docs: capture Core Hub relocation preflight
This commit is contained in:
parent
881c87905f
commit
36f1e729b2
3 changed files with 118 additions and 14 deletions
92
docs/evidence/core-hub-coulombcore-inventory-2026-08-20.md
Normal file
92
docs/evidence/core-hub-coulombcore-inventory-2026-08-20.md
Normal file
|
|
@ -0,0 +1,92 @@
|
|||
# Core Hub CoulombCore production inventory — 2026-08-20
|
||||
|
||||
This is a metadata-only, read-only inventory captured over the existing
|
||||
`coulombcore` SSH route. No Secret value or database credential was read.
|
||||
Secret inspection used `kubectl describe`, which exposed key names and byte
|
||||
sizes only.
|
||||
|
||||
## Source host and runtime
|
||||
|
||||
| Item | Live CoulombCore state |
|
||||
| --- | --- |
|
||||
| Node | `254.130.205.92.host.secureserver.net` / `92.205.130.254` |
|
||||
| Kubernetes | `v1.30.3+k3s1`, Ready |
|
||||
| Namespace | `core-hub`, labeled `railiance.io/postgres-client=apps-pg` |
|
||||
| Helm | release `core-hub`, revision 1, chart `core-hub-0.1.0` |
|
||||
| Deployment | `core-hub-api`, Deployment revision 2, 1/1 Ready |
|
||||
| Image reference | `gitea.coulomb.social/coulomb/core-hub:a33191a` |
|
||||
| Pulled image ID | `sha256:5e1334eb25975b5f7792d2ae9289898586224133896c6aa55bd27cdc776fb10c` |
|
||||
| Service | `core-hub-api`, ClusterIP, port `8010` |
|
||||
| Ingress | Traefik, `hub.coulomb.social`, TLS Secret `core-hub-tls` |
|
||||
| Runtime configuration | `CORE_HUB_ENV=production`, `CORE_HUB_AUTO_CREATE_TABLES=0` |
|
||||
| Runtime Secret metadata | `core-hub-prod-env`; keys `CORE_HUB_API_TOKEN` (64 bytes) and `CORE_HUB_DATABASE_URL` (131 bytes) |
|
||||
| Database boundary | Namespace declares the `apps-pg` consumer; the Secret value was not read |
|
||||
| Migration | `core-hub-prod-migrate` completed once in 65 seconds using the same image tag |
|
||||
| Health | Public `/healthz` and `/readyz` both returned `status: ok` |
|
||||
|
||||
The source pod has zero restarts and has been running for 41 days. Resource
|
||||
requests/limits already match the package baseline: 250m/512Mi requests and
|
||||
1 CPU/1Gi limits. Readiness and liveness use `/readyz` and `/healthz`.
|
||||
|
||||
## Source-to-package differences
|
||||
|
||||
The `rapp-core-hub` chart `0.3.0` intentionally changes the following platform
|
||||
posture on railiance01:
|
||||
|
||||
- immutable Forgejo image digest
|
||||
`sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c`
|
||||
instead of the source's mutable Gitea tag and pulled digest;
|
||||
- a dedicated non-token-mounting ServiceAccount rather than `default`;
|
||||
- non-root, read-only-root-filesystem, dropped-capability and seccomp settings
|
||||
rather than empty pod/container security contexts;
|
||||
- default-deny plus explicit DNS, PostgreSQL and ingress NetworkPolicies rather
|
||||
than no NetworkPolicy objects;
|
||||
- separate static API-token, runtime database and migration database Secrets
|
||||
rather than one combined `envFrom` Secret; and
|
||||
- mounted-file credential rotation supervision rather than process-lifetime
|
||||
environment values.
|
||||
|
||||
The target railiance01 preflight found a Ready `v1.35.1+k3s1` node and no
|
||||
existing `core-hub` namespace or workload. Public Ingress remains disabled in
|
||||
the package until the operator-approved traffic cutover.
|
||||
|
||||
External Secrets Operator CRDs are installed on railiance01. Existing audit-core
|
||||
KV and database stores demonstrate the required two-store pattern, but no
|
||||
Core Hub store exists yet. The `rapp-postgres` repository also has no accepted
|
||||
Core Hub consumer declaration. These are explicit platform gates; the package
|
||||
must not be applied with placeholder Secrets or a standing database password.
|
||||
|
||||
The exact target image was pulled successfully by digest. Inside that image,
|
||||
`core_hub.app`, Uvicorn and Alembic import successfully under UID/GID 10001 with
|
||||
a read-only root filesystem and only a temporary `/tmp`. The image declares no
|
||||
default user, so the chart's explicit non-root security context remains
|
||||
required. This proves entry-point and filesystem compatibility without starting
|
||||
a database writer.
|
||||
|
||||
The application image differs from the live source and therefore must pass the
|
||||
private shadow restore, schema, public-catalog, protected-route and consumer
|
||||
smokes before traffic moves. This is an explicit verification gate, not an
|
||||
assumption of image equivalence.
|
||||
|
||||
## Rollback anchors
|
||||
|
||||
- Keep the CoulombCore Deployment, Service, Ingress, Secret and database writer
|
||||
intact until stabilization closes.
|
||||
- The authoritative live image rollback anchor is the pulled digest
|
||||
`sha256:5e1334eb25975b5f7792d2ae9289898586224133896c6aa55bd27cdc776fb10c`,
|
||||
with tag `a33191a` retained as historical context.
|
||||
- Helm reports revision 1, while Kubernetes reports Deployment revisions 1 and
|
||||
2 with two retained ReplicaSets. Because the Deployment has post-Helm rollout
|
||||
history, do not rely on `helm rollback` alone for the source fallback.
|
||||
- Traffic rollback restores `hub.coulomb.social` and the active tunnel to
|
||||
CoulombCore before disabling the railiance01 writer.
|
||||
|
||||
## Read-only commands used
|
||||
|
||||
- `kubectl get nodes -o wide`
|
||||
- namespace-scoped `kubectl get`/`rollout history` for Deployment, ReplicaSet,
|
||||
Pod, Service, Ingress, Job, NetworkPolicy, ServiceAccount and ConfigMap
|
||||
- `kubectl describe secret core-hub-prod-env`
|
||||
- `helm -n core-hub history/get values/get manifest core-hub`
|
||||
- public HTTPS `/healthz` and `/readyz` requests
|
||||
- digest-pinned local image pull and non-root/read-only import smoke
|
||||
Loading…
Add table
Add a link
Reference in a new issue