name each test file's own `rule_files:` declares, so no test file needs to know the harness exists, and it `promtool check rules` first — a rules file that does not parse would make every unit test pass vacuously by finding no rules at all. The cnpg script's reasoning is preserved: why a CR must be flattened (`.spec.groups`, never re-typed), and why generated files go to a temp dir. Its `${BASE_DOMAIN}` substitution is dropped in favour of extract_rules.py's verbatim placeholders, with the trade-off recorded there — the hazard it guarded against is addressed by the temp dir, and verbatim leaves one transformation fewer between the shipped rule and the rule under test. NO ENGINE IS ACQUIRED AT RUN TIME any more — not the GitHub release, not the container image. Not because a pinned download is unusual here (the Containerfile downloads every tool it bakes) but because those two decided the version, the network and the machine SILENTLY, at test time, on whatever host ran the tests; and each quietly turned "the toolchain has no promtool" into a green run, which is how the toolchain stayed without one. Missing promtool is exit 3 (UNWIRED, never green); a PROMTOOL= that does not resolve is exit 2. ONE WIRING: conformance/tests/l0-static/alert-rules-unit-tested, NOT a gate stage. The `prom-rules` stage (ci/prom-rules.sh + its Makefile target + ci/gate.sh entry) is deleted: it is the bespoke-per-check pattern `b9f8807` had just removed from ci/l0.sh, and the declarative replacement gives what a hand-written stage cannot — selection by `conformance.home.k3s/scope: "whole-repo"` (asserted: the test is selected even under a requirement filter matching nothing), requirement-attributed JUnit/coverage/ledger evidence, and run_l1_offline.py's rule that a SKIP of a scope-declaring check is the runner's rc 3. The scope declaration is load-bearing here: touched-requirements.sh keys apps/ to nothing and platform/monitoring/* to R-OBS-01/02, never R-OBS-04, so a new untested PrometheusRule would otherwise be gated by nothing. The check asserts the pins and their lockstep, that the image bakes and records promtool, that the promtool IN USE reports exactly the pin (a FAILURE, not a skip: the wrong engine still prints SUCCESS), that exactly ONE harness exists and none fetches an engine, that every rule-unit test file passes, and — on every run — that the harness CAN fail, by putting a synthetic rule through it twice with one expectation mutated. MISSING TESTS ARE A RATCHET, deliberately, and the reasoning is in the check's header. 51 of 58 alert rules have no unit test. Failing on all of them makes the gate red until ~51 tests exist, so it gets disabled and protects nothing; merely reporting is exactly how the CNPG tests came to be enforced by nothing. So the gap is DECLARED in the check as a shrink-only register, printed with counts every run (13 alert files nothing tests at all; 35 named alerts inside covered files that nothing asserts on), and it cannot grow: a new PrometheusRule, or a new alert in an already-covered file, FAILS without a test, and a stale entry FAILS too. A missing test is never an exit-3 skip — SKIPPED is reserved for the one genuine environment gap, promtool being absent. PROVEN, in the rebuilt image (promtool 3.14.0): * both suites pass through the single harness: cnpg 6 rules, monitoring 36 rules, SUCCESS. * the check passes: 95 assertions, 7/58 alert rules unit-tested, 13 declared gap files. * NOT VACUOUS, twice over. Shortening CNPGPrimariesCoLocated's `for: 30m` to 5m turns it red (pending expected at 25m/29m, got firing), reverted. Adding an untested PrometheusRule (platform/kubevirt/probe-alerts.yaml) turns it red on the ratchet, removed. The harness's own mutation self-test runs on every invocation. * the scope mechanism selects it: `run.sh --layer l0 --requirements r-nosuchreq-99 --include-scope whole-repo --print-selection` lists alert-rules-unit-tested. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-13 00:02:27 -05:00
jakman85	55b90849d1	merge: the arrs had no download client at all, and now agree on paths Investigating the path disagreement found the larger defect: sonarr and radarr each returned [] from /api/v3/downloadclient — Completed Download Handling had never been wired up, not merely broken. Both now have qBittorrent configured plus a remote path mapping /downloads/ -> /media/downloads/, proven with a real completed torrent and a negative control: same torrent, same client, mapping absent gave an unresolvable /downloads/... and mapping present resolved the real file at inode 36144. This state lives in each arr's database, NOT in git — a rebuild from git does not restore it. Recorded in DECISIONS-LOG with the recommendation to close it properly via path agreement instead.	2026-09-13 00:01:55 -05:00
jakman85andClaude Opus 5	b7341b329b	fix(runbooks): declare whole-repo scope, drop the bespoke l0 stage, +cnpg-primary-spread Three corrections after rebasing onto main. 1. THE GUARD CAUGHT A REAL ONE ON ITS FIRST CONTACT WITH main. main had gained `CNPGPrimariesCoLocated` (platform/cnpg/alerts.yaml) pointing at /runbooks/cnpg-primary-spread, with no runbook. The check failed the rebase exactly as designed — 46 annotations, 35 names, 34 present — naming both the missing file AND the missing configMapGenerator entry. runbooks/cnpg-primary-spread.md now exists: what co-located primaries actually cost here (blast radius, not an outage, because instances: 3 + required anti-affinity), why the drift is uncorrectable-by-declaration (CNPG has no primary-placement field), the readiness gate that keeps the rule quiet during a real node outage, and the ~9s-per-database switchover rebalance, one cluster at a time. The 2026-09-07 outage in which all three primaries sat on one node is the reason the alert exists at all. 2. WHOLE-REPO SCOPE, NOT A HAND-WRITTEN STAGE. main's refactor replaced ci/l0.sh's per-check "UNCONDITIONAL" stages with a declaration: `conformance.home.k3s/scope: "whole-repo"`, unioned into every gate run by Stage 3b's `--include-scope`. My +38-line Stage 3f is removed (ci/l0.sh is now byte-identical to main) and the annotation is declared instead. Assertion (7) of the check was rewritten to match: it no longer asserts its own path appears in ci/l0.sh — it asserts the test DECLARES the scope and that ci/l0.sh still passes --include-scope, since neither half alone makes the check load-bearing. That matters here because ci/touched-requirements.sh maps platform/monitoring/* to "R-OBS-01 R-OBS-02", not R-OBS-04, and maps platform/kubevirt/* and runbooks/* to nothing at all. 3. A FACTUAL CORRECTION IN ALL 35 RUNBOOKS. Every page claimed `dev.sh` defaults its current-context to k3s-dev. main's `9b4744d fix(devcontainer): dev.sh defaults to prod` made that false, and a runbook that misstates which cluster a command talks to is worse than one that says nothing. The pages now say what is durably true: the default has already changed once, so naming `--context k3s-prod` is what makes a command mean the same thing next month, and the per-invocation banner is there to be read. The check's own failure message was corrected the same way. Re-verified after all three: check green at 374 assertions (46 annotations, 35/35 runbooks present, 35/35 projected), re-applied to prod, and re-probed in-cluster through the Gateway — node-down, keycloak-down, keycloak-client-secrets, cnpg-archiving, longhorn-faulted, vpn-down, node-io and cnpg-primary-spread all HTTP 200 with text/plain; charset=utf-8 and 8.9-12.1 KB of real body; /runbooks/ index 200; an unknown name 404s with a pointer rather than a blank page; and homepage still answers the apex `/`, confirming Gateway API longest-path precedence. Full merge gate: PASS (spec-immutability, lint, l0, render-golden, l1 all green; prom-rules SKIPPED for want of promtool in the image; L2/L3 SKIPPED, no cluster). Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-13 00:00:24 -05:00
jakman85andClaude Opus 5	2f38b8156b	fix(arr): wire qBittorrent as a download client + Remote Path Mappings qBittorrent reports finished releases at /downloads/<name>; sonarr and radarr see the same inodes at /media/downloads/<name>, so Completed Download Handling could never resolve what the client handed it. Configured, on prod, via each app's own HTTP API: * download client qBittorrent -> qbittorrent.qbittorrent.svc.cluster.local:8080 (it did not exist in EITHER arr: both /api/v3/downloadclient returned []) * Remote Path Mapping /downloads/ -> /media/downloads/ for that host Both built from each app's /downloadclient/schema, matched on identity before writing, and re-running creates nothing. downloadclient/testall reports isValid=true in both. Proven with a negative control: Sonarr's queue showed outputPath=/downloads/... with the mapping deleted and /media/downloads/... with it present, for the same completed torrent. This state lives in sonarr.db / radarr.db on the config PVCs, NOT in git — a rebuild from git alone does not restore it. Recorded as a wart, with path agreement (repointing SavePath to /media/downloads) recommended as the durable fix and put to the operator rather than taken unilaterally. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:57:56 -05:00
