diff --git a/docs/evidence/2026-10-11-coulombcore-argocd-frozen.md b/docs/evidence/2026-10-11-coulombcore-argocd-frozen.md new file mode 100644 index 0000000..4fd4fdd --- /dev/null +++ b/docs/evidence/2026-10-11-coulombcore-argocd-frozen.md @@ -0,0 +1,20 @@ +# CoulombCore ArgoCD: frozen by expired k3s certificates — 2026-10-11 + +Task: RPF-WP-0044-T08. Collected read-only from the host by claude-code (ssh `coulombcore`, +`sudo -n`), without the Kubernetes API. + +- `/var/lib/rancher/k3s/server/tls/client-admin.crt` and `serving-kube-apiserver.crt`: + `notAfter=Aug 31 16:50:46 2026 GMT`. **Expired.** k3s has been active since 2026-05-24 15:24 UTC with + no restart, so no automatic rotation happened. This explains the "Unauthorized" seen on 2026-09-27 + and 2026-10-11 for every client, root's own kubeconfig included. +- Old ArgoCD (phase A install, undeclared) is still running as containers: application-controller, + applicationset-controller, repo-server, server, dex, redis. notifications-controller is on attempt 53. +- With an expired API server certificate, the old controller cannot reconcile or prune. The legacy + `argocd/applications/` tree is therefore not at risk from it while the certificates stay expired. + +## Disposition (founder, 2026-10-11) + +CoulombCore is not needed for anything. It will be retired and the machine reused. **Do not rotate +certificates or restart k3s on coulombcore.** That would revive the old controller with working +credentials. Retirement proceeds under NK-WP-0022-T08: inventory from the host, then stop and wipe. +RPF-WP-0044 treats the old controller as frozen and no longer waits on this check. diff --git a/workplans/RPF-WP-0036-platform-service-assurance.md b/workplans/RPF-WP-0036-platform-service-assurance.md index d5a4c57..a974ef3 100644 --- a/workplans/RPF-WP-0036-platform-service-assurance.md +++ b/workplans/RPF-WP-0036-platform-service-assurance.md @@ -62,15 +62,23 @@ and package dependency rather than a blanket new-cluster project here. ```task id: RPF-WP-0036-T03 -status: todo +status: wait decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e depends_on: [ACTIVITY-WP-0042] +needs_human: false +blocking_reason: "D2 accepts the activity-core scheduling role; ACTIVITY-WP-0042 must supply the implemented bounded scheduler and scoped custody/execution proof before recurring backup/restore work can execute. No new founder go-ahead is required." priority: high state_hub_task_id: "d64446fb-870b-5ae9-9628-f1fb9d06c5a4" ``` 2026-10-11: requalified after founder decision D2 (ArgoCD owns production) resolved — see the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md. +2026-10-11 dependency audit: D2 resolved the scheduling-role decision. The +remaining blocker is the existing ACTIVITY-WP-0042 owner implementation and +scoped runtime proof, not candidate promotion or a repeated human gate. Current +service-assurance source already classifies metadata signals and adapts pinned +recovery receipts; it explicitly reports recurring cadence/delivery as pending. + Inventory authoritative CNPG backup/PITR, OpenBao snapshot/isolated restore, encrypted off-host copy and custody-recovery receipts. Reuse existing validators and package status commands. Define cadence/expiry from T02; return distinct diff --git a/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md b/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md index 82b99fb..99b7360 100644 --- a/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md +++ b/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md @@ -332,15 +332,23 @@ OrphanedResourceWarning is non-blocking; other Application condition types fail ```task id: RPF-WP-0044-T06 -status: todo +status: wait decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e priority: medium +depends_on: [RPF-WP-0044-T04, RPF-WP-0044-T05] +needs_human: false +blocking_reason: "Ordered D2 adoption: issue-core T04 must provide automated Argo health/diff and private/authenticated smoke proof; target-revenue T05 is already proven. No further founder approval is required." state_hub_task_id: "4ca54868-c31f-5e3d-b7d3-a15b84c15f80" ``` 2026-10-11: requalified after founder decision D2 (ArgoCD owns production) resolved — see the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md. -**Waits on the founder's go-ahead.** Zero diff, but ESO serves every +**Authorized by D2; waits on predecessor automated proof, not another founder go.** +The draft already carries CRD prune/delete protection (verified preparation +2026-09-27; 39 objects, 20 protected CRDs, metadata-only diff). That historical +receipt is preparation, not current adoption proof. The deterministic +`scripts/eso_adoption_readiness.py` checks the draft and bound predecessor +receipts before a fresh native render/diff is considered. ESO serves every `ExternalSecret` on the cluster (25 ClusterSecretStores). Before the merge, add `crds.annotations: {argocd.argoproj.io/sync-options: "Prune=false,Delete=false"}` to the values and re-run the diff; pruning a CRD would delete every @@ -348,11 +356,12 @@ to the values and re-run the diff; pruning a CRD would delete every Watch for drift on `caBundle` fields injected by the cert-controller; if ArgoCD shows it, add `ignoreDifferences` before enabling self-heal. After adoption, retire the stale `pending-upgrade` Helm release record (its -`sh.helm.release.v1.external-secrets.v*` Secrets) under a separate go-ahead; +`sh.helm.release.v1.external-secrets.v*` Secrets) under a separate reviewed cleanup; ArgoCD does not track them. Live check: all ClusterSecretStores keep their current `Valid` state (two, `openbao-activity-core` and -`openbao-email-connect`, are already `ValidationFailed`). Workload restore: -`helm template` 0.16.1 with the same values, `kubectl apply --server-side`. +`openbao-email-connect`, are already `ValidationFailed`). Workload restore: revert the Platform Application to the previously reviewed +chart 0.16.1 values in Git, then manually sync through ArgoCD; never prune/delete +CRDs or silently replace the Helm release record as part of adoption. 2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here. @@ -382,14 +391,13 @@ railiance01 path is a live production change, and `RPF-WP-0043-T04` ```task id: RPF-WP-0044-T08 -status: wait -needs_human: true -decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e -blocking_reason: "Founder runs read-only: ssh coulombcore 'sudo k3s kubectl get applications -n argocd' (agent identity has no kube rights on coulombcore)." +status: done priority: low state_hub_task_id: "55d1382f-5862-5321-a1c9-96767764ba43" ``` +2026-10-11: done by host-side read-only check (docs/evidence/2026-10-11-coulombcore-argocd-frozen.md). k3s certificates expired 2026-08-31, so the old ArgoCD cannot reconcile or prune. Founder: coulombcore is retired and the machine reused; retirement moves to NK-WP-0022-T08. Do not rotate certs or restart k3s there. + 2026-10-11: requalified after founder decision D2 (ArgoCD owns production) resolved — see the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md. Planning only. Needs a read-only check of coulombcore's ArgoCD, outside this