jakman85andClaude Opus 5
44983095e1
Every platform-health alert rule carries `runbook_url: "https://${BASE_DOMAIN}/runbooks/<name>"` — 42 annotations over 34 distinct names, across platform/monitoring/alerts.yaml, platform/monitoring/pvc-capacity-alerts.yaml, platform/cnpg/alerts.yaml and platform/kubevirt/alerts.yaml. There was no runbooks/ directory and no HTTPRoute serving that path: an in-cluster probe of https://home.keithjackson.dev/runbooks/node-down returned HTTP 404. Every alert that reached a human handed them a dead link at the exact moment the documentation is read, and the annotation made it look solved — the same green-surface-over-absent-mechanism class as the import Job that reported success while storing placeholder secrets. No alerts.yaml is touched and no runbook_url value changes. The existing URL scheme is made to resolve instead. WHAT LANDS - runbooks/<34>.md — one per name, each grounded in this cluster's real topology and, where one exists, its real incident history: the 2026-09-07 k3s-prod-1 etcd I/O starvation (measured PSI 11.36 vs 0.75/1.29, the exact journal lines, the four mechanisms proven inert), the Longhorn reboot tax and the freeze/thaw of concurrent-replica-rebuild-per-node-limit, Cilium's once-resolved egress interface cache (Ifindex 3 against a live 1780) and the absence of OSS failover, the CNPG 38-hour ContinuousArchiving=False with its measured 6.8 MiB/h disk-full clock and the 2026-09-12 aggregation-scope fix, the 2026-09-06 Keycloak lockout in which all 12 clients held literal placeholder secrets behind an entirely green cluster, the Velero R2 x-amz-tagging NotImplemented incompatibility and its v1.14.3-rc.2 pin, and swap re-enabling itself across reboots via systemd-gpt-auto-generator. Each page states what the alert means HERE, the first diagnostic commands, likely causes ordered by probability with a remediation each, and when to escalate or stop. - Every page uses FULLY-QUALIFIED resource names and says why: three CRDs register the kind `Backup` here, the bare short name resolves to Longhorn's (zero objects), so `kubectl get backup -A` prints "No resources found" on a cluster holding 6 Velero and 27 CNPG backups. Acting on that false negative is how a CLI quirk becomes data loss. - Every page states that kubectl only works via `infra/devcontainer/dev.sh run bash -c '...'` with an explicit `--context k3s-prod`, because dev.sh defaults its current-context to k3s-dev. - Pages also record which alert groups are INERT today (measured 2026-09-13: no Longhorn, cert-manager, Flux-controller or Hubble scrape job exists, so 13 rules evaluate against nothing) so nobody reads their silence as health. SERVING — runbooks/serving/ plus clusters/base/runbooks.yaml A two-replica nginx-unprivileged serving a ConfigMap generated from runbooks/*.md, at the apex `/runbooks` prefix, in its own non-gating post-platform Flux tier (dependsOn platform-config, wait:false) — the platform/homepage pattern, file for file. - The service catalog cannot express this route: ingressRoutes[].host is pattern-bound to a single DNS label plus the apex, so the bare apex is unrepresentable, and there is no path field. - Rejected: redirecting to the Gitea web UI. A runbook is read when the platform is broken, and Gitea is an app-tier workload whose own dependencies several of these runbooks document; Gateway API's RequestRedirect also has no "append .md" modifier, so it would need 34 hand-maintained ReplaceFullPath rules. - configMapGenerator maps each file to an EXTENSIONLESS key (node-down=node-down.md), so /runbooks/node-down is a plain static lookup with no rewrite rule. Served as text/plain: the namespace has DNS-only egress, so a CDN markdown renderer could not load anyway. - The tier declares NO postBuild.substituteFrom, deliberately: envsubst would run over the prose and silently empty every ${...