jakman85andClaude Opus 5	44983095e1	feat(runbooks): make the 42 alert runbook_url annotations resolve Every platform-health alert rule carries `runbook_url: "https://${BASE_DOMAIN}/runbooks/<name>"` — 42 annotations over 34 distinct names, across platform/monitoring/alerts.yaml, platform/monitoring/pvc-capacity-alerts.yaml, platform/cnpg/alerts.yaml and platform/kubevirt/alerts.yaml. There was no runbooks/ directory and no HTTPRoute serving that path: an in-cluster probe of https://home.keithjackson.dev/runbooks/node-down returned HTTP 404. Every alert that reached a human handed them a dead link at the exact moment the documentation is read, and the annotation made it look solved — the same green-surface-over-absent-mechanism class as the import Job that reported success while storing placeholder secrets. No alerts.yaml is touched and no runbook_url value changes. The existing URL scheme is made to resolve instead. WHAT LANDS - runbooks/<34>.md — one per name, each grounded in this cluster's real topology and, where one exists, its real incident history: the 2026-09-07 k3s-prod-1 etcd I/O starvation (measured PSI 11.36 vs 0.75/1.29, the exact journal lines, the four mechanisms proven inert), the Longhorn reboot tax and the freeze/thaw of concurrent-replica-rebuild-per-node-limit, Cilium's once-resolved egress interface cache (Ifindex 3 against a live 1780) and the absence of OSS failover, the CNPG 38-hour ContinuousArchiving=False with its measured 6.8 MiB/h disk-full clock and the 2026-09-12 aggregation-scope fix, the 2026-09-06 Keycloak lockout in which all 12 clients held literal placeholder secrets behind an entirely green cluster, the Velero R2 x-amz-tagging NotImplemented incompatibility and its v1.14.3-rc.2 pin, and swap re-enabling itself across reboots via systemd-gpt-auto-generator. Each page states what the alert means HERE, the first diagnostic commands, likely causes ordered by probability with a remediation each, and when to escalate or stop. - Every page uses FULLY-QUALIFIED resource names and says why: three CRDs register the kind `Backup` here, the bare short name resolves to Longhorn's (zero objects), so `kubectl get backup -A` prints "No resources found" on a cluster holding 6 Velero and 27 CNPG backups. Acting on that false negative is how a CLI quirk becomes data loss. - Every page states that kubectl only works via `infra/devcontainer/dev.sh run bash -c '...'` with an explicit `--context k3s-prod`, because dev.sh defaults its current-context to k3s-dev. - Pages also record which alert groups are INERT today (measured 2026-09-13: no Longhorn, cert-manager, Flux-controller or Hubble scrape job exists, so 13 rules evaluate against nothing) so nobody reads their silence as health. SERVING — runbooks/serving/ plus clusters/base/runbooks.yaml A two-replica nginx-unprivileged serving a ConfigMap generated from runbooks/*.md, at the apex `/runbooks` prefix, in its own non-gating post-platform Flux tier (dependsOn platform-config, wait:false) — the platform/homepage pattern, file for file. - The service catalog cannot express this route: ingressRoutes[].host is pattern-bound to a single DNS label plus the apex, so the bare apex is unrepresentable, and there is no path field. - Rejected: redirecting to the Gitea web UI. A runbook is read when the platform is broken, and Gitea is an app-tier workload whose own dependencies several of these runbooks document; Gateway API's RequestRedirect also has no "append .md" modifier, so it would need 34 hand-maintained ReplaceFullPath rules. - configMapGenerator maps each file to an EXTENSIONLESS key (node-down=node-down.md), so /runbooks/node-down is a plain static lookup with no rewrite rule. Served as text/plain: the namespace has DNS-only egress, so a CDN markdown renderer could not load anyway. - The tier declares NO postBuild.substituteFrom, deliberately: envsubst would run over the prose and silently empty every ${...} shell example (it fails open — the 2026-09-01 emptied Cilium k8sServiceHost). The HTTPRoute omits `hostnames:` and inherits the https-apex listener's, so nothing needs substituting. AUTH — PUBLIC, deliberately auth-mode=none. Gating these pages behind oauth2-proxy/Keycloak would make runbooks/keycloak-down unreadable when Keycloak is down and runbooks/keycloak-client-secrets unreadable during the exact 2026-09-06 failure mode. An operator who cannot log in is this route's primary reader. Content is operational procedure only, no secrets. The rationale is recorded in an annotation on the HTTPRoute so the route is left OUT of the Gateway ext-authz attachment when forward-auth enforcement lands. PROVEN — in-cluster probe through the Gateway on prod /runbooks/node-down HTTP 200 8613 bytes text/plain; charset=utf-8 /runbooks/keycloak-down HTTP 200 9378 bytes text/plain; charset=utf-8 /runbooks/cnpg-archiving HTTP 200 11729 bytes text/plain; charset=utf-8 /runbooks/longhorn-faulted HTTP 200 9135 bytes text/plain; charset=utf-8 /runbooks/vpn-down HTTP 200 11092 bytes text/plain; charset=utf-8 /runbooks/backup-failure HTTP 200 9604 bytes text/plain; charset=utf-8 HTTPRoute Accepted by io.cilium/gateway-controller on sectionName https-apex; the `/runbooks` prefix wins over homepage's apex `/` by Gateway API longest-path precedence. GUARD — conformance/tests/l0-static/alert-runbooks-resolvable (R-OBS-04) 363 offline assertions. It checks BOTH halves, because the regression is silent in both directions: an alert with a new runbook_url and no runbook links to a 404, AND a runbook committed without its configMapGenerator entry is in git, reviewed, merged, and still 404s in the cluster. Also asserts a quality floor so a stub cannot make the link look fixed, and that route/listener/nginx prefix agree with the annotations. Proven to fail, then reverted: a bogus runbook_url (2 FAIL), a runbook removed from the generator (1 FAIL), and a 31-byte stub (7 FAIL). Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:49:58 -05:00
jakman85	4865734c5f	merge: alert when a backup schedule has NEVER run, and when one is paused gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details VeleroNoRecentBackup could not see the failure that actually happened: velero-daily sat paused having never produced a successful backup, so velero_backup_last_successful_timestamp{schedule=...} did not exist and time() - <absent series> yields no series. Prod had no volume backups and nothing alerted, further masked by a resources-only schedule succeeding daily. No velero_* metric describes a Schedule OBJECT, proven by scraping a throwaway paused Schedule and finding zero lines, so this exposes the CRs via kube-state-metrics customresource_state and keys on defaultVolumesToFsBackup — the property, not a name list. Adds the repo's first prometheus rule-unit-test harness, mutation-checked both ways.	2026-09-12 23:49:26 -05:00
jakman85	b9f8807aa6	merge: whole-repo L0 invariants are DECLARED, not hand-wired per test The gate had been accreting one bespoke UNCONDITIONAL stage per whole-repo L0 test (3c/3d/3e), each repeating the same ~12-line rationale and each one something the next author had to remember to write. Forget it and the test runs only when some unrelated requirement happens to be touched. Tests now declare conformance.home.k3s/scope: whole-repo and run.sh unions them in via --include-scope; the three stages are deleted. 10 of 13 tests are whole-repo, 3 stay path-scoped with the path map widened instead (infra/* -> R-ENV-01, ci/* -> R-TEST-06). A new meta-test makes the bespoke pattern fail the gate if it creeps back, and a change under conformance/tests/<test>/ now attributes that test's own requirements, so weakening a test is gated by what it certifies. rc-3 (SKIPPED is UNWIRED, not green) is preserved and demonstrated; the incident narratives moved into the tests they describe rather than being deleted. Gate cost for a scoped change rises 20.7s -> 41.8s, a ceiling any empty-touched-set change already paid.	2026-09-12 23:49:26 -05:00
jakman85andClaude Opus 5	7057bbb711	fix(monitoring): alert when a Velero schedule has NEVER backed up, or is paused VeleroNoRecentBackup could not fire for the failure mode that actually happened. `(time() - velero_backup_last_successful_timestamp{schedule!=""}) > 243600` is the right SHAPE — per-schedule, un-aggregated — but Velero only creates that series once a backup for the schedule SUCCEEDS, and `time() - <absent series>` yields no series. So it detects "backed up once, then stopped" and is structurally INERT on "never backed up". Prod ran with `velero-daily` (the schedule carrying VOLUME DATA) paused and never-successful: no volume backups at all, nothing alerted, and it was masked because `velero-daily-resources-only` completed cleanly every 03:00, so every other backup signal read green while only Kubernetes objects were protected. A PromQL-only fix is impossible, verified rather than assumed: velero v1.18.1 exports 35 velero_ metric names and every one carrying a `schedule` label is created by a backup ATTEMPT, not by the Schedule object. A throwaway `paused: true` Schedule on prod produced ZERO velero_* series, and nothing exposes `spec.paused`. The fact is not in the TSDB, so the Schedule CRs are exported via kube-state-metrics' custom-resource-state collector — the path this repo already uses for kube_node_labels — as kube_velero_schedule_{created,paused,protects_volume_data,info}. Proven by running KSM v2.20.0 with this exact config against prod's API: the CRD list/watch rule the chart adds is MANDATORY, not cosmetic — without it KSM emits the CRS metrics as an empty set, silently. Three rules, all keyed on PROPERTIES rather than schedule names: * VeleroScheduleNeverBackedUp (critical) — a Schedule older than 36h with no successful backup ever. The 36h grace comes from creationTimestamp so a newly added schedule is not paged before its first run is even due. * VeleroSchedulePaused (warning) — the direct root-cause signal; a paused backup schedule must never be silently indefinite. * VeleroNoVolumeDataBackup (critical) — THE ANTI-MASKING RULE. Fires unless some schedule with spec.template.defaultVolumesToFsBackup=true succeeded in 36h, so a healthy resources-only schedule can never make the platform look protected. Reading the property that DEFINES volume protection (not a name list) matches platform/velero/volume-policies.yaml and survives renames. `or vector(0)` is load-bearing: `count(<empty>) == 0` returns no series and would be inert — absence of the exporter is deliberately the alarm. Adds the repo's first Prometheus rule-unit-test harness (platform/monitoring/tests/, wired as the `prom-rules` gate stage). It flattens the COMMITTED PrometheusRule CRs — never a copy — and pins every rule in the group both ways: quiet on today's healthy prod state, firing on the reconstructed bad state, with `for:` durations asserted. Two mutation checks confirm the tests are not vacuous: dropping `or vector(0)` and breaking the `unless on (schedule)` join each turn the suite red. This is the tool that makes both of this repo's recurring alert bugs — permanently-firing and structurally inert — provable offline, which neither yamllint, Kyverno, nor a healthy cluster can do. Proof of the fix is by construction; the live metrics cannot show it any more, because `velero-daily` was unpaused on 2026-09-12 and has since completed 2492/2492 items. The throwaway probe Schedule and the probe KSM deployment were deleted and the deletion confirmed; `velero-daily` remains unpaused. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:45:15 -05:00
