tegwick
1a6784d5ac
RCLK-WP-0005-T01: systemd-timesyncd only, UTC, Ubuntu NTP defaults. Canonical owner is railiance-infra; railiance-hosts is superseded. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
157 lines
6.9 KiB
Markdown
157 lines
6.9 KiB
Markdown
---
|
|
id: RCLK-WP-0005
|
|
type: workplan
|
|
title: "Deploy clock infrastructure through owner-managed infrastructure as code"
|
|
domain: infotech
|
|
repo: railiance-clock
|
|
status: active
|
|
owner: codex
|
|
topic_slug: custodian
|
|
created: "2026-09-14"
|
|
updated: "2026-09-14"
|
|
related_workplans:
|
|
- RCLK-WP-0002
|
|
- RCLK-WP-0003
|
|
- RCLK-WP-0004
|
|
state_hub_workstream_id: "5af117db-3721-509a-a3a6-36ae6bab7af3"
|
|
---
|
|
|
|
Operator-requested infrastructure plan. Read docs/infrastructure.md. This plan
|
|
tracks the cross-owner delivery outcome; each owning repository holds its actual
|
|
IaC and any required child work records. Inventory and ownership work can begin
|
|
now. Live service deployment depends on the reviewed protocol and built artifact.
|
|
Production applies require concrete owner admission, not just this plan's existence.
|
|
|
|
## Confirm current host state and canonical IaC ownership
|
|
|
|
```task
|
|
id: RCLK-WP-0005-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "883743c4-d368-5f94-878b-0e122eab39ee"
|
|
```
|
|
|
|
Inspect railiance01 time sources/daemon, synchronization health, virtualization,
|
|
network egress, permissions and existing IaC without fetching secrets or changing
|
|
time. Resolve railiance-infra versus inherited railiance-hosts implementation
|
|
ownership with railiance-master; select one canonical baseline and reference it.
|
|
Record target inventory, responsibility, current drift and gaps. Create/link owner
|
|
work records before handing off any execution; no duplicate configuration trees.
|
|
|
|
Acceptance: reviewed source-path/owner matrix, live read-only inventory receipt,
|
|
explicit adoption of existing settings or a bounded source diff; no second daemon.
|
|
|
|
**Done 2026-09-14.** Receipt:
|
|
`docs/evidence/2026-09-14-host-time-inventory.md`. Live: UTC,
|
|
systemd-timesyncd only, synchronized to `ntp.ubuntu.com`, stock config.
|
|
Canonical S1 owner is **railiance-infra**; railiance-hosts is superseded.
|
|
Adopt the existing daemon; do not add chrony. Residual `RAIL-HO-WP-0013`
|
|
declares it in IaC after RCLK-WP-0002.
|
|
|
|
## Implement declarative host UTC discipline and verification
|
|
|
|
```task
|
|
id: RCLK-WP-0005-T02
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "f3eea5a7-e745-57a2-9d76-b78eeba0bf06"
|
|
```
|
|
|
|
Depends on T01 and RCLK-WP-0002's UTC/leap/quality contract. In the S1 owner,
|
|
version the selected existing/supported NTP client, independent upstream selection,
|
|
network requirements, boot/restart behavior, holdover limits, drift monitoring and
|
|
health export. Prefer existing supported automation over inventing a new daemon.
|
|
Do not mix timesyncd/chrony or smeared/unsmeared sources. Restrict listeners; a
|
|
server NTP offering is optional and separately justified, not an implicit public
|
|
UDP/123 endpoint. Do not modify attached corporate workstation clock policy.
|
|
|
|
Acceptance: lint/render and convergence check; idempotent second apply; reboot
|
|
and upstream-loss/recovery proof in disposable infrastructure; exact target diff,
|
|
rollback procedure and owner review before live convergence. Service liveness
|
|
alone does not prove bounded UTC accuracy.
|
|
|
|
## Package private authority service and admitted trust delivery
|
|
|
|
```task
|
|
id: RCLK-WP-0005-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "bc07711b-96d1-5d72-aee1-21d39942564c"
|
|
```
|
|
|
|
Depends on adopted RCLK-WP-0002 trust contract and RCLK-WP-0003 artifact. Use
|
|
rail-kubernetes on reef-railiance as the initial packaging candidate; create the
|
|
reviewed rapp/deployable declarations under the architecture owner's conventions.
