jakman85andClaude Opus 5
44983095e1
Every platform-health alert rule carries `runbook_url: "https://${BASE_DOMAIN}/runbooks/<name>"` — 42 annotations over 34 distinct names, across platform/monitoring/alerts.yaml, platform/monitoring/pvc-capacity-alerts.yaml, platform/cnpg/alerts.yaml and platform/kubevirt/alerts.yaml. There was no runbooks/ directory and no HTTPRoute serving that path: an in-cluster probe of https://home.keithjackson.dev/runbooks/node-down returned HTTP 404. Every alert that reached a human handed them a dead link at the exact moment the documentation is read, and the annotation made it look solved — the same green-surface-over-absent-mechanism class as the import Job that reported success while storing placeholder secrets. No alerts.yaml is touched and no runbook_url value changes. The existing URL scheme is made to resolve instead. WHAT LANDS - runbooks/<34>.md — one per name, each grounded in this cluster's real topology and, where one exists, its real incident history: the 2026-09-07 k3s-prod-1 etcd I/O starvation (measured PSI 11.36 vs 0.75/1.29, the exact journal lines, the four mechanisms proven inert), the Longhorn reboot tax and the freeze/thaw of concurrent-replica-rebuild-per-node-limit, Cilium's once-resolved egress interface cache (Ifindex 3 against a live 1780) and the absence of OSS failover, the CNPG 38-hour ContinuousArchiving=False with its measured 6.8 MiB/h disk-full clock and the 2026-09-12 aggregation-scope fix, the 2026-09-06 Keycloak lockout in which all 12 clients held literal placeholder secrets behind an entirely green cluster, the Velero R2 x-amz-tagging NotImplemented incompatibility and its v1.14.3-rc.2 pin, and swap re-enabling itself across reboots via systemd-gpt-auto-generator. Each page states what the alert means HERE, the first diagnostic commands, likely causes ordered by probability with a remediation each, and when to escalate or stop. - Every page uses FULLY-QUALIFIED resource names and says why: three CRDs register the kind `Backup` here, the bare short name resolves to Longhorn's (zero objects), so `kubectl get backup -A` prints "No resources found" on a cluster holding 6 Velero and 27 CNPG backups. Acting on that false negative is how a CLI quirk becomes data loss. - Every page states that kubectl only works via `infra/devcontainer/dev.sh run bash -c '...'` with an explicit `--context k3s-prod`, because dev.sh defaults its current-context to k3s-dev. - Pages also record which alert groups are INERT today (measured 2026-09-13: no Longhorn, cert-manager, Flux-controller or Hubble scrape job exists, so 13 rules evaluate against nothing) so nobody reads their silence as health. SERVING — runbooks/serving/ plus clusters/base/runbooks.yaml A two-replica nginx-unprivileged serving a ConfigMap generated from runbooks/*.md, at the apex `/runbooks` prefix, in its own non-gating post-platform Flux tier (dependsOn platform-config, wait:false) — the platform/homepage pattern, file for file. - The service catalog cannot express this route: ingressRoutes[].host is pattern-bound to a single DNS label plus the apex, so the bare apex is unrepresentable, and there is no path field. - Rejected: redirecting to the Gitea web UI. A runbook is read when the platform is broken, and Gitea is an app-tier workload whose own dependencies several of these runbooks document; Gateway API's RequestRedirect also has no "append .md" modifier, so it would need 34 hand-maintained ReplaceFullPath rules. - configMapGenerator maps each file to an EXTENSIONLESS key (node-down=node-down.md), so /runbooks/node-down is a plain static lookup with no rewrite rule. Served as text/plain: the namespace has DNS-only egress, so a CDN markdown renderer could not load anyway. - The tier declares NO postBuild.substituteFrom, deliberately: envsubst would run over the prose and silently empty every ${...