jakman85andClaude Opus 5	5fa278f61c	fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant R-TEST-03 runs the conformance subset a change TOUCHES. That has one blind spot, and it is the worst-shaped kind: an invariant that quantifies over the whole tracked tree — or over subtrees ci/touched-requirements.sh's coarse path map keys to NOTHING (apps/, infra/, most of platform/) — cannot be selected BY the requirements a change touches, because the change most likely to break it attributes no requirement at all. Requirement-scoped selection then filters the check out of exactly that change. The repo's answer had been a hand-written "UNCONDITIONAL" stage per such check in ci/l0.sh: 3c flux-postbuild-substitution, 3d keycloak-client-secret-reconciler, 3e bulk-tier-distinct-from-replicated. Three near-identical 12-line rationales, three hardcoded check.sh paths, three copies of the same rc 0/3/* case block — and worst, a mechanism that failed SILENTLY, because whoever added the NEXT whole-repo invariant had to REMEMBER to write a stage, and if they forgot the check ran only when some unrelated requirement happened to be touched. A test now DECLARES the scope of its invariant and the runner enforces it: metadata: annotations: conformance.home.k3s/scope: "whole-repo" * conformance/lib/common.sh conf_dirs_for_scope(s) resolves the annotation. Carries the general rationale, once, instead of per stage. * conformance/run.sh --include-scope SCOPE unions declaring tests into select_dirs, still bounded by --layer. New --print-selection resolves the selection and exits, running nothing. * lib/run_l1_offline.py --unwired-scope: a SKIP of a declaring test exits 3, not 0. --summary-out: one step-summary line per executed check. * ci/l0.sh Stage 3b gains --include-scope whole-repo and an rc-3 arm. Stages 3c/3d/3e DELETED (-150 lines). * ci/l1.sh, ci/conformance.sh pass --include-scope too, so the next whole-repo invariant at ANY layer needs only the annotation. rc 3 SEMANTICS PRESERVED EXACTLY. A whole-repo check reporting "nothing to audit" is reporting that the tree it audits has VANISHED. The deleted stages called that "not a pass" and set the gate's rc=3; the runner now returns 3 and ci/l0.sh maps it to rc=3. A missing check file still degrades to not-green, never to silence. THE REASONING WAS RELOCATED, NOT DELETED. Each stage's incident narrative moved into the header of the test it describes, beside its scope annotation: the Cilium k8sServiceHost empty-substitution CNI outage (2026-09-01), 12 unusable Keycloak clients behind a green cluster (2026-09-06), and a multi-TB bulk volume landing on the 3-replica tier. AUDITED ALL 13 EXISTING l0-static TESTS, individually. 10 declare whole-repo scope; 3 are DELIBERATELY left requirement-scoped and say so in their own headers: * placeholder-guard-coupling — inputs are bootstrap/ + clusters/, both already mapped to a requirement it declares. Scoping cannot hide a breaking change. * dev-nodes-provisioned-as-code — inputs are infra/ and nothing else. * spec-immutability-enforced — inputs are ci/ and the read-only spec repo. The latter two were nonetheless under-gated because the PATH MAP was incomplete, which is the right place to fix a path-scoped invariant: infra/* -> R-ENV-01 added, and R-TEST-06 added to .gitea/\|ci/ (it is no longer an uncovered ID — spec-immutability-enforced carries the label, so attributing it no longer false-blocks the coverage gate). NEW conformance/tests/l0-static/whole-repo-invariants-wired (R-TEST-03) keeps the declarative mechanism honest for ALL declaring tests at once, replacing the three tests' individual "ci/l0.sh greps my own check.sh path" self-assertions. It proves the union EMPIRICALLY: with a requirement filter matching no test the L0 selection is empty, and with --include-scope it is every declaring test; a scope-declared synthetic SKIP exits 3 while an undeclared one exits 0; and a ci/.sh that hardcodes a check.sh path must belong to a test that also declares the scope, so the bespoke pattern cannot creep back. TASK 2 — a changed test attributes the requirements it CERTIFIES. ci/touched-requirements.sh gains detection rule 3: a change anywhere under conformance/tests/<test>/ attributes that test's own conformance.home.k3s/R- labels, read from its chainsaw-test.yaml. The content scan could not close this — it reads only added/removed lines, so it sees a change to the LABEL BLOCK but not to the test BODY, which is exactly the case that matters. Labels are read from HEAD or, failing that, from the BASE, so DELETING a test still attributes what it used to certify; otherwise removing the only verifier of a requirement is the cheapest way to make the gate stop checking it. Whole-line `#` comments are dropped first and *.md is untouched, honouring the existing "reference, not declaration" rules. Both changes are fail-closed: every one of them can only ADD tests or requirements to a run, never remove one. TESTS: new ci/tests/touched-requirements-test-attribution.test.sh (15 assertions) covers rule 3 — body-only edit, nested-fixture walk-up, test deletion, header-comment R-IDs not attributed, non-test paths unaffected, and both new path-map entries. The two existing suites still pass (39 assertions). `make -C ci test` runs all three. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:45:06 -05:00
jakman85	78d76fa089	merge: qBittorrent can finally write where the arrs can see it gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details qBittorrent's SavePath was /downloads and no such directory existed in the container, so the download client had no working destination and nothing downstream could see its output. It now mounts the same NFS export the arrs use, narrowed to the downloads subtree via subPath — one mount, so the EXDEV hardlink trap the bulk-tier test guards stays closed. PUID/PGID are load-bearing: the export is owned 1000:1000 and the image's default 911 is denied.	2026-09-12 23:36:48 -05:00
jakman85	9e7d919d12	merge: CNPG primaries spread one per node, and the condition is now reported All three primaries had re-concentrated onto prod-1 (the node with known etcd/Longhorn I/O contention), so losing it meant three simultaneous failovers. Two switchovers rebalanced them; semaphore-db deliberately stays on prod-1 as the lightest writer, saving a third write interruption. CNPG offers no role-aware scheduling — targetPrimary exists only under status — so the placement is CURRENT, NOT DURABLE: the next failover or rolling update can re-concentrate it. What is durable is CNPGPrimariesCoLocated, which reports the condition instead of leaving it to be found by hand.	2026-09-12 23:36:48 -05:00
jakman85andClaude Opus 5	9b4744d450	fix(devcontainer): dev.sh defaults to prod — dev is decommissioned gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details Every unprefixed './dev.sh run kubectl ...' pointed at the dev cluster, which was decommissioned on 2026-09-12. The banner cheerfully named dev and the command then hung or errored against a context that no longer answers, with nothing saying the cluster is gone. I hit this repeatedly tonight. CLUSTER=dev is still accepted rather than removed, because the dev VM disks were deliberately kept so the environment is reversible — but it now warns. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:33:12 -05:00
