docs: preserve reviewed NetKingdom session artifacts
This commit is contained in:
codex
parent
3ca8bb63a2
commit
5f86a2f1f9
50 changed files with 3251 additions and 0 deletions
|
|
@ -0,0 +1,95 @@
|
|||
---
|
||||
id: RCLUSTER-WP-0017
|
||||
type: workplan
|
||||
title: "Review NetKingdom signer runtime and node-local storage readiness"
|
||||
domain: financials
|
||||
repo: railiance-cluster
|
||||
status: proposed
|
||||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-10-16"
|
||||
updated: "2026-10-16"
|
||||
flavor: implementation
|
||||
related:
|
||||
- CUST-WP-0080
|
||||
- FLEX-WP-0024
|
||||
- RPF-WP-0035
|
||||
- RCLUSTER-WP-0014
|
||||
- RAIL-BS-WP-0014
|
||||
---
|
||||
|
||||
# RCLUSTER-WP-0017 — NetKingdom runtime/storage review
|
||||
|
||||
This proposed record is limited to railiance-cluster INTENT: verified healthy
|
||||
runtime, scheduling headroom, admission/storage constraints and node-local
|
||||
failure-domain facts for the retained flex-auth signer successor. It does not
|
||||
own the Access workload, chart, Helm values or release; Platform OpenBao/ESO or
|
||||
ArgoCD Applications; Enablement ArgoCD installation; Secrets public trust; or
|
||||
founder approval. It neither reopens completed capacity work nor duplicates
|
||||
Access implementation. Current single-node storage remains a single failure
|
||||
domain; ThreePhoenix/Longhorn is not a prerequisite or current capability.
|
||||
|
||||
Origin: CUST-WP-0080 request for independent runtime/storage review of
|
||||
CCR-2026-0050 and the Access signer rollout. Custodian-side read-only preparation
|
||||
is historical input, not a prior formal owner disposition. The conflated legacy
|
||||
cluster-gitops-owner role cannot be accepted by this repo; review the precise
|
||||
successor source role independently. Founder human approval and distinct owner
|
||||
reviews remain necessary before every live action.
|
||||
|
||||
## Review exact runtime and storage source boundary
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0017-T01
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Read exact successor source/CCR/rollout/custody revisions against this repo's
|
||||
INTENT; record a formal runtime/storage-only review under delegated-owner-review
|
||||
canon once this work record exists in the ownrepo checkout. Authenticate the
|
||||
actual Platform Applications and Access release responsibilities. Retain source
|
||||
hashes and current metadata evidence, and keep changes requested visible. A
|
||||
role rename alone does not supply native acceptance or another owner's assent.
|
||||
|
||||
Preparation evidence: Custodian
|
||||
`docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/`.
|
||||
Those observations are dated and must be refreshed at the actual native window.
|
||||
No formal review or native result is backfilled from this preparation.
|
||||
|
||||
## Review the bounded native preflight and storage action
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0017-T02
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Given actual exact successor owner dispositions and window, independently review
|
||||
cluster identity, node health/requested/observed headroom, quota/LimitRange,
|
||||
local-path behavior, admission-defaulted stopped projection and exclusion
|
||||
checks. Access owns workload stop/start and release rollback; Platform owns any
|
||||
Application writer freeze. Require exact caller/source/image/fence/expiry pins,
|
||||
Ready120seconds, recovery decision600seconds, founder abort ownership and
|
||||
explicit local-storage/outage/loss disposition. This task prepares review and
|
||||
records unresolved gates; it does not grant execute authority.
|
||||
|
||||
## Verify the approved runtime and storage result
|
||||
|
||||
```task
|
||||
id: RCLUSTER-WP-0017-T03
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Only after separately approved native action, verify the actual bound1Gi PVC
|
||||
UID, PV UID/name/claimRef/capacity/node affinity and exact Retain readback;
|
||||
refresh node health/headroom and non-overlap observations. Any runtime/storage
|
||||
mutation must have its own exact founder approval and scoped executor. The
|
||||
future bound PV cannot be selected or mutated in advance. Retain is not backup,
|
||||
node-loss protection or a filesystem quota. Preserve unknown outcomes and the
|
||||
original evidence; do not reset cursor/outbox, delete PVC/PV or remint custody.
