Throwaway namespace, namespaced staging Issuer and a Certificate with a
distinct target name (cannot touch the live kc-tls object), operator runbook
with verify/cleanup/abort, and static guard tests. Source only; for
NK-WP-0049-T33 (decision 9f9d0d88 = A).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Follow rail-knative 76cb9c7 (RAIL-KNATIVE-WP-0003): overlays set 10m CPU
requests for the six substrate containers and add hpa-caps.patch.yaml
(maxReplicas activator 3, webhook 2, 3scale-kourier-gateway 3); verify.sh
checks both; tests/test_knative_render.py checks overlays, verify.sh, the
rail-knative declaration and the render. Not applied. Adds the receiving
task for wave-2 railiance-cluster allocation (CUST-WP-0071, RESOURCE-WP-0008).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
- bootstrap.yml: install with --write-kubeconfig-mode=600, stop fetching the
admin kubeconfig to the controller, enforce root:root 0600.
- ansible/k3s-kubeconfig-mode.yml: narrow existing-host playbook with pinned
unit hashes, drift refusal, backup, config.yaml + flag rewrite, restart,
readiness/mode verification and rollback. Never prints unit/kubeconfig content.
- workplans/RCLUSTER-WP-0019: owner workplan; attended apply is T03 (human gate).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
Verified against railiance01 on 2026-08-12 once API access was restored.
Corrections: two clusters are managed, not one - railiance01 is the current
primary running the live workloads, CoulombCore is the older frozen cluster.
Traefik is the ingress controller, not nginx. ArgoCD is not on railiance01 at
all; it runs on CoulombCore only, so the previous entry was accurate for that
host but misleading as a general cluster-level claim.
Adds the verified addon and CNPG cluster inventory, notes the absence of any
monitoring stack, and points at RAIL-HO-WP-0009 for the source-restricted k3s
API.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