} shell example (it fails open — the 2026-09-01 emptied Cilium k8sServiceHost). The HTTPRoute omits `hostnames:` and inherits the https-apex listener's, so nothing needs substituting. AUTH — PUBLIC, deliberately auth-mode=none. Gating these pages behind oauth2-proxy/Keycloak would make runbooks/keycloak-down unreadable when Keycloak is down and runbooks/keycloak-client-secrets unreadable during the exact 2026-09-06 failure mode. An operator who cannot log in is this route's primary reader. Content is operational procedure only, no secrets. The rationale is recorded in an annotation on the HTTPRoute so the route is left OUT of the Gateway ext-authz attachment when forward-auth enforcement lands. PROVEN — in-cluster probe through the Gateway on prod /runbooks/node-down HTTP 200 8613 bytes text/plain; charset=utf-8 /runbooks/keycloak-down HTTP 200 9378 bytes text/plain; charset=utf-8 /runbooks/cnpg-archiving HTTP 200 11729 bytes text/plain; charset=utf-8 /runbooks/longhorn-faulted HTTP 200 9135 bytes text/plain; charset=utf-8 /runbooks/vpn-down HTTP 200 11092 bytes text/plain; charset=utf-8 /runbooks/backup-failure HTTP 200 9604 bytes text/plain; charset=utf-8 HTTPRoute Accepted by io.cilium/gateway-controller on sectionName https-apex; the `/runbooks` prefix wins over homepage's apex `/` by Gateway API longest-path precedence. GUARD — conformance/tests/l0-static/alert-runbooks-resolvable (R-OBS-04) 363 offline assertions. It checks BOTH halves, because the regression is silent in both directions: an alert with a new runbook_url and no runbook links to a 404, AND a runbook committed without its configMapGenerator entry is in git, reviewed, merged, and still 404s in the cluster. Also asserts a quality floor so a stub cannot make the link look fixed, and that route/listener/nginx prefix agree with the annotations. Proven to fail, then reverted: a bogus runbook_url (2 FAIL), a runbook removed from the generator (1 FAIL), and a 31-byte stub (7 FAIL). Co-Authored-By: Claude Opus 5 <[email protected]>
136 lines
8.2 KiB
Markdown
136 lines
8.2 KiB
Markdown
# Alert runbooks — home-network-k3s prod
|
|
|
|
This is the index page served at `https://home.keithjackson.dev/runbooks/`.
|
|
|
|
Every alert rule in this platform carries an annotation of the form
|
|
|
|
runbook_url: "https://${BASE_DOMAIN}/runbooks/<name>"
|
|
|
|
42 of them, over the 34 names below. Until this directory existed, that path returned **HTTP 404** on the
|
|
live cluster: every alert that reached a human handed them a dead link at the exact moment they needed
|
|
help. These pages are what makes the link resolve.
|
|
|
|
## How to run the commands in these runbooks
|
|
|
|
`kubectl` does not work on the operator workstation. The toolchain lives only in the pinned dev
|
|
container, and the host's `k3s-oidc` context hangs on a browser prompt once its token expires — that hang
|
|
is not the cluster being down.
|
|
|
|
infra/devcontainer/dev.sh run bash -c 'kubectl --context k3s-prod get nodes'
|
|
|
|
Always pass `--context k3s-prod`: `dev.sh` merges both clusters into one kubeconfig and defaults its
|
|
current-context to k3s-**dev**, so a command without `--context` silently answers about the wrong cluster.
|
|
`CLUSTER=prod infra/devcontainer/dev.sh run kubectl ...` is the equivalent form. Do not run two `dev.sh`
|
|
invocations at once — they share one container and interfere.
|
|
|
|
**Use fully-qualified resource names, always.** Three CRDs on this cluster register the kind `Backup` —
|
|
`longhorn.io/v1beta2`, `postgresql.cnpg.io/v1`, `velero.io/v1` — and the bare short name resolves to
|
|
Longhorn's, which holds zero objects. `kubectl get backup -A` therefore prints **"No resources found"** on
|
|
a cluster holding 6 Velero and 27 CNPG backups (verified on prod 2026-09-13). Acting on that false
|
|
negative is how a CLI quirk becomes real data loss. Write `backups.velero.io`,
|
|
`backups.postgresql.cnpg.io`, `clusters.postgresql.cnpg.io`, `settings.longhorn.io`,
|
|
`volumes.longhorn.io`, `nodes.longhorn.io`.