} shell example (it fails open — the 2026-09-01 emptied Cilium k8sServiceHost). The HTTPRoute omits `hostnames:` and inherits the https-apex listener's, so nothing needs substituting. AUTH — PUBLIC, deliberately auth-mode=none. Gating these pages behind oauth2-proxy/Keycloak would make runbooks/keycloak-down unreadable when Keycloak is down and runbooks/keycloak-client-secrets unreadable during the exact 2026-09-06 failure mode. An operator who cannot log in is this route's primary reader. Content is operational procedure only, no secrets. The rationale is recorded in an annotation on the HTTPRoute so the route is left OUT of the Gateway ext-authz attachment when forward-auth enforcement lands. PROVEN — in-cluster probe through the Gateway on prod /runbooks/node-down HTTP 200 8613 bytes text/plain; charset=utf-8 /runbooks/keycloak-down HTTP 200 9378 bytes text/plain; charset=utf-8 /runbooks/cnpg-archiving HTTP 200 11729 bytes text/plain; charset=utf-8 /runbooks/longhorn-faulted HTTP 200 9135 bytes text/plain; charset=utf-8 /runbooks/vpn-down HTTP 200 11092 bytes text/plain; charset=utf-8 /runbooks/backup-failure HTTP 200 9604 bytes text/plain; charset=utf-8 HTTPRoute Accepted by io.cilium/gateway-controller on sectionName https-apex; the `/runbooks` prefix wins over homepage's apex `/` by Gateway API longest-path precedence. GUARD — conformance/tests/l0-static/alert-runbooks-resolvable (R-OBS-04) 363 offline assertions. It checks BOTH halves, because the regression is silent in both directions: an alert with a new runbook_url and no runbook links to a 404, AND a runbook committed without its configMapGenerator entry is in git, reviewed, merged, and still 404s in the cluster. Also asserts a quality floor so a stub cannot make the link look fixed, and that route/listener/nginx prefix agree with the annotations. Proven to fail, then reverted: a bogus runbook_url (2 FAIL), a runbook removed from the generator (1 FAIL), and a 31-byte stub (7 FAIL). Co-Authored-By: Claude Opus 5 <[email protected]>
153 lines
8.4 KiB
Markdown
153 lines
8.4 KiB
Markdown
# node-down — A node's node-exporter is unscrapable (the node may be gone)
|
|
|
|
**Alert:** `NodeExporterDown` (critical, 5m)
|
|
**File:** `platform/monitoring/alerts.yaml`, group `platform-health.nodes`
|
|
**Expression:** `up{job="node-exporter"} == 0`
|
|
|
|
## What this means here
|
|
|
|
Prometheus has not scraped node-exporter on that instance for 5 minutes. The alert is worded
|
|
carefully — it says the *exporter* is down — because on this cluster the two cases look identical
|
|
from Prometheus and have opposite urgency:
|
|
|
|
- **The node is genuinely gone** (powered off, kernel panic, network loss).
|
|
- **The node is up and the kubelet stopped posting status.** This is what actually happened on
|
|
**2026-09-07 at 06:05:21Z**: `k3s-prod-1` went NotReady with "Kubelet stopped posting node status"
|
|
while the host was up, pingable and SSH-able. Root cause was disk-I/O starvation of the embedded
|
|
etcd, not a dead machine. If this alert is firing alongside `node-io`, read `/runbooks/node-io`
|
|
first — that is the cause and this is the symptom.
|
|
|
|
**Why it is critical rather than a warning.** All three nodes are control-plane + etcd members
|
|
(`k3s-prod-1` .10, `k3s-prod-2` .11, `k3s-prod-3` .12, kube-vip API VIP `192.168.2.9`). Losing one
|
|
leaves a 2-member etcd with no fault tolerance: the next loss ends quorum and the API server with it.
|
|
Losing a node also degrades every Longhorn volume that had a replica there, and every degraded volume
|
|
starts rebuilding — which loads the same disks etcd fsyncs to. One node down is not a routine event
|
|
on a 3-node cluster; it is one step from an outage.
|
|
|
|
Two node-specific roles matter when you read which node it is:
|
|
- `k3s-prod-3` is the **sole VPN egress gateway**. Cilium OSS has **no egress-gateway failover**, so
|
|
while that node is down, VPN-classed egress is an outage, not a degradation. See `/runbooks/vpn-down`.