|
||||
|
||||
If native action is not approved, keep this task open with its concrete
|
||||
unresolved gates. Do not imply rollout/custody/trust acceptance. Complete this
|
||||
workplan only after source review, bounded preflight disposition and actual
|
||||
approved runtime/storage result are evidenced, or explicit scope cancellation.
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
# Cluster runtime and storage review R1
|
||||
|
||||
Reviewer assignment: railiance-cluster only. Existing coordination work CUST-WP-0080-T03/T04; Access implementation FLEX-WP-0024-T06; Platform custody RPF-WP-0035-T12. No new workplan or work acceptance is created.
|
||||
|
||||
Disposition: informal runtime/storage preparation assessed with the conditions below. This is not a formal owner review under delegated-owner-review canon: no suitable open ownrepo work item exists yet. A proposed normal RCLUSTER-WP-0017 draft accompanies this preparation for coordinator review; it has not been written to railiance-cluster and supplies no current owner work reference. Native admission withheld. This is not a cluster/GitOps combined assent, a completed scope-bound approval, founder approval or permission to execute. The proposed signer successor remains separate from canonical local package d52f811/tree d4fbad7 and its frozen extraction2b/current05a baseline. Image84 ordinary CI402 success supports provenance only.
|
||||
|
||||
## Authority boundary
|
||||
|
||||
railiance-cluster INTENT says “Runtime, Not Workloads” and excludes shared stateful platform services and workload ownership. This role can assess node health, scheduling, baseline admission/storage and runtime constraints. It cannot own Access release values, producer/consumer behavior, OpenBao policy/role/ESO delivery, public trust or GitOps Application dispositions.
|
||||
|
||||
Per Custodian environment orientation §7, railiance-platform owns ArgoCD Applications; railiance-enablement owns ArgoCD installation. Access owns its workload/chart/release. Thus the current required `cluster-gitops-owner` slot in CCR0050 and native admission is too broad for this assignment. A reviewed successor may identify a `cluster-runtime-storage-owner` slot, with Platform separately and explicitly covering its actual Applications/freeze scope inside its existing disposition and Access covering its release/workload scope. Enablement is needed if install/controller configuration changes. Such a source/interface amendment needs exact independent review; neither this document nor a renamed string satisfies frozen R1/P2's combined requirement. Do not manufacture another owner's assent.
|
||||
|
||||
The identified Custodian Codex assignment remains supervised with no authority grant. Source preparation and authorized reads do not promote it. Founder approval must bind exact executed source/action, scope, outage/storage/cost/risk, expiry and rollback; prior implementation authorization does not establish custody approval.
|
||||
|
||||
## Current observations
|
||||
|
||||
Metadata-only workstation Kubernetes reads verified node92.205.62.239 and kube-system UIDa553c742-0115-43d4-99a4-a5ca56fe0786 at18:01:45UTC on16October2026. SSH read-only history/filesystem reads followed routing lookup; raw errors were suppressed. No Secret API object, raw Helm values, pod environment, credentials or logs were requested. Full selected observations are in runtime-observation.json and prechange-resources.json.
|
||||
|
||||
* Helm release flex-auth-secrets-engine in flex-auth: revision4 deployed, chartflex-auth-0.2.0/app0.1.0; revisions1–3 superseded. Revision4 is an observation, not an executable rollback authorization or complete allowlisted values capture.
|
||||
* Deployment UIDf83a5f5c-7dd7-4aac-bc02-d447e423e6ae, generation4/observed4, one desired/Ready/available pod, Helm ownership, RollingUpdate with25% surge/unavailable. Image is immutable05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd. Requests25m/32Mi; limits300m/192Mi.
