feat: prepare Core Hub production relocation
This commit is contained in:
parent
d7627dabf5
commit
881c87905f
7 changed files with 230 additions and 17 deletions
|
|
@ -13,6 +13,7 @@ parent_project: prj-state-hub-retirement
|
|||
parent_workplan: SHR-WP-0001
|
||||
related:
|
||||
- CORE-WP-0009
|
||||
- CORE-WP-0011
|
||||
- HUB-WP-0004
|
||||
- SHR-ARCH-HUB-0001
|
||||
state_hub_workstream_id: "f5a90aa2-e63f-4f94-b052-8be0d0ee55ea"
|
||||
|
|
@ -28,6 +29,15 @@ through dual-run, then **archive core-hub** read-only with evidence.
|
|||
|
||||
Parent project: `prj-state-hub-retirement`. Depends on **HUB-WP-0004**.
|
||||
|
||||
## Sequencing decision — 2026-08-20
|
||||
|
||||
The CoulombCore decommission does not force the unresolved hub-core
|
||||
library-vs-thin-host decision. Production continuity is decoupled through
|
||||
`CORE-WP-0011`, which moves the existing Core Hub service to railiance01
|
||||
first. This workplan remains proposed until `HUB-WP-0004` settles the durable
|
||||
runtime boundary; absorption must not sit on the critical path for leaving
|
||||
CoulombCore.
|
||||
|
||||
## Inventory runtime surfaces to absorb
|
||||
|
||||
```task
|
||||
|
|
|
|||
188
workplans/CORE-WP-0011-railiance01-production-relocation.md
Normal file
188
workplans/CORE-WP-0011-railiance01-production-relocation.md
Normal file
|
|
@ -0,0 +1,188 @@
|
|||
---
|
||||
id: CORE-WP-0011
|
||||
type: workplan
|
||||
title: "Relocate Core Hub production from CoulombCore to railiance01"
|
||||
domain: infotech
|
||||
repo: core-hub
|
||||
status: active
|
||||
owner: codex
|
||||
topic_slug: infotech
|
||||
created: "2026-08-20"
|
||||
updated: "2026-08-20"
|
||||
parent_project: prj-state-hub-retirement
|
||||
parent_workplan: SHR-WP-0002
|
||||
related:
|
||||
- CORE-WP-0005
|
||||
- CORE-WP-0007
|
||||
- CORE-WP-0010
|
||||
- HUB-WP-0004
|
||||
---
|
||||
|
||||
# Relocate Core Hub production from CoulombCore to railiance01
|
||||
|
||||
## Goal
|
||||
|
||||
Move the existing Core Hub production service at `hub.coulomb.social` from
|
||||
CoulombCore to railiance01 before CoulombCore is decommissioned. Preserve the
|
||||
current `/api/v2` contract, data, hostname, credentials boundary, and rollback
|
||||
evidence. Do not make runtime absorption into hub-core a prerequisite.
|
||||
|
||||
## Decision and constraints
|
||||
|
||||
- Use the interim-move shape requested by `SHR-WP-0002-T03`: package and move
|
||||
Core Hub as-is, then resolve long-term absorption under `CORE-WP-0010` and
|
||||
`HUB-WP-0004` on their own architecture schedule.
|
||||
- Use the governed Repo Manager rapp path. Because the live deployment truth is
|
||||
a Helm chart, initialize a managed package instead of asking `rapp wrap` to
|
||||
invent or ingest Helm content; retain this repo's manifests as source evidence
|
||||
until the package is verified.
|
||||
- Treat the CoulombCore decommission date as a scheduling input, not as a
|
||||
reason to collapse the hub-core library-vs-thin-host decision.
|
||||
- Any traffic flip, final data freeze/transfer, or old-runtime removal requires
|
||||
explicit operator approval and a rehearsed rollback.