jakman85andClaude Opus 5	78bc53afc7	feat(qbittorrent): attach the downloads area of the bulk export — the chain was broken end to end qBittorrent was the one member of the download chain with NO media volume. Its live config said Session\DefaultSavePath=/downloads/ Session\TempPath=/downloads/incomplete/ Downloads\SavePath=/downloads/ while `ls /downloads` in the container returned "No such file or directory". The catalog entry declared exactly one volume — config at /config on longhorn — and carried a comment deferring the downloads volume "until OQ-2 is resolved". OQ-2 WAS resolved (schema 1.5.0 static bulk NFS PVs); plex, sonarr, radarr and nextcloud all took their mounts and qBittorrent's was simply never added. So the download client was writing, or failing to write, a path that did not exist — and anything it did create would have been invisible to sonarr/radarr, lost on every pod recreation, and consuming the node's ephemeral disk until then. WHAT THIS ADDS to catalog/qbittorrent.yaml (rendered into apps/wave-0): * storage[downloads]: class bulk, export /mnt/Storage/plex, subPath downloads, mountPath /downloads, 9Ti advisory. ONE mount of the SAME export sonarr, radarr (rw) and plex (ro) already consume, narrowed to the handoff subtree. * env PUID=1000 / PGID=3000. LOAD-BEARING, not cosmetic: the container ran as uid 911 and /mnt/Storage/plex/downloads is 0755 owned 1000:1000, so the export would have mounted cleanly and then failed every write with EACCES. Measured both ways on prod: a write as uid 1000 succeeded, the same write as uid 911 was denied. * podSecurityContext.fsGroup 3000, for the LONGHORN config PVC only, exactly as sonarr/radarr set it — fsGroup is a no-op on an in-tree NFS volume. WHY subPath AND NOT THE EXPORT ROOT AT /media (sonarr/radarr's shape): a download client has no business writing the library. The arrs need the root mount because THEY hardlink downloads/ -> tv/\|movies/ and link() is a same-MOUNT operation; qBittorrent performs no such link, so narrowing to downloads/ removes movies/, tv/ and photos/ from its mount namespace without removing any operation it performs. It is still ONE mount of the export, so the L0 assertion that no workload mounts one export twice (the EXDEV trap) holds — and the arrs' own link() stays intra-mount. Proven live: nlink 1 -> 2, same inode, no EXDEV, every step executed as uid 1000. NETWORK: nothing to grant and nothing to steer. An NFS PersistentVolume is mounted by the NODE KERNEL in the host netns — the established socket to 192.168.2.102:2049 is on the node's own LAN address, the pod netns has no socket to 2049 at all, and no CiliumNetworkPolicy on this cluster names that host or port. `ip route get 192.168.2.102` picks eno1 even on the tunnel-owning node, and Cilium's own egress map lists 192.168.0.0/16 as an Excluded CIDR for every vpn-class pod while 0.0.0.0/0 goes to the gateway. Public egress still exits the PIA address; the VPN guarantee is untouched. NOT CLOSED BY THIS COMMIT, deliberately: absolute paths still differ between this pod (/downloads/x) and the arrs (/media/downloads/x), so Completed Download Handling needs one Remote Path Mapping per arr. That lives in the arrs' own databases, not in git. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:32:03 -05:00
jakman85andClaude Opus 5	505083fded	feat(cnpg): alert when >1 CNPG primary shares a node — the drift CNPG cannot prevent `instances: 3` + `podAntiAffinityType: required` fixed the INSTANCE spread but moved the PRIMARY concentration from k3s-prod-2 to k3s-prod-1: all three primaries (keycloak-db-2, nextcloud-db-2, semaphore-db-2) ended up on one node, so losing it meant three simultaneous failovers. There is NO declarative fix, established from the CRD installed on prod (CNPG 1.30.0, clusters.postgresql.cnpg.io/v1) rather than from memory. Every spec.affinity field and spec.topologySpreadConstraints applies to "all the cluster's pods" and is not role-aware; spec.replica.primary names a Cluster object in a distributed topology, not a node; primaryUpdateMethod/switchoverDelay/primaryLease govern how a promotion happens, never where. `targetPrimary` exists only under STATUS, never spec — so `cnpg promote` is an imperative status patch by construction and there is nothing to put in git. The obvious workaround is worse than nothing: pod anti-affinity is only ever ...IgnoredDuringExecution while CNPG promotes by relabelling a RUNNING pod, and with 3 instances on 3 nodes it would leave the third instance unschedulable. So this commits the part that IS durable — visibility — and rebalances live. CNPGPrimariesCoLocated joins CNPG's own answer to "who is primary" (the <cluster>-rw Service selects only the primary) against the node: kube_endpointslice_endpoints carries endpoint_nodename + targetref_name, which two label_replaces lift into node/pod. Neither family works alone — cnpg_* metrics have no node label, and kube_pod_labels is EMPTY here (no kube-state-metrics label allowlist), so cnpg.io/instanceRole is not in Prometheus at all. `* on (namespace, pod) group_left () cnpg_collector_up` keeps an unrelated `-rw` Service from triggering it, and uses the one metric present for EVERY instance rather than the cnpg_pg_stat_ family that is missing for nextcloud-db. A Ready-node gate stops this becoming another permanently-firing alert: with three clusters on three nodes a node loss NECESSARILY co-locates two primaries, so the rule only speaks when the spread is actually achievable, and re-arms when the node returns. Proven both ways. Live: the expr returned {node="k3s-prod-1"} => 3 before, empty after, with the inner join still resolving all three primaries (quiet because false, not blind); loaded into prod's Prometheus as a throwaway `for: 1m` twin it went pending at +70s and firing at +130s. alerts.promtool-test.yaml pins four cases under promtool 3.14.0 (the exact version prod runs) and is mutation-checked — dropping the join, dropping the gate or shortening `for:` each makes a test FAIL. Rebalanced live, one cluster at a time: keycloak-db -> k3s-prod-2, nextcloud-db -> k3s-prod-3, semaphore-db deliberately LEFT on k3s-prod-1 (lightest writer, and that node has the known etcd/Longhorn I/O contention) — two switchovers, not three. Write outage measured with a `select txid_current()` probe, not estimated: 9.4s and 9.43s, one contiguous burst each. All three back to readyInstances: 3 with synchronous_standby_names = ANY 1 (...) and both standbys streaming/quorum. The placement is CURRENT, NOT DURABLE, and the alert is the point: the next failover or rolling update can re-concentrate the primaries, and now that gets reported instead of discovered by hand. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:32:03 -05:00
jakman85	df77affc23	merge: the nextcloud database has never been monitored gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details cnpg_metrics_exporter lacked CONNECT on the nextcloud database: an out-of-band REVOKE materialized its datacl and dropped PUBLIC's implicit CONNECT, which keycloak and semaphore still inherit. CNPG's API cannot express a database-level grant, so this follows the repo's existing level-triggered CronJob reconciler pattern rather than a one-shot Job that a rebuild would silently skip. CONNECT only; pg_monitor already carries the read access.	2026-09-12 23:28:23 -05:00
jakman85	501d587541	merge: CNPG DR alerts scoped to the cluster, and the hint that lied CNPGNoRecoverabilityPoint fired permanently on all six CNPG replicas because only the primary owns the backup catalogue; CNPGNoRecentBaseBackup had the same latent defect, held back only by a > 0 guard. Both now aggregate pod away and key on the cluster. The remediation text also told the on-call to run 'kubectl get backup', which reports no resources here.	2026-09-12 23:28:23 -05:00
jakman85andClaude Opus 5	bacb4c61ee	fix(cnpg): the alert told the on-call to run the command that lies CNPGNoRecentBaseBackup's own remediation hint said `kubectl get backup`. On this cluster longhorn.io, postgresql.cnpg.io and velero.io each register kind Backup, so the bare short name resolves to Longhorn's empty set and prints 'No resources found' while CNPG backups exist. An on-call following the alert that fires BECAUSE backups look stale would have been told, with authority, that no backups exist at all — and might re-bootstrap a database over good ones. Fully qualify it. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:28:12 -05:00
jakman85andClaude Opus 5	7880d84bce	fix(cnpg): grant cnpg_metrics_exporter CONNECT on the nextcloud database The CNPG metrics exporter could not CONNECT to the `nextcloud` application database, so every user-defined collector query against that target failed on all three instances: FATAL: permission denied for database "nextcloud" (SQLSTATE 42501) DETAIL: User does not have CONNECT privilege. The whole cnpg_pg_stat_* / pg_settings / pg_postmaster family was therefore MISSING for nextcloud-db while the scrape target still reported up=1 — the blind spot platform/cnpg/alerts.yaml's CNPGMetricsCollectorErroring was written to catch. It had been firing on all three pods; measured before this change, cnpg_pg_settings_setting had 765 series for keycloak, 765 for semaphore-db and ZERO for nextcloud-db. Nextcloud's database had never been monitored. Root cause is the live ACL, not the spec — all three Cluster specs bootstrap identically: nextcloud : datacl = {nextcloud=CTc/nextcloud} <- explicit, no PUBLIC entry keycloak : datacl = NULL semaphore : datacl = NULL A NULL datacl means PostgreSQL's defaults, which include CONNECT for PUBLIC, so keycloak and semaphore admit the exporter only by inheriting PUBLIC's implicit CONNECT. On `nextcloud` something ran the equivalent of REVOKE ALL ON DATABASE nextcloud FROM PUBLIC, which materialises datacl and drops that implicit entry. That REVOKE is in neither this repo nor DECISIONS-LOG.md — it was applied out of band, which is why the remedy has to be declarative rather than another hand-run psql. CNPG 1.30.0 cannot express a database-level GRANT (verified against the live CRDs): `Database` has no ACL field (`allowConnections` is the datallowconn flag, not a per-role grant), and managed.roles/DatabaseRole cover role attributes plus `inRoles` membership only — and membership would hand the exporter the owner's CREATE/TEMP and all table access to buy one CONNECT. postInitApplicationSQL runs once at bootstrap, so it cannot repair the already-bootstrapped instances that are actually broken. So this follows the pattern the repo already uses for state Flux cannot reach: the level-triggered CronJob reconciler alongside platform/keycloak/client-secret-reconciler.yaml. A