|
||||
* Four owned ReplicaSets were selected by ownerReference UID; one has one replica, three zero. The one signer-SA pod is Running, not terminating. This is expressly not a stopped fence. No HPA exists in flex-auth at observation time.
|
||||
* No ResourceQuota, LimitRange or PVC exists in flex-auth. This establishes no namespace-enforced storage quota at that time; it is neither unlimited physical capacity nor an allocation approval. local-path UIDdb77292f-e67a-4032-95b4-a88d3321185b uses rancher.io/local-path, Delete, WaitForFirstConsumer.
|
||||
* Node healthy/Ready, pressure flags false. At18:02UTC: CPU requested3580m/4000m leaves420m requestable; memory requested9760Mi; usage2129m CPU/8933Mi memory. CPU limits37500m and memory limits34242Mi are overcommitted. Free bytes on the filesystem containing /var/lib/rancher/k3s/storage:125827354624. These snapshots must be refreshed at the actual window and do not reserve headroom.
|
||||
* Ten ArgoCD Applications were listed, none destination flex-auth and none status-resource referencing the signer Deployment. The informed-decision Application references two flex-auth NetworkPolicies, and shows OutOfSync. Listed Applications have no automated sync block. No direct signer Application adoption was observed; absence of status refs/labels does not prove no manual Helm, CI, hooks, external automation or future adoption writer exists. Platform must authenticate actual controller/writer scope; do not freeze or modify unrelated Applications on this evidence.
|
||||
|
||||
## Exact source review and needed successor
|
||||
|
||||
Reviewed the rollout-r1 activation/stopped/retained render and diff, manifest, projection and proposed exclusive window; native-adapter-r2 and native-packet-p2 documentation/pins; source CCR0050; target architecture/implementation and environment instructions. Input SHA256s are retained in review.json. This review remains tied to those bytes.
|
||||
|
||||
Rollout R1 proposes Recreate, single writer, immutable09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f image, seed directory read-only0440 UID/GID/fsGroup65532, unchanged25m/32Mi requests,64MiB process ceiling,1Gi RWO local-path PVC/Helmkeep. These are suitable source constraints for further native preparation. RWO and Recreate alone do not prove single-process exclusion. Source rendering is not admission defaulting, server dry-run, live diff or a held fence.
|
||||
|
||||
R1 chart rejects outbox replicaCount other than1; stopped YAML is derived after rendering. Installing activation values then scaling risks a signer starting before custody/trust and is unacceptable for the proposed order. A proposed Access successor allowing only numeric integer replicas0 or1 when outbox is enabled can make maintenance representable through the normal Helm path. Its exact implementation, numeric type handling and renders require independent review. Do not approve a future patch by assumption. Reject booleans, strings, fractional values, negative values and values greater than1; `int` coercion alone does not establish this. Require0/1 accepted render cases, invalid inputs refused, Recreate retained, and identical candidate pod-template projection across stopped/ready states. The reviewed actual native stopped projection must equal the selected source projection after admission/defaulting; any mismatch requires explicit reconciliation and review.
|
||||
|
||||
Changing chart/source, admission owner slots, window shape or source pins requires a successor rollout and completed successor scope/P2 pins. Keep frozen R1/P2 and counterexamples unchanged. CCR0050 is still proposed with bound_claims_confirmed=false and empty evidence/review comments; its data-read grants document-level access despite one projected private field. Read-lane, one-use custody writer, public admission and deployment/storage approvals remain distinct. Runtime review supplies none of those grants.
|
||||
|
||||
## Required exclusive window and minimum native preflight
|
||||
|
||||
1. Collect independently authenticated Access, Platform, Secrets, runtime/storage and founder dispositions for exact completed successor bytes. Resolve the actual GitOps/controller scope as above. Pin absolute start/end/expiry, exact approved source/image/projection/trust/CCR hashes, named executor, founder abort owner, Ready timeout120seconds and recovery-decision bound600seconds. Native cost/risk loss ceiling remains unapproved; preparation costs EUR0 incremental infrastructure.