|
|
|
|
`git push origin main` **is** the deploy; there is no other apply step. Durable changes go through git.
|
|
|
|
## Alerts you should not trust the silence of (measured 2026-09-13)
|
|
|
|
Prometheus scrapes 19 jobs on prod. There is **no** Longhorn, cert-manager, Flux-controller or
|
|
Hubble/Cilium job, so these rule groups currently evaluate against nothing and **cannot fire**:
|
|
|
|
| Missing scrape job | Inert alerts |
|
|
|---|---|
|
|
| Longhorn | `LonghornVolumeDegraded`, `LonghornVolumeFaulted`, `LonghornVolumeCapacityHigh`, `LonghornNodeStorageHigh` |
|
|
| cert-manager | `CertificateExpiringSoon`, `CertificateExpiryImminent`, `CertificateNotReady` |
|
|
| Flux (`gotk_*`) | `FluxReconciliationFailure`, `FluxResourceSuspended`, `ImageUpdateAutomationFailing`, `ImagePolicyStalled`, `UpdateHealthGateFailed` |
|
|
| Hubble (`hubble_drop_total`) | `HubbleDeniedFlowSpike` |
|
|
| etcd (`kubeEtcd` disabled for k3s, deliberately) | no etcd fsync alerting exists at all |
|
|
|
|
Each affected runbook says so on its own page and gives the by-hand equivalent. See `targets-down`.
|
|
|
|
## The runbooks
|
|
|
|
### Nodes
|
|
- **`node-down`** — a node's node-exporter is unscrapable; the node may be gone, or its kubelet may have
|
|
stopped posting status while the host stays up (the 2026-09-07 shape).
|
|
- **`node-io`** — disk I/O pressure/starvation. The etcd WAL shares a partition with Longhorn replicas;
|
|
this is the alert that would have called the 2026-09-07 outage and did not exist at the time.
|
|
- **`node-memory`** — memory pressure. Includes why `SwapTotal == 0` is not evidence swap is off.
|
|
- **`node-disk`** — a node filesystem filling up. `/data` is the one that matters.
|
|
- **`node-cpu`** — CPU PSI and run-queue depth, and how to tell CPU contention from I/O contention.
|
|
|
|
### Storage
|
|
- **`longhorn-degraded`** — a volume has lost redundancy. Normal after any reboot, and the rebuild is the
|
|
expensive part. Freeze/thaw commands here.
|
|
- **`longhorn-faulted`** — no usable replica. Data at risk; stop before anything destructive.
|
|
- **`longhorn-capacity`** — a volume or a node's Longhorn disk near capacity.
|
|
- **`pvc-capacity`** — PVC filling up / almost full / predicted to fill. These rules work.
|
|
- **`monitoring-capacity`** — Prometheus or Loki running out of disk; don't let the monitor blind itself.
|
|
|
|
### GitOps and updates
|
|
- **`flux-reconcile`** — a Flux resource stuck at Ready=False. Which tier decides the blast radius.
|
|
- **`flux-suspended`** — reconciliation turned off and forgotten. Drift becomes silent.
|
|
- **`update-rollback`** — a HelmRelease failed its health gate and is rolling back.
|
|
- **`image-automation`** — the git write-back engine is failing (feature is disabled here).
|
|
- **`image-policy-stalled`** — an ImagePolicy/ImageRepository cannot resolve a tag.
|
|
|
|
### Certificates
|
|
- **`cert-issuance`** — ACME issuance failing. The DNS-01 self-check is the usual cause.
|
|
- **`cert-expiry`** — a certificate is expiring. Almost always a late symptom of `cert-issuance`.
