coulomb/core-hub
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
core-hub/docs/evidence/core-hub-coulombcore-inventory-2026-08-20.md
tegwick 36f1e729b2
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / pytest-smoke (push) Failing after 2s
Details
docs: capture Core Hub relocation preflight
2026-08-20 23:04:00 +02:00

4.8 KiB
Raw Permalink Blame History

Core Hub CoulombCore production inventory — 2026-08-20

This is a metadata-only, read-only inventory captured over the existing coulombcore SSH route. No Secret value or database credential was read. Secret inspection used kubectl describe, which exposed key names and byte sizes only.

Source host and runtime

Item Live CoulombCore state
Node 254.130.205.92.host.secureserver.net / 92.205.130.254
Kubernetes v1.30.3+k3s1, Ready
Namespace core-hub, labeled railiance.io/postgres-client=apps-pg
Helm release core-hub, revision 1, chart core-hub-0.1.0
Deployment core-hub-api, Deployment revision 2, 1/1 Ready
Image reference gitea.coulomb.social/coulomb/core-hub:a33191a
Pulled image ID sha256:5e1334eb25975b5f7792d2ae9289898586224133896c6aa55bd27cdc776fb10c
Service core-hub-api, ClusterIP, port 8010
Ingress Traefik, hub.coulomb.social, TLS Secret core-hub-tls
Runtime configuration CORE_HUB_ENV=production, CORE_HUB_AUTO_CREATE_TABLES=0
Runtime Secret metadata core-hub-prod-env; keys CORE_HUB_API_TOKEN (64 bytes) and CORE_HUB_DATABASE_URL (131 bytes)
Database boundary Namespace declares the apps-pg consumer; the Secret value was not read
Migration core-hub-prod-migrate completed once in 65 seconds using the same image tag
Health Public /healthz and /readyz both returned status: ok

The source pod has zero restarts and has been running for 41 days. Resource requests/limits already match the package baseline: 250m/512Mi requests and 1 CPU/1Gi limits. Readiness and liveness use /readyz and /healthz.

Source-to-package differences

The rapp-core-hub chart 0.3.0 intentionally changes the following platform posture on railiance01:

  • immutable Forgejo image digest sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c instead of the source's mutable Gitea tag and pulled digest;
  • a dedicated non-token-mounting ServiceAccount rather than default;
  • non-root, read-only-root-filesystem, dropped-capability and seccomp settings rather than empty pod/container security contexts;
  • default-deny plus explicit DNS, PostgreSQL and ingress NetworkPolicies rather than no NetworkPolicy objects;
  • separate static API-token, runtime database and migration database Secrets rather than one combined envFrom Secret; and
  • mounted-file credential rotation supervision rather than process-lifetime environment values.

The target railiance01 preflight found a Ready v1.35.1+k3s1 node and no existing core-hub namespace or workload. Public Ingress remains disabled in the package until the operator-approved traffic cutover.

External Secrets Operator CRDs are installed on railiance01. Existing audit-core KV and database stores demonstrate the required two-store pattern, but no Core Hub store exists yet. The rapp-postgres repository also has no accepted Core Hub consumer declaration. These are explicit platform gates; the package must not be applied with placeholder Secrets or a standing database password.

The exact target image was pulled successfully by digest. Inside that image, core_hub.app, Uvicorn and Alembic import successfully under UID/GID 10001 with a read-only root filesystem and only a temporary /tmp. The image declares no default user, so the chart's explicit non-root security context remains required. This proves entry-point and filesystem compatibility without starting a database writer.

The application image differs from the live source and therefore must pass the private shadow restore, schema, public-catalog, protected-route and consumer smokes before traffic moves. This is an explicit verification gate, not an assumption of image equivalence.

Rollback anchors

  • Keep the CoulombCore Deployment, Service, Ingress, Secret and database writer intact until stabilization closes.
  • The authoritative live image rollback anchor is the pulled digest sha256:5e1334eb25975b5f7792d2ae9289898586224133896c6aa55bd27cdc776fb10c, with tag a33191a retained as historical context.
  • Helm reports revision 1, while Kubernetes reports Deployment revisions 1 and 2 with two retained ReplicaSets. Because the Deployment has post-Helm rollout history, do not rely on helm rollback alone for the source fallback.
  • Traffic rollback restores hub.coulomb.social and the active tunnel to CoulombCore before disabling the railiance01 writer.

Read-only commands used

  • kubectl get nodes -o wide
  • namespace-scoped kubectl get/rollout history for Deployment, ReplicaSet, Pod, Service, Ingress, Job, NetworkPolicy, ServiceAccount and ConfigMap
  • kubectl describe secret core-hub-prod-env
  • helm -n core-hub history/get values/get manifest core-hub
  • public HTTPS /healthz and /readyz requests
  • digest-pinned local image pull and non-root/read-only import smoke