0 Fork 0

Files

T

jakman85andClaude Opus 5 44983095e1 feat(runbooks): make the 42 alert runbook_url annotations resolve

Every platform-health alert rule carries
`runbook_url: "https://${BASE_DOMAIN}/runbooks/<name>"` — 42 annotations over 34
distinct names, across platform/monitoring/alerts.yaml,
platform/monitoring/pvc-capacity-alerts.yaml, platform/cnpg/alerts.yaml and
platform/kubevirt/alerts.yaml. There was no runbooks/ directory and no HTTPRoute
serving that path: an in-cluster probe of
https://home.keithjackson.dev/runbooks/node-down returned HTTP 404. Every alert that
reached a human handed them a dead link at the exact moment the documentation is read,
and the annotation made it look solved — the same green-surface-over-absent-mechanism
class as the import Job that reported success while storing placeholder secrets.

No alerts.yaml is touched and no runbook_url value changes. The existing URL scheme is
made to resolve instead.

WHAT LANDS
- runbooks/<34>.md — one per name, each grounded in this cluster's real topology and,
  where one exists, its real incident history: the 2026-09-07 k3s-prod-1 etcd I/O
  starvation (measured PSI 11.36 vs 0.75/1.29, the exact journal lines, the four
  mechanisms proven inert), the Longhorn reboot tax and the freeze/thaw of
  concurrent-replica-rebuild-per-node-limit, Cilium's once-resolved egress interface
  cache (Ifindex 3 against a live 1780) and the absence of OSS failover, the CNPG
  38-hour ContinuousArchiving=False with its measured 6.8 MiB/h disk-full clock and the
  2026-09-12 aggregation-scope fix, the 2026-09-06 Keycloak lockout in which all 12
  clients held literal placeholder secrets behind an entirely green cluster, the Velero
  R2 x-amz-tagging NotImplemented incompatibility and its v1.14.3-rc.2 pin, and swap
  re-enabling itself across reboots via systemd-gpt-auto-generator.
  Each page states what the alert means HERE, the first diagnostic commands, likely
  causes ordered by probability with a remediation each, and when to escalate or stop.
- Every page uses FULLY-QUALIFIED resource names and says why: three CRDs register the
  kind `Backup` here, the bare short name resolves to Longhorn's (zero objects), so
  `kubectl get backup -A` prints "No resources found" on a cluster holding 6 Velero and
  27 CNPG backups. Acting on that false negative is how a CLI quirk becomes data loss.
- Every page states that kubectl only works via
  `infra/devcontainer/dev.sh run bash -c '...'` with an explicit `--context k3s-prod`,
  because dev.sh defaults its current-context to k3s-dev.
- Pages also record which alert groups are INERT today (measured 2026-09-13: no
  Longhorn, cert-manager, Flux-controller or Hubble scrape job exists, so 13 rules
  evaluate against nothing) so nobody reads their silence as health.

SERVING — runbooks/serving/ plus clusters/base/runbooks.yaml
A two-replica nginx-unprivileged serving a ConfigMap generated from runbooks/*.md, at
the apex `/runbooks` prefix, in its own non-gating post-platform Flux tier
(dependsOn platform-config, wait:false) — the platform/homepage pattern, file for file.
- The service catalog cannot express this route: ingressRoutes[].host is pattern-bound
  to a single DNS label plus the apex, so the bare apex is unrepresentable, and there is
  no path field.
- Rejected: redirecting to the Gitea web UI. A runbook is read when the platform is
  broken, and Gitea is an app-tier workload whose own dependencies several of these
  runbooks document; Gateway API's RequestRedirect also has no "append .md" modifier,
  so it would need 34 hand-maintained ReplaceFullPath rules.
- configMapGenerator maps each file to an EXTENSIONLESS key (node-down=node-down.md),
  so /runbooks/node-down is a plain static lookup with no rewrite rule. Served as
  text/plain: the namespace has DNS-only egress, so a CDN markdown renderer could not
  load anyway.
- The tier declares NO postBuild.substituteFrom, deliberately: envsubst would run over
  the prose and silently empty every ${...} shell example (it fails open — the 2026-09-01
  emptied Cilium k8sServiceHost). The HTTPRoute omits `hostnames:` and inherits the
  https-apex listener's, so nothing needs substituting.

AUTH — PUBLIC, deliberately
auth-mode=none. Gating these pages behind oauth2-proxy/Keycloak would make
runbooks/keycloak-down unreadable when Keycloak is down and
runbooks/keycloak-client-secrets unreadable during the exact 2026-09-06 failure mode.
An operator who cannot log in is this route's primary reader. Content is operational
procedure only, no secrets. The rationale is recorded in an annotation on the HTTPRoute
so the route is left OUT of the Gateway ext-authz attachment when forward-auth
enforcement lands.