|
||||
|
||||
## Inventory source and target runtime
|
||||
|
||||
```task
|
||||
id: CORE-WP-0011-T01
|
||||
status: progress
|
||||
priority: high
|
||||
```
|
||||
|
||||
Capture the live CoulombCore image, Deployment, Service, Ingress, database,
|
||||
secret references, resource policy, and tunnel/DNS ownership. Compare them to
|
||||
railiance01 and the checked-in `k8s/railiance-production/` manifests.
|
||||
|
||||
Local review on 2026-08-20 confirms that the repo already carries a namespace,
|
||||
migration Job, API Deployment, Service, Ingress, health probes, and the
|
||||
historical migration/cutover runbook. The manifests need a live-state diff and
|
||||
modern platform-policy review before reuse. The retirement project reports no
|
||||
`core-hub` namespace or Deployment on railiance01. A read-only preflight on
|
||||
2026-08-20 confirmed the current Kubernetes context reaches the Ready k3s node
|
||||
`239.62.205.92.host.secureserver.net` (`92.205.62.239`, Kubernetes
|
||||
`v1.35.1+k3s1`), has no `core-hub` namespace or resources, and retains an
|
||||
`inter-hub` namespace. Pin the CoulombCore decommission date while this task is
|
||||
in progress so later gates have explicit deadlines. The retirement deadline is
|
||||
now pinned to **2026-08-31** (11 days from workplan creation). Source-cluster
|
||||
live state and target platform-policy comparison remain open.
|
||||
|
||||
The registry audit found that production/staging manifests, runbooks, and
|
||||
Forgejo CI already publish and pull `forgejo.coulomb.social/coulomb/core-hub`,
|
||||
but the local Makefile default and deployed-smoke evidence still named the
|
||||
CoulombCore-hosted Gitea registry. Those two active references were changed to
|
||||
Forgejo on 2026-08-20. The only remaining Gitea image reference is historical
|
||||
evidence in finished `CORE-WP-0004`; confirm the live source Deployment image
|
||||
and digest before declaring the dependency closed.
|
||||
|
||||
An attended source-cluster inventory remains required. On 2026-08-20 the
|
||||
CoulombCore kubeconfig pointed at the documented local API port `16443`, but
|
||||
the tunnel was down; the current ops-bridge config no longer contains
|
||||
`k3s-api-coulombcore`. The sanctioned warden signer route was followed, but its
|
||||
credential broker requires an operator-held OpenBao issuer login unavailable
|
||||
to this non-interactive session. No alternate credential path was attempted.
|
||||
After operator login, collect metadata-only Deployment/Service/Ingress, image
|
||||
digest, Secret names and keys (never values), database target, resource policy,
|
||||
and Helm revision evidence before closing this task.
|
||||
|
||||
## Build the relocatable application package
|
||||
|
||||
```task
|
||||
id: CORE-WP-0011-T02
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
Wrap the current service through the governed rapp path. Pin the source
|
||||
revision and image digest, express namespace/runtime/database/secret
|
||||
dependencies without credential values, and add render/package checks. Reuse
|
||||
the current container and `/healthz`, `/readyz`, and deployed-smoke surfaces.
|
||||
|
||||
Done when the package renders deterministically, policy checks pass, and its
|
||||
rendered workload is equivalent to the live service except for documented
|
||||
railiance01 platform adaptations.
|
||||
|
||||
Completed locally on 2026-08-20 in `/home/worsch/rapp-core-hub`. Repo Manager
|
||||
initialized a Helm-managed package because the live deployment truth is the
|
||||
existing `railiance-apps/charts/core-hub` chart; `rmgr rapp wrap` deliberately
|
||||
refuses to invent or ingest Helm charts. The package absorbs that chart and
|
||||
adds an immutable Forgejo digest pin, safe-private Ingress default,
|
||||
non-root/read-only security contexts, ServiceAccount hardening,
|
||||
default-deny/DNS/Postgres/Traefik NetworkPolicies, deterministic render,
|
||||
Alembic migration, live smoke, and Helm rollback surfaces. Evidence:
|
||||
|
||||
- package tests: 5 passed;
|
||||
- Helm lint: passed;
|
||||
- family validator: 4 declarations ok;
|
||||
- railiance01 Helm/Kubernetes server dry-run: passed;
|
||||
- current image pin:
|
||||
`sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c`.
