0 Fork 0

Files

T

jakman85andClaude Opus 5 44983095e1 feat(runbooks): make the 42 alert runbook_url annotations resolve

Every platform-health alert rule carries
`runbook_url: "https://${BASE_DOMAIN}/runbooks/<name>"` — 42 annotations over 34
distinct names, across platform/monitoring/alerts.yaml,
platform/monitoring/pvc-capacity-alerts.yaml, platform/cnpg/alerts.yaml and
platform/kubevirt/alerts.yaml. There was no runbooks/ directory and no HTTPRoute
serving that path: an in-cluster probe of
https://home.keithjackson.dev/runbooks/node-down returned HTTP 404. Every alert that
reached a human handed them a dead link at the exact moment the documentation is read,
and the annotation made it look solved — the same green-surface-over-absent-mechanism
class as the import Job that reported success while storing placeholder secrets.

No alerts.yaml is touched and no runbook_url value changes. The existing URL scheme is
made to resolve instead.

WHAT LANDS
- runbooks/<34>.md — one per name, each grounded in this cluster's real topology and,
  where one exists, its real incident history: the 2026-09-07 k3s-prod-1 etcd I/O
  starvation (measured PSI 11.36 vs 0.75/1.29, the exact journal lines, the four
  mechanisms proven inert), the Longhorn reboot tax and the freeze/thaw of
  concurrent-replica-rebuild-per-node-limit, Cilium's once-resolved egress interface
  cache (Ifindex 3 against a live 1780) and the absence of OSS failover, the CNPG
  38-hour ContinuousArchiving=False with its measured 6.8 MiB/h disk-full clock and the
  2026-09-12 aggregation-scope fix, the 2026-09-06 Keycloak lockout in which all 12
  clients held literal placeholder secrets behind an entirely green cluster, the Velero
  R2 x-amz-tagging NotImplemented incompatibility and its v1.14.3-rc.2 pin, and swap
  re-enabling itself across reboots via systemd-gpt-auto-generator.
  Each page states what the alert means HERE, the first diagnostic commands, likely
  causes ordered by probability with a remediation each, and when to escalate or stop.
- Every page uses FULLY-QUALIFIED resource names and says why: three CRDs register the
  kind `Backup` here, the bare short name resolves to Longhorn's (zero objects), so
  `kubectl get backup -A` prints "No resources found" on a cluster holding 6 Velero and
  27 CNPG backups. Acting on that false negative is how a CLI quirk becomes data loss.
- Every page states that kubectl only works via
  `infra/devcontainer/dev.sh run bash -c '...'` with an explicit `--context k3s-prod`,
  because dev.sh defaults its current-context to k3s-dev.
- Pages also record which alert groups are INERT today (measured 2026-09-13: no
  Longhorn, cert-manager, Flux-controller or Hubble scrape job exists, so 13 rules
  evaluate against nothing) so nobody reads their silence as health.

SERVING — runbooks/serving/ plus clusters/base/runbooks.yaml
A two-replica nginx-unprivileged serving a ConfigMap generated from runbooks/*.md, at
the apex `/runbooks` prefix, in its own non-gating post-platform Flux tier
(dependsOn platform-config, wait:false) — the platform/homepage pattern, file for file.
- The service catalog cannot express this route: ingressRoutes[].host is pattern-bound
  to a single DNS label plus the apex, so the bare apex is unrepresentable, and there is
  no path field.
- Rejected: redirecting to the Gitea web UI. A runbook is read when the platform is
  broken, and Gitea is an app-tier workload whose own dependencies several of these
  runbooks document; Gateway API's RequestRedirect also has no "append .md" modifier,
  so it would need 34 hand-maintained ReplaceFullPath rules.
- configMapGenerator maps each file to an EXTENSIONLESS key (node-down=node-down.md),
  so /runbooks/node-down is a plain static lookup with no rewrite rule. Served as
  text/plain: the namespace has DNS-only egress, so a CDN markdown renderer could not
  load anyway.
- The tier declares NO postBuild.substituteFrom, deliberately: envsubst would run over
  the prose and silently empty every ${...} shell example (it fails open — the 2026-09-01
  emptied Cilium k8sServiceHost). The HTTPRoute omits `hostnames:` and inherits the
  https-apex listener's, so nothing needs substituting.

AUTH — PUBLIC, deliberately
auth-mode=none. Gating these pages behind oauth2-proxy/Keycloak would make
runbooks/keycloak-down unreadable when Keycloak is down and
runbooks/keycloak-client-secrets unreadable during the exact 2026-09-06 failure mode.
An operator who cannot log in is this route's primary reader. Content is operational
procedure only, no secrets. The rationale is recorded in an annotation on the HTTPRoute
so the route is left OUT of the Gateway ext-authz attachment when forward-auth
enforcement lands.

