jakman85andClaude Opus 4.8
cc89b4b830
Author-only Phase-2 components (platform suspended; cluster untouched): - platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE) - platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS) - platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2 - conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2) - bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume) Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG). Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
48 lines
3.8 KiB
Markdown
48 lines
3.8 KiB
Markdown
# Autonomous Session Decision Log (PM)
|
||
|
||
Program Manager working independently while the operator is AFK (started 2026-08-16). Every
|
||
best-effort decision and assumption is recorded here for later review. **Specs were NOT modified**
|
||
(PM cannot change `../home-network-k3s`; that requires the System Architect hat). Blocked items that
|
||
need the operator are called out.
|
||
|
||
## Guardrails I'm holding to
|
||
- No spec changes. No fabricated secrets (Cloudflare token, PIA creds, SMTP — all await hand-off).
|
||
- Don't break the running cluster: `platform/` stays **suspended** in Flux until each component is
|
||
filled in + validated; `platform/cilium` must carry `k8sServiceHost=10.73.0.11` before it ever
|
||
reconciles.
|
||
- Everything author-first, `make -C ci gate` green before merge, feature-branch→main.
|
||
|
||
## Decisions / assumptions (append-only)
|
||
| # | Decision / assumption | Why | Review flag |
|
||
|---|---|---|---|
|
||
| A1 | Complete Phase 1 T-1.4 via **Option A** (Flux bootstrapped, `platform`+`apps` suspended) | You picked Option A earlier as the safe path; "keep going" authorizes it | Confirm scope |
|
||
| A2 | Advance Phase 2 only for components needing **no operator secret**: Longhorn, monitoring, Kyverno-admission, Cilium-parity | cert-manager/externaldns/velero/VPN are blocked on token/PIA/OQ-BKP | — |
|
||
| A3 | Dev resource caps for monitoring (short retention, small PVCs, single replicas) from `cluster-vars` | 22 GiB RAM ceiling | Tune later |
|
||
| A4 | Host Gitea repo is **public** (NAT-only) so Flux needs no git creds | dev bootstrap simplicity | Fine for dev |
|
||
|
||
## Autonomous session results (2026-08-16)
|
||
- **Phase-2 authoring (author-only, merged):** `platform/longhorn` (3-replica SC + bulk indirection),
|
||
`platform/monitoring` (kube-prometheus-stack + Loki + Alloy, dev-trimmed ~1.3 GiB, +8 alert rules),
|
||
`platform/cilium` (parity fix: k8sServiceHost=10.73.0.11 + masquerade, safe to adopt in Phase 2),
|
||
`platform/kyverno` (verified). Gate green.
|
||
- **Flux INSTALLED** on the cluster (4 controllers Running). Host **Gitea working** (named-volume fix),
|
||
repo pushed. GitRepository created → **BLOCKED**: cluster pods can't reach `10.73.0.1:3000`
|
||
(firewalld `libvirt` zone drops VM→host:3000). **Needs operator (one command, I lack sudo):**
|
||
`sudo firewall-cmd --zone=libvirt --add-port=3000/tcp --permanent && sudo firewall-cmd --reload`
|
||
Then Flux reconciles from Gitea (Phase-1 T-1.4 exit).
|
||
- **NOT deployed:** `platform`/`apps` Kustomizations were deliberately NOT created — the running
|
||
cluster (Cilium etc.) is untouched. Only Flux controllers + the GitRepository source exist.
|
||
|
||
## KNOWN ISSUES to fix before Phase-2 un-suspend (logged, not yet fixed)
|
||
| # | Issue | Impact | Fix |
|
||
|---|---|---|---|
|
||
| K1 | **Substitution-var case mismatch**: components use `${UPPERCASE}` but `clusters/base/cluster-vars.yaml` keys are lowercase; Flux substituteFrom is case-sensitive → won't resolve | platform HelmReleases get literal `${...}` values on reconcile | Rename cluster-vars keys to UPPERCASE + update dev/prod overlay patch paths (clusters/) |
|
||
| K2 | Conformance worker **failed (session limit)** mid-task; left partial L2 tests (default-deny, deny-undeclared, data-survival) + incomplete `run.sh --requirements×--layer` work | L2 tests partial, not verified runnable | Re-dispatch to finish run.sh flag intersection + validate the tests |
|
||
| K3 | `bootstrap/gitea/bootstrap-gitea.sh` used a host bind-mount → rootless-podman perms broke app.ini | initial Gitea start failed | FIXED: switched to a named volume |
|
||
|
||
## Blocked on operator (hand-offs)
|
||
- **T-2.4p** Cloudflare API token → cert-manager DNS-01 + ExternalDNS (Phase 2 TLS/DNS).
|
||
- **T-3.2p** PIA username/password → VPN egress gateway (Phase 3).
|
||
- **OQ-BKP** off-cluster backup target → Velero (Phase 4).
|
||
- SMTP creds → Alertmanager email (Phase 4).
|