|
|
- `k3s-prod-2` is the cluster **founder** (`[k3s_prod_primary]` in `inventory/hosts.ini`). Do not
|
|
re-provision it from the inventory without reading `/runbooks/node-io` — re-provisioning a node
|
|
still listed as primary founds a **second cluster**.
|
|
## Running the commands in this runbook
|
|
|
|
`kubectl` does not work on the operator workstation. The toolchain lives only in the pinned dev
|
|
container, and the host's `k3s-oidc` context hangs on a browser prompt once its token expires —
|
|
that hang is not the cluster being down. Every command below runs as:
|
|
|
|
infra/devcontainer/dev.sh run bash -c 'kubectl --context k3s-prod get nodes'
|
|
|
|
Always pass `--context k3s-prod` explicitly. `dev.sh` merges both clusters into one kubeconfig and
|
|
defaults its current-context to k3s-**dev**, so a command without `--context` silently answers
|
|
about the wrong cluster. (`CLUSTER=prod infra/devcontainer/dev.sh run kubectl ...` is equivalent.)
|
|
Do not run two `dev.sh` invocations at once — they share one container and interfere.
|
|
|
|
USE FULLY-QUALIFIED RESOURCE NAMES, ALWAYS. Three CRDs on this cluster register the kind `Backup`:
|
|
`longhorn.io/v1beta2`, `postgresql.cnpg.io/v1` and `velero.io/v1`. The bare short name resolves to
|
|
Longhorn's, which holds zero objects — so `kubectl get backup -A` prints **"No resources found"** on
|
|
a cluster holding 6 Velero backups and 27 CNPG backups. Verified on prod 2026-09-13. Reading that as
|
|
"the backups are gone" and acting on it turns a false negative into real data loss. Write
|
|
`backups.velero.io`, `backups.postgresql.cnpg.io`, `clusters.postgresql.cnpg.io`,
|
|
`settings.longhorn.io`, `volumes.longhorn.io`, `nodes.longhorn.io`.
|
|
|
|
Mutating kubectl (`apply`, `patch`, `annotate`, `rollout`) and `flux reconcile` are blocked for
|
|
agents here: every durable change goes through git (`git push origin main` **is** the deploy).
|
|
Where this runbook gives a mutating command it is for an operator, and it says so.
|
|
|
|
## First commands
|
|
|
|
Is the node actually NotReady, or is only the exporter unscrapable?
|
|
|
|
```
|
|
infra/devcontainer/dev.sh run bash -c \
|
|
'kubectl --context k3s-prod get nodes -o wide; echo; kubectl --context k3s-prod -n monitoring get pods -l app.kubernetes.io/name=prometheus-node-exporter -o wide'
|
|
```
|
|
|
|
Is it the API server or the node? (If this hangs, you have a bigger problem than one node.)
|
|
|
|
```
|
|
infra/devcontainer/dev.sh run bash -c \
|
|
'kubectl --context k3s-prod get --raw /readyz?verbose 2>&1 | tail -20'
|
|
```
|
|
|
|
Is the host alive at all? Prod is directly on `192.168.2.0/24` — no NAT hop:
|
|
|
|
```
|
|
ping -c3 192.168.2.10 ; ssh k3s-prod-1 'uptime; systemctl is-active k3s; cat /proc/pressure/io'
|
|
```
|
|
|
|
The three lines that distinguish "etcd starved" from "machine dead":
|
|
|
|
```
|
|
ssh k3s-prod-1 'journalctl -u k3s --since "30 min ago" | grep -Ei "fdatasync|apply request took|too many requests|Kubelet stopped|leader"'
|
|
```
|
|
|
|
Etcd membership and leader — do this before touching anything:
|
|
|
|
```
|
|
ssh k3s-prod-2 'curl -s http://127.0.0.1:2381/metrics | grep -E "etcd_server_is_leader|etcd_server_has_leader"'
|
|
```
|
|
|
|
What did the node take with it?