PROVEN — in-cluster probe through the Gateway on prod
  /runbooks/node-down        HTTP 200   8613 bytes  text/plain; charset=utf-8
  /runbooks/keycloak-down    HTTP 200   9378 bytes  text/plain; charset=utf-8
  /runbooks/cnpg-archiving   HTTP 200  11729 bytes  text/plain; charset=utf-8
  /runbooks/longhorn-faulted HTTP 200   9135 bytes  text/plain; charset=utf-8
  /runbooks/vpn-down         HTTP 200  11092 bytes  text/plain; charset=utf-8
  /runbooks/backup-failure   HTTP 200   9604 bytes  text/plain; charset=utf-8
HTTPRoute Accepted by io.cilium/gateway-controller on sectionName https-apex; the
`/runbooks` prefix wins over homepage's apex `/` by Gateway API longest-path precedence.

GUARD — conformance/tests/l0-static/alert-runbooks-resolvable (R-OBS-04)
363 offline assertions. It checks BOTH halves, because the regression is silent in both
directions: an alert with a new runbook_url and no runbook links to a 404, AND a runbook
committed without its configMapGenerator entry is in git, reviewed, merged, and still
404s in the cluster. Also asserts a quality floor so a stub cannot make the link look
fixed, and that route/listener/nginx prefix agree with the annotations.
Proven to fail, then reverted: a bogus runbook_url (2 FAIL), a runbook removed from the
generator (1 FAIL), and a 31-byte stub (7 FAIL).

Co-Authored-By: Claude Opus 5 <[email protected]>

2026-09-12 23:49:58 -05:00

8.9 KiB

Raw Blame History

kubevirt-launch-failed — One or more VirtualMachineInstances are in the Failed phase

Alert: KubeVirtVMLaunchFailing (critical, 5m) File: platform/kubevirt/alerts.yaml, group platform-health.kubevirt Expression: sum by (namespace) (kubevirt_vmi_phase_count{phase="Failed"}) > 0

What this means here

A VMI reached the Failed phase — a scheduling, launch or qemu failure. The IaaS path is broken for that workload, which is why it is page-worthy even though the VM tier is deliberately non-gating (apps-vms is wait: false, dependsOn: platform-config, because a VM's image import and in-guest install are legitimately long-not-Ready).

What actually runs here: the unifi namespace holds the UniFi VM (rootdisk 40 GiB, Block mode on longhorn-vm). UniFi OS Server is not yet installed in the guest — that is known, documented state, not a launch failure.

Live note, measured 2026-09-13: kubevirt_vmi_phase_count returned 0 series on prod. That metric only exists while VMIs do, so this alert is currently evaluating against nothing. Confirm the real state from kubectl get vmi -A, not from this alert's silence. (kubevirt-prometheus-metrics is a live scrape job and kubevirt_virt_api_ready_status does publish, so the target is up — see /runbooks/kubevirt-control-plane.)

The three k3s-specific launch failures this platform already hit and fixed

Recorded from bring-up, and worth checking against any new VM definition because all three were non-obvious:

containerDisk requires the ALPHA ImageVolume feature gate, which is off on k3s. The fix was to switch to a CDI DataVolume on Longhorn instead. A VM authored with containerDisk will not launch here.
A UEFI image needs firmware.efi set on the VM. Without it, boot fails.
useEmulation: true silently forces TCG on KubeVirt v1.9 — it is set to false deliberately. A VM that appears to launch but burns a whole core per vCPU is this; it also degrades the Cilium datapath under sustained load.

Also recorded: a virt-handler certificate error seen during that work was unrelated and cosmetic — do not chase it.

Running the commands in this runbook

kubectl does not work on the operator workstation. The toolchain lives only in the pinned dev container, and the host's k3s-oidc context hangs on a browser prompt once its token expires — that hang is not the cluster being down. Every command below runs as:

infra/devcontainer/dev.sh run bash -c 'kubectl --context k3s-prod get nodes'

Always pass --context k3s-prod explicitly. dev.sh merges both clusters into one kubeconfig and defaults its current-context to k3s-dev, so a command without --context silently answers about the wrong cluster. (CLUSTER=prod infra/devcontainer/dev.sh run kubectl ... is equivalent.) Do not run two dev.sh invocations at once — they share one container and interfere.

USE FULLY-QUALIFIED RESOURCE NAMES, ALWAYS. Three CRDs on this cluster register the kind Backup: longhorn.io/v1beta2, postgresql.cnpg.io/v1 and velero.io/v1. The bare short name resolves to Longhorn's, which holds zero objects — so kubectl get backup -A prints "No resources found" on a cluster holding 6 Velero backups and 27 CNPG backups. Verified on prod 2026-09-13. Reading that as "the backups are gone" and acting on it turns a false negative into real data loss. Write backups.velero.io, backups.postgresql.cnpg.io, clusters.postgresql.cnpg.io, settings.longhorn.io, volumes.longhorn.io, nodes.longhorn.io.

Mutating kubectl (apply, patch, annotate, rollout) and flux reconcile are blocked for agents here: every durable change goes through git (git push origin main is the deploy). Where this runbook gives a mutating command it is for an operator, and it says so.

