tegwick b7fb7b226f Wave-2 right-sizing and inter-hub removal (RAPPS-WP-0018, CSOC-WP-0017, REUSE-WP-0026)

- coulomb-social: requests 100m/256Mi -> 15m/176Mi (limits unchanged)
- reuse-surface: main 100m/256Mi -> 5m/64Mi, landing 10m/32Mi -> 5m/16Mi
- vergabe-demo-company: memory request 256Mi -> 512Mi, CPU 60m kept
- inter-hub (retired, CORE-WP-0007): delete chart, values, Make targets,
  smoke script and production deploy workflow; release to be uninstalled

Full renders vs live: resources only, except the vergabe release-unit label
from 64530e1 not yet on its Service and PVCs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

2026-10-22 00:03:48 +02:00

3 KiB

Raw Blame History

Operator Setup

Run these checks before deploying any S5 workload:

make check-tools

When the app release work touches encrypted SOPS files, also verify the operator age identity against the encrypted file being changed:

SOPS_SENTINEL=<encrypted-file> make check-sops

Required Tools

kubectl
helm
sops
python3
curl

Install the CNPG plugin for better database diagnostics:

kubectl krew install cnpg

make check-tools fails when required tools are missing and warns when kubectl cnpg is unavailable. The Makefile status targets fall back to plain Kubernetes resources, but the plugin output is the preferred view for primary/replica health and backup state.

Production Cluster Kubeconfig

S5 production app releases belong on Railiance01. CoulombCore may still host bootstrap or prerelease services, so do not rely on the workstation's ambient kubectl context for production app deploys.

Name	IP	Role
Railiance01	`92.205.62.239`	Production k3s; deploy S5 apps here
CoulombCore	`92.205.130.254`	Bootstrap / prerelease only

Hostname	Production DNS A	Notes
`reuse.coulomb.social`	`92.205.62.239`	Production reuse-surface hub
`hub.coulomb.social`	`92.205.62.239`	Target production inter-hub host; bootstrap may still point at CoulombCore until cutover

The production Makefile targets default to:

~/.kube/config-railiance01

It reaches the API through the k3s-api-railiance01 ops-bridge tunnel on 127.0.0.1:16444 (bridge up k3s-api-railiance01 if it is down). The older ~/.kube/config-hosteurope names port 16443 and is retired.

Restore it from Railiance01 when missing:

ssh tegwick@92.205.62.239 'sudo cat /etc/rancher/k3s/k3s.yaml' \
  | sed 's|127.0.0.1:6443|127.0.0.1:16444|' > ~/.kube/config-railiance01
chmod 600 ~/.kube/config-railiance01
export KUBECONFIG=~/.kube/config-railiance01

The app-specific targets also accept explicit overrides:

REUSE_KUBECONFIG=~/.kube/config-railiance01 make reuse-status

SOPS Age Key Bootstrap

SOPS-encrypted values used by app release work expect an age identity at:

~/.config/sops/age/keys.txt

Bootstrap procedure:

Receive the operator age identity through an out-of-band channel.

Create the directory with owner-only permissions:

mkdir -p ~/.config/sops/age
chmod 700 ~/.config/sops ~/.config/sops/age

Write the identity to ~/.config/sops/age/keys.txt.
Restrict the file:
```
chmod 600 ~/.config/sops/age/keys.txt
```
Verify decryption against the encrypted file being changed:
```
SOPS_SENTINEL=<encrypted-file> make check-sops
```

Do not commit age identities, decrypted values, or copied SOPS plaintext to this repo.

Rotation

To rotate access, add the new recipient to the relevant SOPS files, re-encrypt, verify with both old and new operators, then remove the old recipient in a separate change. Keep at least one known-good recovery operator key available during the transition.

3 KiB Raw Blame History