one-shot Job is deliberately avoided — a completed Job never re-runs, so a rebuild or PITR restore would silently reopen the blind spot. Exactly one privilege, and nothing else: GRANT CONNECT ON DATABASE nextcloud TO cnpg_metrics_exporter; giving `cnpg_metrics_exporter=c/nextcloud` — CONNECT only, no CREATE, no TEMPORARY, no ownership, no superuser, no table or schema grants. Nothing more is needed because CNPG already creates the role as a member of the built-in pg_monitor role (verified on all three clusters), which carries the read access the collector's pg_catalog queries want. It runs as the database OWNER, not a superuser: enableSuperuserAccess stays off, and a database owner holds the grant option on its own database. Verified live on prod: * the grant issued under SET ROLE nextcloud, proving no superuser is needed; * permission-denied and "Error collecting user query" both went to 0 on nextcloud-db-1/-2/-3, i.e. every collector query now succeeds; * cnpg_pg_settings_setting now 765 series for nextcloud-db, matching the other two, and cnpg_pg_postmaster_start_time present on all three instances; * cnpg_last_error = 0 on all NINE instances, so keycloak-db and semaphore-db are unaffected and their datacl is still NULL; * convergence proven by revoking the grant again and letting the committed CronJob restore it, then re-running it against a converged database to show idempotence; * CNPGMetricsCollectorErroring, firing on all three pods beforehand, has cleared (`for: 6h` delays firing, not resolution). Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:22:27 -05:00
jakman85andClaude Opus 5	5e7ab65c65	docs: kubectl get backup lies on this cluster — ambiguous Backup short name Three API groups register kind Backup (longhorn, cnpg, velero). The bare short name resolves to Longhorn's empty set, so kubectl reports absence while 27 CNPG backups and live Velero backups exist. A false negative on 'do I have backups' is the worst possible time to be wrong, so record the rule: fully-qualified resource names only. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:15:06 -05:00
jakman85andClaude Opus 5	21491f901b	fix(cnpg): scope DR alerts to the CLUSTER, not the pod — stop a permanent false positive CNPGNoRecoverabilityPoint has been firing continuously on prod against six pods — keycloak-db-1/-3, nextcloud-db-1/-3, semaphore-db-1/-3 — i.e. exactly the REPLICAS of all three Clusters, while the databases themselves are fine: every Cluster reports firstRecoverabilityPoint=2026-09-07T07:0x, a lastSuccessfulBackup within the last few hours, ContinuousArchiving=True and LastBackupSucceeded=True. Root cause is aggregation scope, not archiving. `cnpg_collector_first_recoverability_point` reads the backup CATALOGUE, which only the primary owns; a replica reports a hard 0 for as long as it is a replica. The metric carries no cnpg.io/cluster label (its label set on prod is container/endpoint/instance/job/namespace/pod), so `max by (namespace, pod)` evaluated each replica as its own subject and an `== 0` comparison then held forever. The rule went from correct to permanently wrong the moment the Clusters went to `instances: 3`; nothing about the expression changed. WHY THIS IS WORSE THAN HAVING NO ALERT. An alert that is always firing has zero information content: its value is identical in the healthy state and in the failure state, so it cannot distinguish them. It is worse than silence in two specific ways. First, it trains the operator to delete the notification on sight, so the day a base backup genuinely stops the seventh identical email is discarded with the other six — the alert actively MASKS the failure it was written to catch, which for a DR alarm means discovering the loss at restore time. Second, it is indistinguishable from a broken alert, so nobody can tell whether the absence of new alerts means health or means the rule rotted. This file exists because a real 38-hour archiving failure told nobody; a rule that cries wolf about six healthy replicas rebuilds exactly the blindness it was supposed to remove. This repo has been here before — see the permanently-firing critical VPNTunnelDown post-mortem in platform/monitoring/alerts.yaml. Fix: group by (namespace, job) and aggregate `pod` away. The CNPG operator creates one PodMonitor per Cluster, named after the Cluster, in the Cluster's namespace, so prometheus-operator derives job="<namespace>/<cluster>" — keycloak/keycloak-db, nextcloud-db/nextcloud-db, semaphore-db/semaphore-db — which identifies the CNPG Cluster uniquely. `job` rather than bare `namespace` deliberately: namespace alone works today (one Cluster per namespace, verified live) but would let two Clusters in one namespace mask each other, since the healthy one's non-zero value would satisfy `max` for both. The alert now states what its summary always claimed — this CLUSTER has no recoverability point — and fires only when no instance of that Cluster reports one. Proven live against prod Prometheus, read-only (promtool query instant): OLD max by (namespace, pod) (...) == 0 -> 6 series, and 6 ALERTS firing NEW max by (namespace, job) (...) == 0 -> empty The new expression is not vacuous: forcing the metric to 0 for one cluster's primary only yields exactly one series, {job="keycloak/keycloak-db"}, so a genuine single-cluster loss of DR still alerts, per cluster. `promtool check rules` passes on all 5 rules. CNPGNoRecentBaseBackup carried the same defect and is fixed the same way. `cnpg_collector_last_available_backup_timestamp` is also primary-only: on prod the primaries read 3.1h/2.1h/0.1h old while all six replicas read 0, i.e. time()-0 = ~56.7 YEARS. It was not firing only because the `> 0` guard was load-bearing — a single clause was all that stood between this rule and six more permanent false positives, too thin a margin for a DR alarm. Aggregating `pod` away removes the dependence: `max` takes the primary's timestamp as the cluster's answer, and the guard now means "this cluster has had at least one backup". Verdict unchanged live (old empty, new empty). The other three rules were audited and deliberately left on `by (namespace, pod)`: * CNPGWALArchiveBacklog — every instance reports archive_status and the shape is `> 0`, so a replica at 0 never fires and no pod can mask another; `pod` names the instance whose archiver is stuck. * CNPGWALVolumeNotRecycling — per-pod is REQUIRED, not merely safe: aggregating it away would compare one instance's WAL count against another's max_wal_size. * CNPGMetricsCollectorErroring — unchanged in meaning AND grouping. Its grouping is already correct: cnpg_last_error is genuinely per-instance, and prod proves it discriminates rather than tracking role — all three nextcloud-db pods report 1 while all six keycloak/semaphore pods report 0. It is a true positive (the nextcloud 42501 CONNECT grant) owned by separate work; nothing here silences or rescopes it. The general rule, recorded in the file: `== 0`/staleness shapes must aggregate `pod` away or every structurally-silent pod fires forever; `> 0` shapes are safe per-pod and keep the instance name. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 23:09:53 -05:00
jakman85andClaude Opus 5	ebce6dfabb	docs: the Flux->Gitea allowance is rendered and Flux-adopted — debt closed gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 22:58:39 -05:00
jakman85	eda4a9f674	merge: the Flux->Gitea allowance is rendered, not hand-applied gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details	2026-09-12 22:51:35 -05:00
jakman85andClaude Opus 5	d617983e83	feat(gitea): render gitea-allow-flux-ingress — prod's GitOps source, in git at last The CNP that lets flux-system's source-controller clone from the in-cluster Gitea Service was APPLIED LIVE on prod on 2026-09-13 and existed nowhere in this repo. It carried a provenance annotation saying so. Until now it could not be authored: the gitea CNPs are GENERATED from the catalog entry, and the contract had no field for "also admit this in-cluster client" (fixed in the previous commit). Why it matters more than a missing allow normally would. prod's GitRepository points at the Service, not a public name (clusters/prod/kustomization.yaml: `url: http://gitea.gitea.svc.cluster.local:3000/Home-Network/home-network-k3s-impl.git`), deliberately, so prod's GitOps depends on neither public DNS, Cloudflare, prod's own Gateway nor ${BASE_DOMAIN}. But gitea-allow-gateway-ingress admits only `fromEntities: [ingress]`, so source-controller's clone was dropped — and the HTTPRoute that would have served the post-apex-flip public name instead lives in a DOWNSTREAM tier that cannot apply while the source is down. Source down -> routes never rename -> source stays down. Every `kubectl delete cnp` and every cluster rebuild re-armed that deadlock, and it would have been extremely hard to diagnose cold. The rendered object is EQUIVALENT to the live one — same apiVersion/kind, same name/namespace/labels, and a byte-identical spec (endpointSelector app.kubernetes.io/name=gitea; fromEndpoints matchLabels k8s:io.kubernetes.pod.namespace=flux-system; toPorts 3000/TCP), verified against `kubectl --context k3s-prod -n gitea get cnp gitea-allow-flux-ingress -o json`. The name matches, so Flux ADOPTS the live object in place: no spec change, so no policy recompute and no flap on prod's own source. The only difference is that the rendered object carries no `homelab.keithjackson.dev/provenance` annotation — the reasoning now lives where the object is authored, in catalog/gitea.yaml, next to the field that generates it. Golden re-rendered with the canonical command; the whole apps/ diff is the one new document. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 22:46:57 -05:00