|
|
A documented host-service alternative is allowed only if bootstrap dependencies
|
|
or measured constraints justify it. The clock app reads host time/health but must
|
|
not obtain CAP_SYS_TIME, privileged host access or a host clock-write interface.
|
|
|
|
Declare immutable image/build pins, namespace/service identity, private exposure,
|
|
network policy, resource requests/limits, health versus usability probes, TLS and
|
|
sample-signing key delivery/rotation via admitted owners, non-secret config,
|
|
monitoring and state-retention/epoch behavior. No secret values in Git, no raw
|
|
kubectl patches or console-created persistent resources as the desired state.
|
|
|
|
Acceptance: IaC rendered/validated by native tools, deployment admission and
|
|
trust bootstrap reviewed, least-privilege and no-redirect tests, config/source
|
|
hashes and exact deployment/rollback plan. Fail if dynamic trust resolution needs
|
|
usable Railiance time before the first sample with no independent bootstrap path.
|
|
|
|
## Integrate the clock prerequisite into the new-estate bootstrap path
|
|
|
|
```task
|
|
id: RCLK-WP-0005-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "584440e4-49ce-57f4-b6f1-953c0feec710"
|
|
```
|
|
|
|
Coordinate with railiance-bootstrap after T01 establishes owners. Add ordering:
|
|
S1 obtains usable external UTC and basic transport trust; S2/S3 bring up the
|
|
required substrate and admitted custody; the authority service is deployed;
|
|
protected consumers start only after usable time/identity evidence. Bootstrap
|
|
invokes pinned owner automation and verifies its receipts; it does not copy host
|
|
roles or retain ongoing clock operation. The external UTC prerequisite must not
|
|
require the not-yet-created Forgejo, OpenBao, cluster or clock endpoint.
|
|
|
|
Acceptance: fresh-estate rehearsal, existing-estate upgrade path, explicit manual
|
|
bootstrap actions and retirement, failed-time gate, versioned handoff to steady
|
|
state owners. No unsupported claim that corporate workstations can be converged.
|
|
|
|
## Deploy on railiance01 and prove drift, recovery and rollback
|
|
|
|
```task
|
|
id: RCLK-WP-0005-T05
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "1b9fa2cb-77c5-5519-a4d3-184cb8597f86"
|
|
```
|
|
|
|
Depends on T02/T03 readiness and specific live owner authorization. Apply the
|
|
reviewed source revision through its normal owner pipeline. Keep clock steps
|
|
and effects on existing token consumers within the reviewed rollout window.
|
|
Read back daemon configuration, image digest, service/identity/network state and
|
|
usable UTC interval. Verify an independently managed workstation obtains a sample
|
|
without changing OS clocks. Exercise upstream outage, restart, revoked signing
|
|
trust and rollback through safe rehearsals and the approved native scope.
|
|
|
|
Acceptance: exact-commit render/apply/readback receipts; repeated convergence is
|
|
no-op; drift detection catches a disposable config change; rebuild from committed
|
|
source succeeds; rollback restores known-good configuration without falsely
|
|
restoring old epochs/trust. No unnoticed unrelated resource or credential changes.
|
|
|
|
## Transfer operational responsibility and gate consumer adoption
|
|
|
|
```task
|
|
id: RCLK-WP-0005-T06
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "c2edb898-7446-5e82-8d2a-9f3f45f41b00"
|
|
```
|
|
|
|
Deliver alert ownership, quality/error budgets, backup/recovery and key-rotation
|
|
runbooks, source locations, pipeline/placement identifiers and native evidence to
|
|
railiance-telemetry/platform and RCLK-WP-0004. Document what remains single-host.
|
|
Keep all unresolved work as live records before finishing this plan. RCLK-WP-0004
|
|
may adopt a protected consumer only after this infrastructure gate AND its own
|
|
explicit consumer review/negative tests pass. A deployed endpoint is not a grant.
|