|
||||
|
||||
Published and registered on 2026-08-20 after the operator created the Forgejo
|
||||
stub. Local history was attached without discarding either root. Private
|
||||
Forgejo `main` now includes credential-contract release commit `03effc8`.
|
||||
Chart `0.3.0` separates the static API-token Secret from runtime and migration
|
||||
database lease Secrets and supervises the application through mounted-file
|
||||
rotation; seven tests prove separation, safe URL construction, no credential
|
||||
output, and restart signaling. State Hub registers active
|
||||
repo `rapp-core-hub` as `445ea292-70bb-435c-8c69-c4cb57a6985b`, with the
|
||||
`bnt-lap001:/home/worsch/rapp-core-hub` host path, the canonical stub-root Git
|
||||
fingerprint, and Core Hub's topic ID. The package uses registered workplan
|
||||
prefix `RAPPCOREHUB-WP-`; consistency passes with only the expected warning
|
||||
that this workstation is not the production workplan-UUID registrar.
|
||||
|
||||
## Deploy shadow runtime and rehearse data transfer
|
||||
|
||||
```task
|
||||
id: CORE-WP-0011-T03
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Provision the railiance01 namespace, database role/database, governed secret
|
||||
delivery, migration Job, Deployment, and Service without moving production
|
||||
traffic. Rehearse backup/restore or logical transfer from CoulombCore, compare
|
||||
table and row counts, and run public plus authenticated consumer smokes against
|
||||
the private target endpoint.
|
||||
|
||||
Done when the shadow runtime is healthy, data reconciliation is repeatable,
|
||||
and ops-hub plus activity-core smokes pass against railiance01.
|
||||
|
||||
## Cut over production traffic
|
||||
|
||||
```task
|
||||
id: CORE-WP-0011-T04
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
With explicit operator approval, freeze writes for the bounded final-transfer
|
||||
window, transfer and reconcile the final data, then move
|
||||
`hub.coulomb.social` and the active ops-bridge tunnel from CoulombCore to
|
||||
railiance01. Verify TLS, health/readiness, public catalogs, protected routes,
|
||||
operator console, consumer smokes, and the first post-cutover write.
|
||||
|
||||
Rollback must restore the prior traffic/tunnel target and database write path;
|
||||
the old runtime stays intact until stabilization closes.
|
||||
|
||||
## Stabilize and release CoulombCore dependencies
|
||||
|
||||
```task
|
||||
id: CORE-WP-0011-T05
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Run a time-bounded stabilization window with scheduled health and consumer
|
||||
checks. After operator sign-off, remove Core Hub from the CoulombCore shutdown
|
||||
critical path, retire `core-hub-staging` and any obsolete tunnel there, and
|
||||
record retained backup/rollback evidence and residual owners. Do not archive
|
||||
this repo unless the separate absorption workplan has also completed.
|
||||
|
||||
## Acceptance
|
||||
|
||||
- [ ] Decommission deadline and live source/target inventory are recorded
|
||||
- [x] Governed rapp package renders and passes policy checks
|
||||
- [ ] Shadow restore/reconciliation and consumer smokes pass on railiance01
|
||||
- [ ] Production traffic and tunnel move with explicit approval and rollback
|
||||
- [ ] Stabilization passes and CoulombCore no longer hosts Core Hub dependencies
|
||||
- [ ] `CORE-WP-0010` remains independently sequenced behind `HUB-WP-0004`
|
||||
Loading…
Add table
Add a link
Reference in a new issue