PROVEN — in-cluster probe through the Gateway on prod
  /runbooks/node-down        HTTP 200   8613 bytes  text/plain; charset=utf-8
  /runbooks/keycloak-down    HTTP 200   9378 bytes  text/plain; charset=utf-8
  /runbooks/cnpg-archiving   HTTP 200  11729 bytes  text/plain; charset=utf-8
  /runbooks/longhorn-faulted HTTP 200   9135 bytes  text/plain; charset=utf-8
  /runbooks/vpn-down         HTTP 200  11092 bytes  text/plain; charset=utf-8
  /runbooks/backup-failure   HTTP 200   9604 bytes  text/plain; charset=utf-8
HTTPRoute Accepted by io.cilium/gateway-controller on sectionName https-apex; the
`/runbooks` prefix wins over homepage's apex `/` by Gateway API longest-path precedence.

GUARD — conformance/tests/l0-static/alert-runbooks-resolvable (R-OBS-04)
363 offline assertions. It checks BOTH halves, because the regression is silent in both
directions: an alert with a new runbook_url and no runbook links to a 404, AND a runbook
committed without its configMapGenerator entry is in git, reviewed, merged, and still
404s in the cluster. Also asserts a quality floor so a stub cannot make the link look
fixed, and that route/listener/nginx prefix agree with the annotations.
Proven to fail, then reverted: a bogus runbook_url (2 FAIL), a runbook removed from the
generator (1 FAIL), and a 31-byte stub (7 FAIL).

Co-Authored-By: Claude Opus 5 <[email protected]>

2026-09-12 23:49:58 -05:00

8.7 KiB

Raw Blame History

backup-partial — A Velero backup completed with partial failures

Alert: VeleroBackupPartialFailure (warning, 5m) File: platform/monitoring/alerts.yaml, group platform-health.backups Expression: increase(velero_backup_partial_failure_total[1h]) > 0

What this means here

The backup finished, but some resources or volumes were skipped or errored. It is a warning rather than a critical because most of it worked — and that is exactly what makes it dangerous: a PartiallyFailed backup looks like a backup in every listing, and the thing it silently omitted may be the thing you need.

The first question is always: was the skip deliberate? On this cluster a great deal of skipping is intentional and correct.

READ THIS BEFORE YOU CONCLUDE THE BACKUPS ARE GONE

kubectl get backup -A prints "No resources found" on this cluster even when backups exist. Three CRDs register the kind Backup — longhorn.io/v1beta2, postgresql.cnpg.io/v1 and velero.io/v1 — and the bare short name resolves to Longhorn's, which holds zero objects. Verified on prod 2026-09-13: the fully-qualified queries returned 6 Velero backups and 27 CNPG backups while the short name returned nothing. This false negative has already produced two wrong "the backups are missing" conclusions in one night. A destructive recovery action taken on it is how a CLI quirk becomes real data loss. Always:

backups.velero.io           backups.postgresql.cnpg.io           backups.longhorn.io
schedules.velero.io         scheduledbackups.postgresql.cnpg.io  clusters.postgresql.cnpg.io

The deliberate exclusions (know these before calling anything a failure)

NFS-sourced volumes are skipped on purpose, and the reason is a near-miss worth remembering. The opt-out file-system-backup schedule (defaultVolumesToFsBackup: true, excluding only monitoring and unifi) would have read the NFS media library three times — plex-media, sonarr-media and radarr-media are all bound to the same 192.168.2.102:/mnt/Storage/plex export, 8.32 TiB measured — plus nextcloud-legacy-archive (270 GiB), pushing roughly 8.6 TiB to R2 nightly with 720h retention. Namespace exclusion could not express the fix, because those namespaces also hold real Longhorn PVCs that must be backed up.

The fix is a per-volume opt-out by SOURCE TYPE: the ConfigMap velero-volume-policies skips any volume whose source is NFS, and the schedule references it. The per-pod backup-volumes-excludes annotation was rejected for failing OPEN (forget the annotation and you back up 8 TiB). Proven on prod: a Backup of namespace nextcloud produced exactly one PodVolumeBackup (data, Longhorn, 875,417,102 bytes, Completed) and the NFS volume produced none. Residual gap, stated honestly: the rule matches NFS only. A future non-NFS bulk source would not be covered.

The three CNPG databases are also out of scope by design. keycloak-db, nextcloud-db and semaphore-db have their own DR path (Barman WAL archive + base backups to R2) because a Velero snapshot of a live Postgres is not a backup. If a *-db-N volume is skipped, that is correct — see /runbooks/cnpg-archiving for the path that does cover them.

monitoring and unifi are excluded from file-system backup as well.

Running the commands in this runbook

kubectl does not work on the operator workstation. The toolchain lives only in the pinned dev container, and the host's k3s-oidc context hangs on a browser prompt once its token expires — that hang is not the cluster being down. Every command below runs as:

infra/devcontainer/dev.sh run bash -c 'kubectl --context k3s-prod get nodes'

Always pass --context k3s-prod explicitly. dev.sh merges both clusters into one kubeconfig and defaults its current-context to k3s-dev, so a command without --context silently answers about the wrong cluster. (CLUSTER=prod infra/devcontainer/dev.sh run kubectl ... is equivalent.) Do not run two dev.sh invocations at once — they share one container and interfere.

