coulomb/kaizen-agentic
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ops: apply approved host-operator remediations on railiance01
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details
ci / test (push) Failing after 5s
Details

Browse source 
Record operator approval and implement P1–P4: 4G swapfile, journald vacuum,
apt upgrade, and UFW lockdown of k3s API/flannel world-open rules. k3s node
Ready post-change; residual risk is still tight RAM.
This commit is contained in:
tegwick 2026-07-16 13:05:25 +02:00
parent 6730ec0a2c
commit 48443a9abb
8 changed files with 129 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

15
engagements/pilots/eng-coulomb-railiance01-ho-001/vault/handoff/risks.md
View file

@ -1,13 +1,10 @@
# Outstanding risks — eng-coulomb-railiance01-ho-001
Populated during operate; finalise at ramp-down (RD-03).
| Risk | Severity | Mitigation / owner | Status |
|------|----------|--------------------|--------|
| RAM undersized (3.8G, no swap) for k3s+platform density | Critical | Human capacity decision (RAM and/or swap); reduce concurrent load | open |
| k3s API ServiceUnavailable under pressure | Critical | Stabilize memory; re-check API; avoid heavy kubectl while degraded | open |
| Load average ≫ 2 cores | High | Same as capacity; schedule non-urgent work off-host | open |
| journald ~4.1G | Medium | Approved journal vacuum | open |
| Pending security package updates | Medium | Approved OS security pass | open |
| UFW allows 6443/8472 from Anywhere | Medium | Policy review + possible firewall_change | open |
| Reverse-forward port 18765 collisions | Low–Medium | Bridge/tunnel cleanup | open |
| RAM still 3.8G; swap heavily used (~1.9G/4G) | High | Provider RAM upgrade | open |
| Load still elevated (~6 on 2 cores) | Medium | Reduce concurrent workloads; capacity | open |
| Stale user sessions after apt upgrade | Low | Re-login SSH | open |
| UFW 6443 allowlist may miss new admin IPs | Medium | Add `ufw allow from <ip> to any port 6443 proto tcp` | open |
| 8472 closed externally | Low | Re-open if multi-node flannel peers appear | accepted (single-node) |
| fwupd.service failed restart during upgrade | Low | Investigate if firmware tooling needed | open |