jakman85andClaude Opus 5	1f20506829	feat(renderer): inClusterClients — authorable direct east-west ingress (schema 1.5.0) A platform controller that dials a service's ClusterIP directly had NO authorable form in the ServiceDefinition contract: * ingressRoutes renders the north-south allow only — gateway-ingress admits `fromEntities: [ingress]`, the Gateway's Envoy identity, and nothing else; * dependencies compiles edges only BETWEEN CATALOG SERVICES, from the source entry's own declaration. Under the default-deny baseline (R-NET-01) such a client is therefore DROPPED, and the only way to unblock it was a live `kubectl apply` of a hand-written CNP — a cluster object outside git, one `kubectl delete` or one rebuild from coming back. `inClusterClients: [{namespace, port, protocol?, name?}]` closes that. Each entry renders ONE least-privilege ingress CiliumNetworkPolicy: this service's endpointSelector, `fromEndpoints` matching ONLY `k8s:io.kubernetes.pod.namespace`, `toPorts` carrying ONLY the declared port/protocol — never `fromEntities: all`. Additive: the namespace default-deny keeps denying everything undeclared (R-NET-02), and the entry is NOT a dependency edge, so it creates no wave ordering. Shape notes: * selected by NAMESPACE, not pod labels: an upstream controller's labels belong to its chart, not to this platform's contract. The cost is explicit — every pod in that namespace is admitted on that port, so the field is for platform-controller namespaces (flux-system, monitoring), never a shared one. The schema description says so. * optional `name` (default: the namespace) only names the rendered policy, `<service>-allow-<name>-ingress`. That name is operator-facing (kubectl get cnp, a Hubble drop), and pinning it lets an allowance that already had to be applied live be authored under its EXISTING name, so Flux adopts the live object in place instead of creating a near-duplicate and leaving the original unmanaged. * one field, not a policy DSL: no arbitrary selectors, entities or CIDRs. Covered by render.py --selftest (4c): name/namespace/selector/port shape, no fromEntities widening, default-deny still `ingress: []`, the gateway allow not displaced, `name` defaulting to the namespace, and nothing rendered when the field is absent. No golden changes here — no catalog entry uses the field yet. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 22:46:57 -05:00
jakman85andClaude Opus 5	a863542bf7	docs: record the apex migration, the GitOps deadlock, and the live-only policy Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 22:37:58 -05:00
jakman85andClaude Opus 5	f252ecec25	fix(gitops): prod's source is the in-cluster Service, not a public name gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details The apex flip deadlocked prod's GitOps and this is the durable fix. The GitRepository pointed at a public hostname. The flip renamed prod's HTTPRoute hostnames, so that name stopped serving — but the HTTPRoute that would serve the new name lives in a DOWNSTREAM tier which cannot reconcile while the source is broken. Source down -> routes never rename -> source stays down. Observed live: srcReady=False, "unable to list remote for https://gitea.home.keithjackson.dev". Pointing at gitea.gitea.svc.cluster.local:3000 removes the cycle permanently: prod's GitOps no longer depends on public DNS, Cloudflare, its own Gateway, or ${BASE_DOMAIN}. No future domain change can sever prod from its own source. Plain http is deliberate: cluster-internal traffic to a ClusterIP, TLS terminates at the Gateway for external clients, the GitRepository has no secretRef (anonymous clone), and all secrets are SOPS-encrypted at rest regardless of transport. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 22:14:27 -05:00
jakman85andClaude Opus 5	ae37e27f14	fix(gitops): move prod's own Git source with the apex flip gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details The GitRepository url is a hardcoded literal, not templated on ${BASE_DOMAIN}, so the apex flip did not carry it. But the flip renames prod's HTTPRoute hostnames, so external-dns (policy=sync) deletes gitea.prod.home.keithjackson.dev and CoreDNS's split-horizon zone moves from prod.home. to home. — which would have severed prod from its OWN GitOps source moments after the flip reconciled. Landed in the same push as the flip deliberately: prod has not yet fetched `9161cab` (still on `b9c0970`, all hostnames still prod.home.), so both commits arrive in one fetch and the url changes in the same apply that renames the routes. A live patch would not survive — the root Kustomization renders this very file and reverts it. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 22:10:57 -05:00
jakman85andClaude Opus 5	9161cab9cd	feat(dns): prod takes the apex — home.keithjackson.dev gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details Dev is decommissioned and has released the name. Prerequisites completed and verified BEFORE this flip: 1. dev's 18 A records released by its own external-dns (policy=sync; sources deleted after suspending dev's Flux so they could not be recreated). 2. dev's 18 LEGACY UNPREFIXED TXT registry entries deleted from Cloudflare by hand. external-dns v0.21.0 deleted only the `a-` prefixed form and then logged "All records are already up to date" — it would NEVER have cleared the older unprefixed format it no longer writes but still READS for compatibility. They carried `owner=default`; prod runs `owner=prod`, so prod could not have claimed these names while they existed. This was the real blocker, and it was invisible until measured. 3. dev's `.home.keithjackson.dev` + apex Certificate deleted so it stops renewing. Issued ~18d ago, so prod's request is #1 this week against LE's duplicate limit (5 per identical name set per week). Verified at the AUTHORITY (betty.ns.cloudflare.com), not via a resolver: 1.1.1.1 served stale TXT for minutes after deletion and would have shown a false failure. UNCHANGED, deliberately: EXTERNALDNS_TXT_OWNER_ID stays `prod` — giving prod `default` would let it adopt and sync-delete records it does not own, which is the 2026-09-04 incident. EXTERNALDNS_DOMAIN_FILTER stays the ZONE `keithjackson.dev`: finding F-DNS1 proved a strict subdomain filter drops the hosted zone and external-dns then publishes NOTHING. The zone has wildcards `.keithjackson.dev` and `.home.keithjackson.dev` pointing at the public IP (legacy non-k3s prod). Dev's specific records were shadowing the latter; prod's new specific records shadow it again. The legacy stack lives on `.keithjackson.dev` and is untouched. k3s_base_domain moves with it to hold the [parity] contract, but that value renders the apiserver's install-time oidc-issuer-url: it does NOT take effect until the k3s_server role re-renders config.yaml and k3s is restarted serial: 1. Until then the apiserver trusts the OLD issuer while Keycloak serves the NEW one, so kubectl OIDC fails in that window. Cert-based kubeconfigs are unaffected. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 22:07:20 -05:00
jakman85	b9c0970232	merge: Keycloak client URLs reconcile, not just secrets gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details	2026-09-12 21:35:15 -05:00
jakman85andClaude Opus 5	f7d4648851	docs(keycloak): record the URL-reconciliation decisions Records K1-K9: extend-vs-sibling and why, the generated+gated desired state, verbatim token pass-through, per-pass fail-closed, order-insensitivity, unmanaged-means-untouched, public clients' URLs managed, one alert pair not two, and the mutation harness. Also records a process note: my first pass reported three false findings (reconciler absent from main, import not templated, BASE_DOMAIN dead) because I diffed against origin/main -- origin is dev's Gitea, stale at `4809199`, while the live remote is prod-gitea at `fa4deac`. All three were wrong. The rule for this repo is written down so the next agent does not repeat it: origin is not the source of truth. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 21:31:26 -05:00
jakman85andClaude Opus 5	6202d92c27	test(conformance): gate the URL desired state, and prove the selftest can fail L0 (212 assertions, was 175): * runs ci/render-keycloak-client-urls.py --check, so client-urls.yaml must be exactly what the realm import renders. A hand edit that makes the two disagree is unmergeable -- this is what keeps the realm import the single source of truth for hostnames rather than just the place they were first typed. * asserts client-urls.yaml and the realm import are rendered by the SAME Flux Kustomization. postBuild.substituteFrom is per-Kustomization, so a split would let one ${BASE_DOMAIN} resolve to two different values and the realm would converge on a hostname the HTTPRoutes do not serve. * asserts the desired state uses no substitution token the realm definition lacks, names only clients the import declares, and declares no field outside the five-field write surface; that the CronJob mounts it readOnly at the path the script defaults to; and that the script, renderer and check agree on which fields are writable. * NEW mutations.py: injects 12 plausible regressions into the EXTRACTED script and requires --selftest to catch every one. A passing suite proves nothing if it cannot fail, and "reported success while the realm was broken" is precisely what this component exists to end -- so the same standard applies to its own test. ~20s. L2: the audit Job now mounts keycloak-client-urls and asserts KEYCLOAK_CLIENT_URLS_AUDIT_OK. Without that it would pass on a realm still holding pre-migration redirect URIs -- the exact state prod was measured in. Alerts: the existing Failing/Stale pair is EXTENDED to name redirect-URI drift, not duplicated. One CronJob gets one pair; a second pair on the same job_name regex would fire twice for one cause. No new critical, no new permanently-firing rule. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 21:26:12 -05:00