|
|
|
|
### Networking
|
|
- **`vpn-down`** — the egress VPN tunnel. Includes the silent egress-gateway staleness that this alert
|
|
cannot see, and what the kill-switch actually does.
|
|
- **`denied-flows`** — policy-denied flow spike. The Cilium hairpin/identity regression class.
|
|
|
|
### Backups and DR
|
|
- **`backup-failure`** — a Velero backup failed. The R2 object-tagging incompatibility is documented here.
|
|
- **`backup-partial`** — a Velero backup completed with partial failures, and which skips are deliberate.
|
|
- **`backup-missed`** — no successful Velero backup in 24h.
|
|
- **`cnpg-archiving`** — WAL archiving stuck / no recoverability point. **An availability incident, not
|
|
just a backup one.**
|
|
- **`cnpg-backup-missed`** — no recent CNPG base backup. Velero does not cover these databases.
|
|
- **`cnpg-wal-growth`** — `pg_wal` not being recycled. Never delete WAL by hand.
|
|
- **`cnpg-exporter`** — the CNPG SQL exporter erroring: a blind spot that looks exactly like health.
|
|
|
|
### Identity
|
|
- **`keycloak-down`** — the IdP is down. Blast radius, and the break-glass path that still works.
|
|
- **`keycloak-db`** — Keycloak's CloudNativePG database is unavailable.
|
|
- **`keycloak-client-secrets`** — the client/URL reconciler failing or silent. The 2026-09-06 lockout that
|
|
every green signal missed.
|
|
|
|
### Virtualisation
|
|
- **`kubevirt-control-plane`** — VM lifecycle operations will fail; running VMs keep running.
|
|
- **`kubevirt-launch-failed`** — a VMI reached the Failed phase. The three k3s-specific launch traps.
|
|
- **`kubevirt-crashloop`** — a virt-launcher pod restarting repeatedly.
|
|
- **`cdi-import-stuck`** — a DataVolume import not progressing. Check node I/O before restarting it.
|
|
|
|
## Editing a runbook
|
|
|
|
Each page is `runbooks/<name>.md` in the `home-network-k3s-impl` repo. Edit it, push to `main`, and Flux
|
|
re-renders the ConfigMap and rolls the two-replica server; kustomize's content hash on the generated
|
|
ConfigMap name is what triggers the roll.
|
|
|
|
Adding a **new** alert with a `runbook_url` requires the matching `runbooks/<name>.md` **and** its
|
|
`<name>=<name>.md` entry in `runbooks/kustomization.yaml`. Both are enforced by
|
|
`conformance/tests/l0-static/alert-runbooks-resolvable`, which runs unconditionally in the merge gate —
|
|
"the file exists in git" and "the URL resolves in the cluster" are different claims, and it checks both.
|
|
|
|
Every page must carry the four operator sections (*What this means here*, *First commands*, *Likely
|
|
causes, most likely first*, *When to escalate or stop*), mention `dev.sh`, and pass `--context k3s-prod`.
|
|
The check enforces that too, because a stub that makes the link resolve while helping nobody is worse than
|
|
the 404 it replaced — it looks fixed.
|
|
|
|
## Why this route has no login
|
|
|
|
Deliberately public. Every other exposed UI here declares forward-auth via oauth2-proxy → Keycloak; if
|
|
these pages did too, `keycloak-down` would be unreadable exactly when Keycloak is down,
|
|
`keycloak-db` unreadable when its database is down, and `keycloak-client-secrets` unreadable during the
|
|
precise failure that broke all 12 OIDC clients on 2026-09-06 behind an entirely green cluster. An
|
|
operator who cannot log in is this route's primary reader. The content is operational procedure — metric
|
|
names, thresholds, kubectl invocations, topology — and no secrets. See
|
|
`runbooks/serving/httproute.yaml` for the full reasoning, including the instruction to leave this route
|
|
**out** of the Gateway ext-authz attachment when forward-auth enforcement lands.
|
|
|
|
The running narrative of real incidents on this cluster is `DECISIONS-LOG.md`.
|