First commands

Which VMI, in which namespace, and what phase:

infra/devcontainer/dev.sh run bash -c \
  'kubectl --context k3s-prod get vmi -A -o wide; echo; \
   kubectl --context k3s-prod get vm -A -o custom-columns=NS:.metadata.namespace,NAME:.metadata.name,STATUS:.status.printableStatus,READY:.status.ready'

The reason — the VMI status conditions and the launcher pod's events are where it is stated:

infra/devcontainer/dev.sh run bash -c \
  'kubectl --context k3s-prod -n unifi describe vmi unifi 2>&1 | sed -n "/Status:/,\$p" | head -60'

infra/devcontainer/dev.sh run bash -c \
  'kubectl --context k3s-prod -n unifi get pods -l kubevirt.io=virt-launcher -o wide; echo; \
   kubectl --context k3s-prod -n unifi describe pod -l kubevirt.io=virt-launcher 2>&1 | sed -n "/Events:/,\$p"'

Is the disk there? (A missing or still-importing DataVolume is the most common cause.)

infra/devcontainer/dev.sh run bash -c \
  'kubectl --context k3s-prod get datavolumes.cdi.kubevirt.io -A \
     -o custom-columns=NS:.metadata.namespace,NAME:.metadata.name,PHASE:.status.phase,PROGRESS:.status.progress; echo; \
   kubectl --context k3s-prod get pvc -A | grep -Ei "rootdisk|dv|unifi"'

Is nested virtualisation actually available on the node it was scheduled to?

ssh k3s-prod-1 'ls -l /dev/kvm; grep -c -E "vmx|svm" /proc/cpuinfo'

Is the storage class right for a live-migratable VM?

infra/devcontainer/dev.sh run bash -c \
  'kubectl --context k3s-prod get sc; echo; \
   kubectl --context k3s-prod -n longhorn-system get volumes.longhorn.io -o custom-columns=NAME:.metadata.name,ROBUST:.status.robustness | grep -v healthy'

And whether the KubeVirt control plane can act at all:

infra/devcontainer/dev.sh run bash -c 'kubectl --context k3s-prod -n kubevirt get pods'

Likely causes, most likely first

1. The disk is not ready — a CDI import that has not completed or has stalled

The VM cannot start without its DataVolume. Go to /runbooks/cdi-import-stuck. The specific recorded failure: the 3-replica default class failed the UniFi 60Gi import with insufficient storage / ReplicaSchedulingFailure, which is why a dedicated single-replica longhorn-scratch class exists and is referenced by the CDI CR's scratchSpaceStorageClass.

2. The VM is authored in a way k3s does not support

The three items above: containerDisk without the ALPHA ImageVolume gate (use a CDI DataVolume), missing firmware.efi for a UEFI image, or useEmulation: true forcing TCG. All are git changes to the VM definition.

3. The cloud-init payload is too large or corrupted

Two precise traps. KubeVirt caps inline userData at 2048 bytes — the original rich cloud-init exceeded it; userDataSecretRef was tried and reverted, and the shipped state is a minimal ~1.1 KB inline payload. And: apps-vms must NOT carry postBuild.substituteFrom — Flux's envsubst rewrote ${...} inside the cloud-init and corrupted it (commit da1f833). Do not restore substitution there for consistency with the app waves. If a VM stopped booting right after someone "tidied up" the Flux Kustomizations, this is it.

4. It cannot be scheduled

No node with room, or a storage constraint. A live-migratable VM needs longhorn-vm: RWX, Block mode only (migratable RWX is a raw block device, not the share-manager/NFS path), annotated storageclass.kubevirt.io/is-default-virt-class: "true" — which is not the cluster default class. A VM pointed at plain longhorn will not live-migrate.

5. The CDI importer cannot open the raw Block device

nonroot-devices: true is set on the k3s servers because the non-root CDI importer must open a raw Block device that Kubernetes never chowns for it (commit df5979f). A permission error in the importer on a Block PVC is this.

6. The KubeVirt control plane is down

Then nothing can launch. /runbooks/kubevirt-control-plane.

When to escalate or stop

Scope it before escalating. The VM tier is non-gating and does not affect the container platform. One failed VM is not a platform outage — but the UniFi VM is the home network's controller, so treat that one as user-visible.
Do not delete the VM or its DataVolume to "start clean". A 60 GiB re-import is hours of I/O on disks that share a partition with the embedded etcd WAL, and that is the mechanism behind the 2026-09-07 node outage. Fix the definition, not the data.
Do not set evictionStrategy: LiveMigrate cluster-wide. A blanket setting would wedge drains for RWO-disk VMs; it is per-VM on purpose.
Do not add postBuild.substituteFrom to apps-vms. It corrupts cloud-init.
Escalate for anything that needs a fresh image import during a storage incident, and for changes to the k3s server flags (nonroot-devices) — those are Ansible/operator work.

Source of truth: runbooks/kubevirt-launch-failed.md. Index: /runbooks/ Records: DECISIONS-LOG.md Session 7 (the three k3s-specific launch failures); commits da1f833 (cloud-init corrupted by envsubst) and df5979f (nonroot-devices); the longhorn-scratch / UniFi 60Gi import finding.

8.9 KiB Raw Blame History