jakman85andClaude Opus 4.8
3df5071bd1
Per operator: the firewalld rule (VM->host:3000 for the Flux<-Gitea source) must be IaC, not a manual command (R-ENV-01, R-PLAT-04). - infra/ansible/playbooks/host-prereqs.yml: idempotent firewalld open on the libvirt zone (localhost play, become; no extra collection). - bootstrap/gitea/bootstrap-gitea.sh: now fully automates admin + public repo + push (was manual instructions) — idempotent; creds stay 0600 on host, never committed. Applying host-prereqs still needs host sudo (I lack non-interactive sudo); with passwordless become a destroy/rebuild is fully unattended. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
51 lines
4.1 KiB
Markdown
51 lines
4.1 KiB
Markdown
# Autonomous Session Decision Log (PM)
|
||
|
||
Program Manager working independently while the operator is AFK (started 2026-08-16). Every
|
||
best-effort decision and assumption is recorded here for later review. **Specs were NOT modified**
|
||
(PM cannot change `../home-network-k3s`; that requires the System Architect hat). Blocked items that
|
||
need the operator are called out.
|
||
|
||
## Guardrails I'm holding to
|
||
- No spec changes. No fabricated secrets (Cloudflare token, PIA creds, SMTP — all await hand-off).
|
||
- Don't break the running cluster: `platform/` stays **suspended** in Flux until each component is
|
||
filled in + validated; `platform/cilium` must carry `k8sServiceHost=10.73.0.11` before it ever
|
||
reconciles.
|
||
- Everything author-first, `make -C ci gate` green before merge, feature-branch→main.
|
||
|
||
## Decisions / assumptions (append-only)
|
||
| # | Decision / assumption | Why | Review flag |
|
||
|---|---|---|---|
|
||
| A1 | Complete Phase 1 T-1.4 via **Option A** (Flux bootstrapped, `platform`+`apps` suspended) | You picked Option A earlier as the safe path; "keep going" authorizes it | Confirm scope |
|
||
| A2 | Advance Phase 2 only for components needing **no operator secret**: Longhorn, monitoring, Kyverno-admission, Cilium-parity | cert-manager/externaldns/velero/VPN are blocked on token/PIA/OQ-BKP | — |
|
||
| A3 | Dev resource caps for monitoring (short retention, small PVCs, single replicas) from `cluster-vars` | 22 GiB RAM ceiling | Tune later |
|
||
| A4 | Host Gitea repo is **public** (NAT-only) so Flux needs no git creds | dev bootstrap simplicity | Fine for dev |
|
||
|
||
## Autonomous session results (2026-08-16)
|
||
- **Phase-2 authoring (author-only, merged):** `platform/longhorn` (3-replica SC + bulk indirection),
|
||
`platform/monitoring` (kube-prometheus-stack + Loki + Alloy, dev-trimmed ~1.3 GiB, +8 alert rules),
|
||
`platform/cilium` (parity fix: k8sServiceHost=10.73.0.11 + masquerade, safe to adopt in Phase 2),
|
||
`platform/kyverno` (verified). Gate green.
|
||
- **Flux INSTALLED** on the cluster (4 controllers Running). Host **Gitea working** (named-volume fix),
|
||
repo pushed. GitRepository created → **BLOCKED**: cluster pods can't reach `10.73.0.1:3000`
|
||
(firewalld `libvirt` zone drops VM→host:3000).
|
||
- **Now codified as IaC (per operator: no manual commands):** `infra/ansible/playbooks/host-prereqs.yml`
|
||
opens the port idempotently; `bootstrap/gitea/bootstrap-gitea.sh` now **fully automates** admin +
|
||
public repo + push (was manual). A rebuild is hands-off. To APPLY the firewall (I lack
|
||
non-interactive sudo): `ansible-playbook infra/ansible/playbooks/host-prereqs.yml --ask-become-pass`
|
||
(or passwordless host sudo for unattended rebuilds). Then Flux reconciles → Phase-1 T-1.4 exit.
|
||
- **NOT deployed:** `platform`/`apps` Kustomizations were deliberately NOT created — the running
|
||
cluster (Cilium etc.) is untouched. Only Flux controllers + the GitRepository source exist.
|
||
|
||
## KNOWN ISSUES to fix before Phase-2 un-suspend (logged, not yet fixed)
|
||
| # | Issue | Impact | Fix |
|
||
|---|---|---|---|
|
||
| K1 | **Substitution-var case mismatch**: components use `${UPPERCASE}` but `clusters/base/cluster-vars.yaml` keys are lowercase; Flux substituteFrom is case-sensitive → won't resolve | platform HelmReleases get literal `${...}` values on reconcile | Rename cluster-vars keys to UPPERCASE + update dev/prod overlay patch paths (clusters/) |
|
||
| K2 | Conformance worker **failed (session limit)** mid-task; left partial L2 tests (default-deny, deny-undeclared, data-survival) + incomplete `run.sh --requirements×--layer` work | L2 tests partial, not verified runnable | Re-dispatch to finish run.sh flag intersection + validate the tests |
|
||
| K3 | `bootstrap/gitea/bootstrap-gitea.sh` used a host bind-mount → rootless-podman perms broke app.ini | initial Gitea start failed | FIXED: switched to a named volume |
|
||
|
||
## Blocked on operator (hand-offs)
|
||
- **T-2.4p** Cloudflare API token → cert-manager DNS-01 + ExternalDNS (Phase 2 TLS/DNS).
|
||
- **T-3.2p** PIA username/password → VPN egress gateway (Phase 3).
|
||
- **OQ-BKP** off-cluster backup target → Velero (Phase 4).
|
||
- SMTP creds → Alertmanager email (Phase 4).
|