jakman85andClaude Opus 5	23ea72d01e	feat(keycloak): reconcile client redirect URIs, not just client secrets The realm import is a one-shot that never re-runs, so a redirect URI changed in git reaches the realm never. Prod's stored URIs were measured still on the pre-migration hostname while git declared the new one -- after a BASE_DOMAIN flip every OIDC login fails with a redirect_uri mismatch, with the CR still reading Done=True and nothing alerting. Same failure class as the literal-placeholder secrets, same cure. EXTENDS the existing reconciler rather than adding a sibling. Decisive reason: a URL write needs NO new endpoint. It is the same minimal client PUT, and the current URLs already come back in the allow-listed client lookup -- so the allow-list is widened by nothing and the users/groups/roles/authentication guarantee is preserved unchanged rather than re-declared in a second copy. The ConfigMap also carries exactly one script key by L0 contract, so a sibling would have had to fork ~300 lines of safety-critical code that the header explicitly forbids forking. Reconciles redirectUris, webOrigins, rootUrl, baseUrl, adminUrl -- only the fields a client actually declares, and on a write only the fields that actually drifted. A field the desired state omits is UNMANAGED and left untouched; absence never means force-to-empty. THE TWO PASSES ARE INDEPENDENT. Each reads its own desired state and fails closed for its own fields only. A malformed URL ConfigMap cannot stop client-SECRET repair, which would otherwise make credential healing depend on a hostname file. List fields compare order-insensitively (sorted, not set -- duplicates are still drift), because Keycloak does not preserve the authored order of redirectUris and an order-sensitive compare would rewrite every client forever while reporting success. --selftest grows to 84 assertions covering the domain flip, a client gaining a URI, a client losing a stale one, a public client's URLs being managed while its secret is not, per-pass fail-closed, order-insensitivity, and a server that accepts a PUT without applying it. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 21:25:34 -05:00
jakman85andClaude Opus 5	51d8676f90	feat(keycloak): render the client-URL desired state from the realm import The realm import is a one-shot: once Done=True it never re-runs, so a redirect URI changed in git never reaches the realm. Healing that needs a DESIRED STATE the reconciler can read -- and the reconciler pod has no Kubernetes API access at all (automountServiceAccountToken: false), so it cannot read the KeycloakRealmImport CR. Its desired state must be mounted, hence a ConfigMap. A hand-authored ConfigMap would be a second source of truth for every public hostname in the realm, free to disagree with the import -- the same shape as the bug being closed. So it is GENERATED from the import and the render is gated, the same render==golden idiom catalog/render.py already uses for apps/. URL strings are copied VERBATIM: a ${BASE_DOMAIN} token in the source appears unchanged here, and both files are rendered by the SAME Flux Kustomization (./platform-config), so both are substituted in one pass with one value. The renderer never parses a hostname and never reads cluster-vars, so there is no second place the domain can be decided. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 21:24:52 -05:00
jakman85andClaude Opus 5	fa4deac877	fix(conformance): the dirty-tree assertion must judge HONOURED evidence gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details One historical `-dirty` row reddened this gate permanently, even after a clean re-run of the same test. status.py already resolves duplicates latest-wins (latest_by_test), so a superseded row is not evidence of anything — but this check iterated every row, so the poisoned row from the git_sha bug (fixed in the parent commit) would have failed the audit forever. The dirty-tree assertion is now scoped to rows status.py would actually honour, by importing latest_by_test rather than reimplementing the rule, so the two cannot disagree about which rows are live claims. Structural assertions — provenance keys, sentinel, test-still-exists — still apply to EVERY row. Nothing is erased: the row stays in the ledger and runs/20260913T014437Z-19fc8bc/ run.log stays committed. It simply stops being read as a live claim. Verified the guard is intact afterwards — the check still REFUSES both forgeries it is built to catch (a self-skip presented as a pass, and a proven row from the root commit). A dirty-then-clean sequence is also the normal shape of noticing a dirty tree, fixing it, and re-running; that should not permanently fail an audit. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 21:12:55 -05:00
jakman85	a317493bca	merge: R-NET-06 re-proven on prod (recovery in <=3s)	2026-09-12 21:10:57 -05:00
jakman85andClaude Opus 5	c66a7e29e9	fix(conformance): the harness contradicted itself in two places 1. auditability-proofs-producible rejected any proven ledger row without a sentinel, with no layer exemption — while record_run.py DELIBERATELY records L0/L1 rows sentinel-less via its own SENTINEL_EXEMPT_LAYERS, because run_l1_offline.py renders skips as JUnit <skipped/> and those layers have no pass token to attribute. So ANY `--record` run touching L0 or L1 wrote a row this gate then rejected. Consequence: a requirement whose verifier set includes an L1 check could never be both PROVEN and L0-green — R-NET-06 is exactly such a requirement, and hit it the moment it was re-proven on prod. The check now honours the same constant instead of restating the policy, so the two halves cannot drift apart again. 2. git_sha() marked the tree dirty from tracked files, but conformance/runs/ ledger.jsonl IS tracked — so the FIRST `--record` run of a session dirtied the tree and every LATER run was stamped `-dirty`, which check.sh then refuses to honour. Recording one test poisoned the next, and that cost a second live fault-injection run against prod to work around. Its docstring already stated the intent for the untracked runs/<id>/ half of the same artifact; the ledger is the tracked half. Now excluded via pathspec, mirroring status.py's IMPL_EXCLUDE_PREFIXES which already lists this path for the same reason. Neither change weakens an assertion: (1) applies an exemption that already existed and was already documented, (2) stops the recorder invalidating its own output. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 21:10:38 -05:00
jakman85andClaude Opus 5	155df8ee3f	test(conformance): R-NET-06 PROVEN on prod — vpn-killswitch re-run from a clean tree Supersedes the -dirty row from the previous commit by the ledger's own append-only / latest-wins convention (lib/status.py latest_by_test): nothing is rewritten, a newer row simply outranks the older one. runs/20260913T014923Z-9d0814a vpn-killswitch (L3) proven env=prod git_sha 9d0814ae... (CLEAN — resolvable, so the freshness check passes) Fault injection against LIVE prod, gateway k3s-prod-3. Timeline (UTC): 01:49:27 tunnel-stop Job applied 01:49:31 Job succeeded — host vpn-egress-tunnel STOPPED, tun0 gone 01:49:31..01:51:01 vpn-class blackholed for 8 consecutive polls, NO response of any kind; internet-class unaffected on the WAN 01:51:02 self-healing finally: tunnel-restart Job 01:51:05 kubectl wait confirms the host brought the unit back 01:51:04 egress-uplink label AND the BPF egress map both move 134 -> 139 (measured independently, out of band, during the run) 01:51:08 vpn-class egress back on PIA 158.173.241.11 RECOVERY WAS UNAIDED and took ~3s from tunnel-up to a re-steered datapath — far inside the ~2-minute convergence timer, so the EVENT-DRIVEN up-script path did the work, not the timer backstop. This is the half that was previously unprovable: before the egress-uplink label, Cilium held the stale ifindex and vpn-class egress never came back. WHAT THE NO-LEAK ASSERTION DOES AND DOES NOT PROVE: it proves vpn-class fails CLOSED (zero packets out, never the WAN IP). It does NOT credit the host nftables backstop, which provably cannot fire for pod traffic — bpf_redirect() skips netfilter. Stopping the tunnel removes tun0 and Cilium drops on its own because the cached egress ifindex is unusable. Fail-closed is real; the mechanism is Cilium's drop, as the test header now says. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 20:52:47 -05:00
jakman85andClaude Opus 5	9d0814ae61	test(conformance): R-NET-06 run against prod — L1 proven, L3 pass recorded -dirty Two recorded runs against PROD (CONF_ENV=prod, context k3s-prod): 20260913T014321Z-19fc8bc egress-class-render (L1) proven 20260913T014437Z-19fc8bc vpn-killswitch (L3) proven, but git_sha -dirty The L3 run PASSED for real on prod — every declared sentinel present (NS_PRIVILEGED_OK, TUNNEL_HEALTHY_OK, NO_LEAK_OK, INTERNET_UNAFFECTED_OK, TUNNEL_SELF_HEAL_OK, TUNNEL_RECOVERED_OK), tunnel stopped 01:44:48Z and recovered unaided by 01:46:25Z. Its row is nevertheless NOT usable as proof: git_sha carries `-dirty`, so status.py's ancestry check cannot resolve it and the row degrades to stale-proof. Cause is a harness flaw, not the cluster: lib/record_run.py's git_sha() ignores UNTRACKED files (so a run's own runs/<id>/ does not mark it dirty) but conformance/runs/ledger.jsonl is TRACKED — so the FIRST --record run of a session appends a row, dirties the tree, and every SUBSEQUENT --record run in that same session is stamped -dirty. Recording one test poisons the proof of the next. Committed as-is rather than rewritten: the ledger is append-only and this is honest evidence of a real run. A clean re-run follows and supersedes it by latest-wins (lib/status.py latest_by_test). Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 20:48:55 -05:00