USE FULLY-QUALIFIED RESOURCE NAMES, ALWAYS. Three CRDs on this cluster register the kind Backup: longhorn.io/v1beta2, postgresql.cnpg.io/v1 and velero.io/v1. The bare short name resolves to Longhorn's, which holds zero objects — so kubectl get backup -A prints "No resources found" on a cluster holding 6 Velero backups and 27 CNPG backups. Verified on prod 2026-09-13. Reading that as "the backups are gone" and acting on it turns a false negative into real data loss. Write backups.velero.io, backups.postgresql.cnpg.io, clusters.postgresql.cnpg.io, settings.longhorn.io, volumes.longhorn.io, nodes.longhorn.io.

Mutating kubectl (apply, patch, annotate, rollout) and flux reconcile are blocked for agents here: every durable change goes through git (git push origin main is the deploy). Where this runbook gives a mutating command it is for an operator, and it says so.

First commands

Which backup, and what exactly it warned about:

infra/devcontainer/dev.sh run bash -c \
  'kubectl --context k3s-prod get backups.velero.io -A \
     -o custom-columns=NAME:.metadata.name,PHASE:.status.phase,ERRORS:.status.errors,WARN:.status.warnings,START:.status.startTimestamp'

infra/devcontainer/dev.sh run bash -c \
  'kubectl --context k3s-prod -n velero get backups.velero.io <name> -o yaml | sed -n "/status:/,\$p"'

Per-volume results — this tells you whether a skip was the NFS policy or a real failure:

infra/devcontainer/dev.sh run bash -c \
  'kubectl --context k3s-prod -n velero get podvolumebackups.velero.io \
     -o custom-columns=NAME:.metadata.name,BACKUP:.metadata.labels.velero\\.io/backup-name,POD:.spec.pod.name,VOL:.spec.volume,PHASE:.status.phase,BYTES:.status.progress.bytesDone'

The volume policy that does the deliberate skipping:

infra/devcontainer/dev.sh run bash -c \
  'kubectl --context k3s-prod -n velero get cm velero-volume-policies -o yaml'

The controller's own account of what it skipped:

infra/devcontainer/dev.sh run bash -c \
  'kubectl --context k3s-prod -n velero logs deploy/velero --tail=200 2>&1 | grep -iE "skip|excluded|warn|error" | tail -30'

Likely causes, most likely first

1. The deliberate NFS / CNPG / monitoring exclusions

Most common by far, and correct. Confirm against the velero-volume-policies ConfigMap and the schedule's excluded namespaces. No action. If you are tempted to "fix" it, re-read the 8.6 TiB near-miss above.

2. A resource Velero could not serialise

Usually a CRD whose API was unavailable at the moment of the backup, or an admission webhook refusing a read. The log names the group/kind. Often transient; if it recurs for the same kind, that kind is genuinely not backed up.

3. A volume was busy, degraded, or on a node under pressure

Velero's daily runs at 03:00 against Longhorn PVCs. A degraded volume or a node with high I/O-PSI can fail one volume's read while the rest succeed. Cross-read /runbooks/longhorn-degraded and /runbooks/node-io.

4. A partial R2 write

Related to the tagging/checksum incompatibilities in /runbooks/backup-failure: those normally produce a hard Failed, but a partially-written backup is worth checking the plugin pin for (velero/velero-plugin-for-aws:v1.14.3-rc.2 — do not revert to v1.14.2).

5. A namespace was created or deleted mid-backup

Benign race. Leaked test namespaces have existed on this cluster and been deleted; a namespace disappearing under Velero produces exactly this warning.

When to escalate or stop

Decide, and record, whether the skipped items matter. The honest failure mode here is shrugging at a PartiallyFailed and discovering later that something was never covered. If the skip was not one of the documented exclusions, treat it as an uncovered resource.
Do not add namespaces to the exclusion list to quiet the alert. Those namespaces hold real Longhorn PVCs; namespace-level exclusion is the mistake the source-type policy exists to avoid.
Do not switch to the per-pod backup-volumes-excludes annotation — it was rejected for failing OPEN, and the consequence of forgetting it is 8 TiB per night.
Do not delete a PartiallyFailed backup — like a Failed one it can leave orphaned kopia blobs, and deleting R2 objects is an operator decision.
Escalate if the same resource or volume is skipped on consecutive nights: that is a coverage gap, which is an R-STATE-03 matter and not a transient.

Source of truth: runbooks/backup-partial.md. Index: /runbooks/ Records: commit 2e259a8 (the 8.6 TiB near-miss, the source-type volume policy, and the rejection of the fail-open annotation); docs/BULK-NFS-STORAGE.md.

8.7 KiB Raw Blame History