|
||||
2. Reverify cluster/node/backend identity and exact Deployment UID/release revision/current allowlisted values. Refresh health, allocated and actual resource use, free storage, quota/limits and StorageClass metadata. Review exact client-side diff and server dry-run through a sanitizer which suppresses object/error dumps; never run these against unfiltered Secret manifests. Record admission mutations and resolve them before custody. Confirm immutable image pull/runtime availability without starting a signer.
|
||||
3. Access authenticates affected protected-consumer acceptance is stopped before template/custody changes. Access freezes manual Helm/CI/release actors; Platform authenticates and freezes any actual Application/GitOps writer under its authority, recording exact identity, prior state, no in-flight operation, expiry and restoration criteria. No broad ArgoCD shutdown is inferred. Check namespace workloads, jobs and autoscalers for any signer-SA/seed use or second signer; any unknown writer or unaccounted pod holds the fence closed.
|
||||
4. Through separately approved exact maintenance Helm path, install candidate template at replicas0. Observe Deployment generation caught up and zero desired/status replicas, all UID-owned ReplicaSets spec/status0, and no live or terminating UID-owned, signer-SA or seed-mount pods. Labels alone are insufficient. Hold the same exclusive window across custody/delivery/public admission; repeat exact native projection/fence immediately before CAS. Current running state fails this gate.
|
||||
5. Before PVC create, explicitly approve1Gi local-path request and storage risk. WaitForFirstConsumer requires the reviewed binding/start step with protected consumers still fenced. Capture actual PVC UID, PV name/UID, claimRef UID, capacity and node affinity; have the authorized runtime/storage executor set and verify this exact PV Retain before durable acceptance. Do not predict identifiers or patch arbitrary claim-selected PVs. Helmkeep does not protect manual deletion or undo Delete reclaim;1Gi request is not a hard filesystem quota, backup or off-node recovery guarantee.64MiB process enforcement still needs native proof.
|
||||
6. Platform owns separately approved read-lane/native binding, attended exact-source CAS0 ceremony, public receipt and delivery readback; Secrets independently admits public trust/verifier/caller. The child120second absolute bound, founder identity and five authenticated dispositions remain gates. No post-login extension, CAS retry/remint or private-key observation is permitted. Only after custody/trust/delivery gates and binding/Retain proof may the exact separately approved replica1 start proceed, with consumers still fenced until native signed ALLOW/DENY, caller negatives, durable restart/sequence/cursor and storage failure proofs pass.
|
||||
|
||||
## Abort and rollback retained
|
||||
|
||||
Founder aborts. Missing identity/owner approval, competing writer, insufficient headroom, quota/binding/Retain uncertainty, projection drift, surviving/terminating signer pod, child timeout, ambiguous CAS/readback/receipt fsync, Ready beyond120seconds or recovery decision beyond600seconds keeps acceptance fenced. Preserve original unknown receipt and logs/cursor/PVC; do not retry CAS0, remint, reset evidence or restore seed.
|
||||
|
||||
Access stops candidate and verifies every relevant pod gone and lock released. Preserve bound volume and originals. Helm revision4 is now a captured prechange candidate, but restoring it requires exact allowlisted image/config and outbox-format compatibility review; no rollback command is authorized here. Old05a unsigned availability cannot satisfy signed consumer. If format/exclusion is uncertain, remain unavailable. Restore each competing controller only when its recorded owner restoration criteria are met. Compromise requires public trust withdrawal and separately approved forward-only successor, never old-seed restoration. No uninstall, PVC/PV deletion or policy/trust weakening.
|
||||
|
||||
No native mutation, stop, PVC creation, controller freeze, policy/grant change, credential access, founder disposition or other-owner approval occurred in this review.
