48 lines
2 KiB
Markdown
48 lines
2 KiB
Markdown
|
# Privileged remediation report — railiance01 — 2026-07-16
|
|||
|
|
|
|||
|
|
**Engagement:** eng-coulomb-railiance01-ho-001
|
|||
|
|
**Approval:** `vault/session-log/2026-07-16-privileged-approval.md`
|
|||
|
|
**Outcome:** success (with residual capacity risk)
|
|||
|
|
|
|||
|
|
## Summary
|
|||
|
|
|
|||
|
|
| ID | Action | Result |
|
|||
|
|
|----|--------|--------|
|
|||
|
|
| P1 | 4 GiB `/swapfile`, fstab persist | **Done** — swap active (~1.9 GiB used post-change) |
|
|||
|
|
| P2 | journald vacuum → 500 M | **Done** — freed ~3.5 GiB archived journals; journal now ~461 M |
|
|||
|
|
| P3 | `apt-get upgrade` (noninteractive) | **Done** — packages updated; kernel still current (no reboot required) |
|
|||
|
|
| P4 | UFW: drop world 6443/8472; allow 6443 from operator IPs | **Done** |
|
|||
|
|
|
|||
|
|
## Before → after (host signals)
|
|||
|
|
|
|||
|
|
| Metric | Before (ramp-up) | After remediation |
|
|||
|
|
|--------|------------------|-------------------|
|
|||
|
|
| Swap | none | 4 GiB file, ~1.9 GiB used |
|
|||
|
|
| MemAvailable | often <150 Mi | ~625 Mi |
|
|||
|
|
| PSI memory full avg60 | ~24% | ~8% |
|
|||
|
|
| Load 1m | ~12 | ~6 |
|
|||
|
|
| /var/log/journal | ~4.1 Gi | ~461 Mi |
|
|||
|
|
| k3s node | API often unavailable | **Ready** control-plane |
|
|||
|
|
| UFW 6443 | Anywhere | 89.244.90.246, 85.132.220.102 only |
|
|||
|
|
| UFW 8472 | Anywhere | **removed** (single-node) |
|
|||
|
|
|
|||
|
|
## Side effects / notes
|
|||
|
|
|
|||
|
|
- `fwupd.service` failed to restart during upgrade (non-blocking for cluster)
|
|||
|
|
- needrestart: deferred restarts for cloud-final, dbus, getty, logind, unattended-upgrades; user sessions still on older sshd binaries until re-login
|
|||
|
|
- **RAM is still 3.8 GiB** — swap masks OOM risk but is not a substitute for more memory under sustained pressure
|
|||
|
|
- If remote kubectl from another IP fails, add: `ufw allow from <ip> to any port 6443 proto tcp`
|
|||
|
|
- UFW backups: `/etc/ufw/user.rules.bak.20260716` (and user6)
|
|||
|
|
|
|||
|
|
## Explicitly not done
|
|||
|
|
|
|||
|
|
- Hardware RAM upgrade (provider console)
|
|||
|
|
- Host reboot (kernel KSTA=1, not required)
|
|||
|
|
|
|||
|
|
## Recommended follow-up
|
|||
|
|
|
|||
|
|
1. Plan RAM upgrade when convenient
|
|||
|
|
2. Re-login SSH sessions to pick up new binaries
|
|||
|
|
3. Watch swap usage; if chronically full, capacity still insufficient
|
|||
|
|
4. Maintain operator IP allowlist when admin IPs change
|