tegwick
48443a9abb
Record operator approval and implement P1–P4: 4G swapfile, journald vacuum, apt upgrade, and UFW lockdown of k3s API/flannel world-open rules. k3s node Ready post-change; residual risk is still tight RAM.
32 lines
1.1 KiB
Markdown
32 lines
1.1 KiB
Markdown
# Human approval — privileged remediation batch
|
|
|
|
**Engagement:** eng-coulomb-railiance01-ho-001
|
|
**Date:** 2026-07-16
|
|
**Approver:** Bernd (operator) — via session instruction: *“approve the suggested tasks… implement them”*
|
|
**Agent:** host-operator (grok session)
|
|
|
|
## Approved items
|
|
|
|
| ID | Action | Class |
|
|
|----|--------|--------|
|
|
| P1 | Emergency swap file (~4G) on root FS | privileged_ops |
|
|
| P2 | journald vacuum to ~500M | privileged_ops |
|
|
| P3 | OS package upgrades (apt) + needrestart awareness | package_upgrade |
|
|
| P4 | Tighten UFW: remove world-open 6443/8472; allow k3s API from known operator IPs | firewall_change |
|
|
|
|
## Explicit non-goals
|
|
|
|
- Hardware RAM upgrade (provider console — not shell-implementable here)
|
|
- Unilateral workload kill / pod deletion
|
|
- Reboot unless needrestart shows kernel requires it **and** operator re-confirms mid-session
|
|
|
|
## Rollback notes
|
|
|
|
- P1: `swapoff` + remove swapfile + fstab line
|
|
- P2: logs not recoverable
|
|
- P3: package-specific rollback / restore
|
|
- P4: re-add `ufw allow 6443/tcp` and `8472/udp` if access breaks
|
|
|
|
## Status
|
|
|
|
Approved for immediate implementation under host_observe + gated classes above.
|