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"posted": true,
|
||||
"id": "5500bf8c-1a99-4c54-9293-a3028c1ec42d",
|
||||
"workplan_id": "f383557d-c8a8-553e-adcd-9f82ff9c2929",
|
||||
"task_id": "6ee408cd-c055-532d-bc80-f64c9bdf143b",
|
||||
"summary": "RCLUSTER-WP-0017-T01 fresh own-checkout formal source reviews approve only exact PlatformR5 owner-boundary manifest78003b1b and Access rolloutR2 manifest5be7a7f4 runtime/storage preparation. Independent exact archive Helm renders/projection checks pass; WFFC no-wait maintenance and conditional stopped-revision rollback captured. Cumulative ownrepo evidence/AGENTS-prefix patch prepared for coordinator; canonical untouched, task source scope still awaits successor custody packet. No native/CCR/founder/other-owner assent."
|
||||
}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
"commit": "2c98c637950164779d89a0b4eda194cbfd82b283",
|
||||
"repo": "railiance-cluster",
|
||||
"files_sha256": {
|
||||
"AGENTS.md": "sha256:5cc7808a6d0e5cdebc7b3f13a0d7dce9cee5441ed6de4703b67cf3fe1800d45b",
|
||||
"workplans/RCLUSTER-WP-0017-netkingdom-signer-runtime-storage-review.md": "sha256:bd925a81a111f79022a1d510edf5395ca90e45c78c32b237195e50d65a4494ee"
|
||||
},
|
||||
"patch_sha256": "sha256:e9f9ab901512af08d502b20f2ad996295d59e426edbbfae4284c76602bd14681",
|
||||
"observed_at": "2026-10-16T18:37:53.804219+00:00",
|
||||
"source_review_completed": true,
|
||||
"native_preflight_accepted": false,
|
||||
"native_action": false,
|
||||
"published": true,
|
||||
"normal_sync": {
|
||||
"session_id": 92747,
|
||||
"exit_code": 0,
|
||||
"bindings": "22/22",
|
||||
"assessment_fail": 0,
|
||||
"automation_error": 0,
|
||||
"warn": 44,
|
||||
"info": 8,
|
||||
"generated_only_commit_refused": true
|
||||
},
|
||||
"committed_hashes_verified": true
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"checked_at": "2026-10-16T18:30:14.773749+00:00",
|
||||
"source": "installed helm upgrade --help",
|
||||
"relevant_lines": [
|
||||
"--atomic if set, upgrade process rolls back changes made in case of failed upgrade. The --wait flag will be set automatically if --atomic is used",
|
||||
"--cleanup-on-fail allow deletion of new resources created in this upgrade when upgrade fails",
|
||||
"--force force resource updates through a replacement strategy",
|
||||
"--no-hooks disable pre/post upgrade hooks",
|
||||
"--reset-then-reuse-values when upgrading, reset the values to the ones built into the chart, apply the last release's values and merge in any overrides from the command line via --set and -f. If '--reset-values' or '--reuse-values' is specified, this is ignored",
|
||||
"--reset-values when upgrading, reset the values to the ones built into the chart",
|
||||
"--reuse-values when upgrading, reuse the last release's values and merge in any overrides from the command line via --set and -f. If '--reset-values' is specified, this is ignored",
|
||||
"--wait if set, will wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet are in a ready state before marking the release as successful. It will wait for as long as --timeout",
|
||||
"--wait-for-jobs if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. It will wait for as long as --timeout"
|
||||
],
|
||||
"inference": "A WaitForFirstConsumer claim can remain Pending at replicas0. --wait can time out; --atomic implies --wait and may rollback a maintenance upgrade to the running predecessor, violating the desired fence. Stopped maintenance must have reviewed non-atomic no-wait and no-hooks/reset-values semantics, with explicit failclosed manual recovery; success is not native fence proof.",
|
||||
"native_execution": false
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue