jakman85andClaude Opus 4.8
cc89b4b830
Author-only Phase-2 components (platform suspended; cluster untouched): - platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE) - platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS) - platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2 - conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2) - bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume) Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG). Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
3.8 KiB
3.8 KiB
Autonomous Session Decision Log (PM)
Program Manager working independently while the operator is AFK (started 2026-08-16). Every
best-effort decision and assumption is recorded here for later review. Specs were NOT modified
(PM cannot change ../home-network-k3s; that requires the System Architect hat). Blocked items that
need the operator are called out.
Guardrails I'm holding to
- No spec changes. No fabricated secrets (Cloudflare token, PIA creds, SMTP — all await hand-off).
- Don't break the running cluster:
platform/stays suspended in Flux until each component is filled in + validated;platform/ciliummust carryk8sServiceHost=10.73.0.11before it ever reconciles. - Everything author-first,
make -C ci gategreen before merge, feature-branch→main.
Decisions / assumptions (append-only)
| # | Decision / assumption | Why | Review flag |
|---|---|---|---|
| A1 | Complete Phase 1 T-1.4 via Option A (Flux bootstrapped, platform+apps suspended) |
You picked Option A earlier as the safe path; "keep going" authorizes it | Confirm scope |
| A2 | Advance Phase 2 only for components needing no operator secret: Longhorn, monitoring, Kyverno-admission, Cilium-parity | cert-manager/externaldns/velero/VPN are blocked on token/PIA/OQ-BKP | — |
| A3 | Dev resource caps for monitoring (short retention, small PVCs, single replicas) from cluster-vars |
22 GiB RAM ceiling | Tune later |
| A4 | Host Gitea repo is public (NAT-only) so Flux needs no git creds | dev bootstrap simplicity | Fine for dev |
Autonomous session results (2026-08-16)
- Phase-2 authoring (author-only, merged):
platform/longhorn(3-replica SC + bulk indirection),platform/monitoring(kube-prometheus-stack + Loki + Alloy, dev-trimmed ~1.3 GiB, +8 alert rules),platform/cilium(parity fix: k8sServiceHost=10.73.0.11 + masquerade, safe to adopt in Phase 2),platform/kyverno(verified). Gate green. - Flux INSTALLED on the cluster (4 controllers Running). Host Gitea working (named-volume fix),
repo pushed. GitRepository created → BLOCKED: cluster pods can't reach
10.73.0.1:3000(firewalldlibvirtzone drops VM→host:3000). Needs operator (one command, I lack sudo):sudo firewall-cmd --zone=libvirt --add-port=3000/tcp --permanent && sudo firewall-cmd --reloadThen Flux reconciles from Gitea (Phase-1 T-1.4 exit). - NOT deployed:
platform/appsKustomizations were deliberately NOT created — the running cluster (Cilium etc.) is untouched. Only Flux controllers + the GitRepository source exist.
KNOWN ISSUES to fix before Phase-2 un-suspend (logged, not yet fixed)
| # | Issue | Impact | Fix |
|---|---|---|---|
| K1 | Substitution-var case mismatch: components use ${UPPERCASE} but clusters/base/cluster-vars.yaml keys are lowercase; Flux substituteFrom is case-sensitive → won't resolve |
platform HelmReleases get literal ${...} values on reconcile |
Rename cluster-vars keys to UPPERCASE + update dev/prod overlay patch paths (clusters/) |
| K2 | Conformance worker failed (session limit) mid-task; left partial L2 tests (default-deny, deny-undeclared, data-survival) + incomplete run.sh --requirements×--layer work |
L2 tests partial, not verified runnable | Re-dispatch to finish run.sh flag intersection + validate the tests |
| K3 | bootstrap/gitea/bootstrap-gitea.sh used a host bind-mount → rootless-podman perms broke app.ini |
initial Gitea start failed | FIXED: switched to a named volume |
Blocked on operator (hand-offs)
- T-2.4p Cloudflare API token → cert-manager DNS-01 + ExternalDNS (Phase 2 TLS/DNS).
- T-3.2p PIA username/password → VPN egress gateway (Phase 3).
- OQ-BKP off-cluster backup target → Velero (Phase 4).
- SMTP creds → Alertmanager email (Phase 4).