|
|
|
|
```
|
|
infra/devcontainer/dev.sh run bash -c \
|
|
'kubectl --context k3s-prod -n longhorn-system get volumes.longhorn.io \
|
|
-o custom-columns=NAME:.metadata.name,ROBUST:.status.robustness | grep -v healthy; \
|
|
kubectl --context k3s-prod get pods -A --field-selector spec.nodeName=k3s-prod-1 -o wide | head -30'
|
|
```
|
|
|
|
## Likely causes, most likely first
|
|
|
|
### 1. Disk I/O starvation wedged the kubelet (host still up)
|
|
The signature is `slow fdatasync took=3.56s` / `apply request took too long took=8.30s` /
|
|
`etcdserver: too many requests` in `journalctl -u k3s`, with `/proc/pressure/io` full avg300 well
|
|
above 1. On 2026-09-07 node 1 read **11.36** against 0.75 on node 2 and 1.29 on node 3.
|
|
Remediation: follow `/runbooks/node-io`. Recovery that day required a manual
|
|
`systemctl restart k3s` on the node (operator, on-host), after which 18 Longhorn volumes rebuilt and
|
|
pressure only fell when the rebuilds finished.
|
|
|
|
### 2. The node rebooted (planned or otherwise)
|
|
Check `uptime`. A reboot is not harmless here: **every node reboot degrades all ~18 Longhorn volumes
|
|
and triggers a full rebuild**. If a reboot is intentional, roll one node at a time and wait for
|
|
`robustness=healthy` on every volume before the next, and freeze rebuilds first (see
|
|
`/runbooks/longhorn-degraded`). Note two hardware quirks recorded in `infra/PROD-PROVISIONING.md`
|
|
§0b: `k3s-prod-2` **hangs on a warm reboot while staying powered**, and all three nodes carry the EFI
|
|
memattr kernel bug that once presented `k3s-prod-1` as having 2.6 GiB usable of 16 GB (needs kernel
|
|
≥ 6.13).
|
|
|
|
### 3. node-exporter itself is unhealthy, node fine
|
|
If `kubectl get nodes` says Ready and the pod is CrashLoopBackOff or Pending, this is a monitoring
|
|
fault, not a node fault. Downgrade urgency, but do not ignore it — while that exporter is down you
|
|
are blind to `node-io`, `node-memory`, `node-disk` and `node-cpu` on that node, which is exactly the
|
|
blindness that let 2026-09-07 arrive as a surprise. Related: `/runbooks/targets-down`.
|
|
|
|
### 4. Network loss to the node
|
|
`ping` fails, SSH fails. Check the switch and the node's `eno1` (prod-3's
|
|
`/etc/network/interfaces` also holds a commented-out wireless stanza — inert, but worth scrubbing).
|
|
A node reachable by ping but not by the API is usually Cilium, not the network: heavy sustained node
|
|
load has been observed to degrade the Cilium datapath into intermittent LB-VIP unreachability,
|
|
cleared by a restart.
|
|
|
|
### 5. Hardware
|
|
`k3s-prod-1`'s original 2011 SSD had 61,440 reallocated sectors and was replaced 2026-09-07. Check
|
|
SMART (`/runbooks/node-io` has the command). Hardware is an operator job.
|
|
|
|
## When to escalate or stop
|
|
|
|
- **STOP if two nodes are affected.** Two of three etcd members down means no quorum, no API server,
|
|
and no GitOps. Nothing in this runbook applies; get the operator.
|
|
- **Do not reboot, drain or cordon a second node** while any Longhorn volume is not `healthy`. This
|
|
cluster deliberately does not `kubectl drain` — the auto-drain of system-upgrade-controller was
|
|
rejected precisely because it fights slow-disk Longhorn.
|
|
- **Do not delete the Node object** to "clean up". That triggers replica deletion in Longhorn.
|
|
- Escalate to the operator for: a power-cycle, a disk replacement, or re-provisioning a node (the
|
|
inventory's `[k3s_prod_primary]` trap above makes re-provisioning a two-person job).
|
|
- If the node returns but volumes stay degraded for more than an hour, go to
|
|
`/runbooks/longhorn-degraded`.
|
|
|
|
---
|
|
Source of truth: `runbooks/node-down.md` in `home-network-k3s-impl`. Index: `/runbooks/`
|
|
Incident record: `DECISIONS-LOG.md` "2026-09-07 — k3s-prod-1 NotReady"; `infra/PROD-PROVISIONING.md` §0b/§0c.
|