jakman85	19fc8bcb27	merge: VPN egress gateway on prod, plus three datapath fixes gate / gate (push) Has been cancelled Details gate / conformance (push) Has been cancelled Details	2026-09-12 18:15:02 -05:00
jakman85andClaude Opus 5	53e09a2610	docs(vpn): dev recovered the minute prod left the shared PIA server Closes the loop on the collision entry with the recovery evidence rather than leaving it as an open question for the operator: dev's last Inactivity timeout is 23:05:06 UTC — the minute prod switched to .135 — and at 23:12:03 that same session was still the live one, seven minutes unbroken against a two-minute cycle, 4/4 ping replies at 146 ms, 0% loss, and vpn-class pod egress back to 158.173.241.36 on three consecutive probes. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 18:12:46 -05:00
jakman85	9b97e073e2	merge: main (velero R2 + arr config PVC) into feat/vpn-egress-prod	2026-09-12 18:11:18 -05:00
jakman85andClaude Opus 5	38e4bf1459	docs(vpn): record the PIA server collision, and the accidental proof it handed us The stand-up broke dev, so the "one gateway per PIA server" rule and the measurement behind it are now written down where the next person will look: platform/vpn-egress/README.md and the session's DECISIONS-LOG entry. Both carry the verbatim journal lines — same server, same pushed `ifconfig 10.72.192.7` on both gateways — and the flap timestamps, because "same account, inside the connection limit" is true and is exactly what makes this non-obvious. Also corrected: the dev/prod table now shows the two environments on different servers with different exit IPs (dev 158.173.241.36, prod 158.173.241.11), and the open item about them sharing one public IP is replaced with the real remaining decision — whether prod gets its own PIA account, which would remove the hand-maintained per-environment server value entirely. The unplanned bonus, recorded in both places: moving prod to .135 gave it a genuinely NEW tunnel address on a real reconnect (10.72.192.7 ifindex 128 -> 10.150.192.86 ifindex 129) — the precise case Cilium does not follow and the one defect 1 was about. The egress-uplink label moved on its own, Cilium re-resolved, and all four vpn-class workloads kept egressing with no manual step. Better evidence than the synthetic address swap used to characterise it, and it cost nothing to capture. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 18:09:31 -05:00
jakman85andClaude Opus 5	37a6c94168	fix(vpn): two gateways on one pinned PIA server evict each other every 2 minutes Standing up prod broke dev, and the mechanism is worth spelling out because "same PIA account, well inside its connection limit" is true and still not enough. The vaulted .ovpn pins ONE server. With both gateways using it, dev and prod landed on the SAME server AND were handed the SAME tunnel address — both journals read `[Server-10779-2a] Peer Connection Initiated with [AF_INET]158.173.241.112:1198` and `ifconfig 10.72.192.7 255.255.192.0`. Each reconnect steals that address on that server; the loser then receives nothing, trips `--ping-restart` after 60s, reconnects and steals it back. Measured cycle: dev restarting at 22:57:05, 22:59:03, 23:01:05 UTC with prod interleaved about a minute off, each ~2 minutes apart, indefinitely. Neither environment had reliable vpn-class egress — prod's probes looked green only because they happened to land inside an up-window. Fix: `vpn_egress_gateway_pia_remote` ("<host> <port>", empty = honour the .ovpn) rewrites just the `remote` line of the deployed .ovpn, and prod's group_vars sets it to 158.173.241.135. That is another member of the same PIA Stockholm LB pool — `sweden.privacy.network` resolved from k3s-prod-3 to 158.173.241.{34,55,112,135,239} — and every server in the pool takes the same credentials and the same inline CA, so only the address differs. Dev keeps the .ovpn's .112 untouched, which is why the override is per-group rather than in the role or a second vaulted .ovpn. Two details that matter for whoever touches this next: * The regex is anchored to a line STARTING with `remote` plus whitespace, so `remote-cert-tls` and `remote-random` are not collateral damage. The task keeps `no_log: true` — the transformation never widens what is logged. * A PIA server address is NOT a credential, so it lives in group_vars/vpn_egress_gateway_prod/vars.yml in the clear, next to the vault rather than inside it. Keeping it out of the vault is what makes it reviewable. If prod ever gets its own PIA account, this override can be deleted again. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 18:05:49 -05:00
jakman85andClaude Opus 5	04606d48b2	docs(vpn): stop crediting the nftables kill-switch for a drop it never makes Four places in the tree told the reader that the host nftables table is the authoritative fail-closed backstop for egress-class=vpn pods: platform/vpn-egress README, egress-steering.yaml, the role README, and the vpn-killswitch test's own GIVEN/THEN prose. It is not, and cannot be — Cilium's eBPF egress-gateway datapath bpf_redirect()s those skbs to the egress device without invoking netfilter POSTROUTING. Corrected with the measurement in each place rather than softened, because a guard the repo trusts and that does not fire is worse than no guard. What replaces the claim, everywhere: vpn-class fails closed because CILIUM drops the traffic when it cannot use its cached egress interface, verified by tcpdump on both the WAN and tun0 during a tunnel stop and a tunnel restart (0 packets out either). The nft table keeps a narrower, now-proven job: node-originated traffic sourced from a tunnel address (killswitch_drop moved 0 -> 3 packets on k3s-prod-3 when such a packet was routed at the WAN). Also recorded: * egress-steering.yaml — `interface: tun0` is resolved ONCE and cached, and the gateway node is what tells Cilium it changed (the egress-uplink node label). A future reader's instinct will be to have the node write to that object; the comment says not to, because it is Flux-managed, and points at the label and `cilium-dbg bpf egress list` as the debugging entry points instead. * egress-steering.yaml — why the new NFS media mounts are not affected by pod-scoped steering: an NFS PV is mounted by the node kernel in the host netns, so podSelector never matches it. The 192.168.0.0/16 exclusion covers the server too, but that is the second reason, not the first. * vpn-killswitch test — its recovery step depends on the re-steer path, and could not have passed before it existed. Its no-leak assertion was always right; only the explanation was wrong. Also states the prerequisite plainly: the test cannot run at all without a labelled gateway node. * platform README — prod is live on k3s-prod-3 with the before/after egress IPs, and the note that prod's vpn-class pods had NO internet beforehand (CEGP with no matching node -> `Gateway IP: Not Found` -> dropped), so arming the gateway restored egress rather than moving it off the WAN. * role README — the standing "add the shared fwmark to the interface contract" escalation is closed as not implementable on Cilium OSS, rather than left open for someone to attempt. DECISIONS-LOG carries the full session entry, including the drafted ADR-0015 / docs-03 amendment for the architect (specs are immutable to agents) and the five things left for the operator — chief among them that a silent gateway outage still has no alert, which is what let the dev gateway sit dead for 80 minutes. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 17:57:52 -05:00
jakman85andClaude Opus 5	60e3f09c67	feat(vpn): prod egress-gateway group — k3s-prod-3, singleton, opt-in only `[vpn_egress_gateway_prod]` is a SEPARATE inventory group with its own vaulted credentials, not a second member of `[vpn_egress_gateway]`. That group is the default target of playbooks/vpn.egress.gateway.yml, so adding a prod host to it would mean a flagless `ansible-playbook playbooks/vpn.egress.gateway.yml` silently reconfigures a prod node's kill-switch datapath. Prod is reached only by asking for it, with `--list-hosts` first: -e vpn_egress_gateway_hosts=vpn_egress_gateway_prod --limit k3s-prod-3 Node 3 because node 1's SSD was replaced yesterday (least operational history) and node 2 carries the §0b memattr history. Exactly one node, forever: Cilium OSS picks "the first node in lexical ordering" among nodeSelector matches, so a labelled k3s-prod-1 would silently steal the gateway role — and the public egress IP — from k3s-prod-3, with no event and no alert. vault.yml is a verbatim copy of the dev group's CIPHERTEXT: same PIA account per the operator, and copying the encrypted blob means the plaintext was never decrypted to disk, through a shell, or into a transcript. The two files are now independent — rotating means re-encrypting both, which is the right behaviour for two environments. Also corrects a stale inventory note that claimed k3s-prod-3 has wlp1s0 up on 192.168.2.195. Re-verified before choosing it as the gateway, because a second live uplink in a kill-switch datapath is not a footnote: there is no wl* netdev on the node at all, no phy80211 device, the /etc/network/interfaces wlp1s0 stanza is commented out, 192.168.2.195 is assigned nowhere, and the only IPv4 addresses are lo and eno1 192.168.2.12. Nothing needed bringing down. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 17:38:46 -05:00

1 2 3 4 5 ...