tegwick
b7fb7b226f
- coulomb-social: requests 100m/256Mi -> 15m/176Mi (limits unchanged)
- reuse-surface: main 100m/256Mi -> 5m/64Mi, landing 10m/32Mi -> 5m/16Mi
- vergabe-demo-company: memory request 256Mi -> 512Mi, CPU 60m kept
- inter-hub (retired, CORE-WP-0007): delete chart, values, Make targets,
smoke script and production deploy workflow; release to be uninstalled
Full renders vs live: resources only, except the vergabe release-unit label
from 64530e1 not yet on its Service and PVCs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
110 lines
3 KiB
Markdown
110 lines
3 KiB
Markdown
# Operator Setup
|
|
|
|
Run these checks before deploying any S5 workload:
|
|
|
|
```bash
|
|
make check-tools
|
|
```
|
|
|
|
When the app release work touches encrypted SOPS files, also verify the
|
|
operator age identity against the encrypted file being changed:
|
|
|
|
```bash
|
|
SOPS_SENTINEL=<encrypted-file> make check-sops
|
|
```
|
|
|
|
## Required Tools
|
|
|
|
- `kubectl`
|
|
- `helm`
|
|
- `sops`
|
|
- `python3`
|
|
- `curl`
|
|
|
|
Install the CNPG plugin for better database diagnostics:
|
|
|
|
```bash
|
|
kubectl krew install cnpg
|
|
```
|
|
|
|
`make check-tools` fails when required tools are missing and warns when
|
|
`kubectl cnpg` is unavailable. The Makefile status targets fall back to
|
|
plain Kubernetes resources, but the plugin output is the preferred view
|
|
for primary/replica health and backup state.
|
|
|
|
## Production Cluster Kubeconfig
|
|
|
|
S5 production app releases belong on **Railiance01**. CoulombCore may still
|
|
host bootstrap or prerelease services, so do not rely on the workstation's
|
|
ambient `kubectl` context for production app deploys.
|
|
|
|
| Name | IP | Role |
|
|
|---|---|---|
|
|
| Railiance01 | `92.205.62.239` | Production k3s; deploy S5 apps here |
|
|
| CoulombCore | `92.205.130.254` | Bootstrap / prerelease only |
|
|
|
|
| Hostname | Production DNS A | Notes |
|
|
|---|---|---|
|
|
| `reuse.coulomb.social` | `92.205.62.239` | Production reuse-surface hub |
|
|
| `hub.coulomb.social` | `92.205.62.239` | Target production inter-hub host; bootstrap may still point at CoulombCore until cutover |
|
|
|
|
The production Makefile targets default to:
|
|
|
|
```text
|
|
~/.kube/config-railiance01
|
|
```
|
|
|
|
It reaches the API through the `k3s-api-railiance01` ops-bridge tunnel on
|
|
`127.0.0.1:16444` (`bridge up k3s-api-railiance01` if it is down). The older
|
|
`~/.kube/config-hosteurope` names port `16443` and is retired.
|
|
|
|
Restore it from Railiance01 when missing:
|
|
|
|
```bash
|
|
ssh tegwick@92.205.62.239 'sudo cat /etc/rancher/k3s/k3s.yaml' \
|
|
| sed 's|127.0.0.1:6443|127.0.0.1:16444|' > ~/.kube/config-railiance01
|
|
chmod 600 ~/.kube/config-railiance01
|
|
export KUBECONFIG=~/.kube/config-railiance01
|
|
```
|
|
|
|
The app-specific targets also accept explicit overrides:
|
|
|
|
```bash
|
|
REUSE_KUBECONFIG=~/.kube/config-railiance01 make reuse-status
|
|
```
|
|
|
|
## SOPS Age Key Bootstrap
|
|
|
|
SOPS-encrypted values used by app release work expect an age identity at:
|
|
|
|
```text
|
|
~/.config/sops/age/keys.txt
|
|
```
|
|
|
|
Bootstrap procedure:
|
|
|
|
1. Receive the operator age identity through an out-of-band channel.
|
|
2. Create the directory with owner-only permissions:
|
|
```bash
|
|
mkdir -p ~/.config/sops/age
|
|
chmod 700 ~/.config/sops ~/.config/sops/age
|
|
```
|
|
3. Write the identity to `~/.config/sops/age/keys.txt`.
|
|
4. Restrict the file:
|
|
```bash
|
|
chmod 600 ~/.config/sops/age/keys.txt
|
|
```
|
|
5. Verify decryption against the encrypted file being changed:
|
|
```bash
|
|
SOPS_SENTINEL=<encrypted-file> make check-sops
|
|
```
|
|
|
|
Do not commit age identities, decrypted values, or copied SOPS plaintext
|
|
to this repo.
|
|
|
|
## Rotation
|
|
|
|
To rotate access, add the new recipient to the relevant SOPS files,
|
|
re-encrypt, verify with both old and new operators, then remove the old
|
|
recipient in a separate change. Keep at least one known-good recovery
|
|
operator key available during the transition.
|