diff --git a/clientdocs/sweep-receipt.txt b/clientdocs/sweep-receipt.txt index 2016d22..08b49ab 100644 --- a/clientdocs/sweep-receipt.txt +++ b/clientdocs/sweep-receipt.txt @@ -23,11 +23,11 @@ 3dd17ab9e95d99bea0c9f36a2662e77d25ea9d691f8c60d1d314f237c7c3f655 clientdocs/scripts/smoke-test.sh 7667bb1d2ff1e315f8ecaa2b4f680d04978a79ceeeb8cc3f5e16de2b295b2205 clientdocs/scripts/tenancy-audit.sh 783eb0a2c0cff3b6b7906364cc67b5b62c9bfe3ded3f54994bbb0f437464cb46 clientdocs/self-service-guide.md -3ee4cfd5e83b4179ff736dc14d1dc8fd51f6701d6c1b894033febce7aa2bb7f2 clientdocs/tenant-skill/SKILL.md +840ce47dbff4987121ced9d16fc606fe5240b4820b367a0c44f4e838811197e6 clientdocs/tenant-skill/SKILL.md c7708c35d1d5fceab763268f6a10ed214e23e9458018b115cb944b6a3168f182 clientdocs/tenant-skill/references/ci-automation.md 42c8dc4f451befdba2fb8f75e9023255ae65698f81af7b7273c0b5a1291ec555 clientdocs/tenant-skill/references/day2-operations.md -8dfbbb8c053c32c7a63ed58910366f4262fb1d0ac2935defc9c507233b1d96b0 clientdocs/tenant-skill/references/kubernetes.md -b844e00610df813275779320a13ecc131525a89b052bd5c8ab522d7666eb4fad clientdocs/tenant-skill/references/troubleshooting.md +92bb1c715b5e5220b38ff749d2479eee460b36194ca2e431227591bacf3d6b1a clientdocs/tenant-skill/references/kubernetes.md +e129181d12c9f778b85fe20c22f24fe05a5c1a2b8a3eba275f60292342c99d8f clientdocs/tenant-skill/references/troubleshooting.md 3e13aaf7987c952c0970ce1126d7de93514165bf027b46a01925a34a2963f2e1 clientdocs/welcome.md e00900e6d08d19c195edee6cab5d8198295a35371cd6333a50ca5ad28940b129 docs/tenant-onboarding-contract.md 64f99b638a1855b02180e907c9535db8bddc5847a502759a9e0d63c513b63077 policies/domain-manager-policy.yaml diff --git a/clientdocs/tenant-skill/SKILL.md b/clientdocs/tenant-skill/SKILL.md index 6df5761..993846b 100644 --- a/clientdocs/tenant-skill/SKILL.md +++ b/clientdocs/tenant-skill/SKILL.md @@ -140,6 +140,11 @@ | Read-only audit, CI smoke test, leftover sweep | the delivered starter scripts (see "Starter scripts" below) | | Quota raise, password reset, custodian change, shared substrate | not self-service -- an authorized requester contacts {{ACCOUNT_CONTACT}} | +For a full Jenkins-to-Kubernetes pipeline (cluster create through deploying an +app), the delivered Jenkins + Kubernetes Implementation Guide is the single +end-to-end workflow; `references/kubernetes.md` carries the cluster-side command +detail it builds on. + ## Starter scripts (delivered with your document pack) Your document pack includes a `scripts/` directory of helpers; run @@ -194,9 +199,18 @@ ## Companion documents -The Welcome letter, Self-Service Guide, Handover Pack, Acceptance -Checklist, and CI/Automation Integration Guide delivered at handover -are the authoritative long-form references; this skill is the -operating layer over them. If this skill and a delivered document -disagree, the delivered document wins -- flag the divergence to -{{ACCOUNT_CONTACT}}. +The documents delivered at handover are the authoritative long-form +references; this skill is the operating layer over them: + +- Welcome letter -- orientation and the reading order. +- Self-Service Guide -- running the tenancy day to day. +- Handover Pack -- your identifiers, accounts, endpoints, platform + rules, and (at its end) the Glossary of every term used across the + pack. +- CI/Automation Integration Guide -- connecting pipelines to the cloud. +- Jenkins + Kubernetes Implementation Guide -- the single end-to-end + workflow for standing up a cluster and deploying to it from Jenkins. +- Acceptance Checklist -- the checks that prove the tenancy works. + +If this skill and a delivered document disagree, the delivered document +wins -- flag the divergence to {{ACCOUNT_CONTACT}}. diff --git a/clientdocs/tenant-skill/references/kubernetes.md b/clientdocs/tenant-skill/references/kubernetes.md index 1de8b34..9954298 100644 --- a/clientdocs/tenant-skill/references/kubernetes.md +++ b/clientdocs/tenant-skill/references/kubernetes.md @@ -46,8 +46,13 @@ If that template is missing, or you need a variant, create your own -- see "Creating your own cluster template" below. -Create (node counts are limited by your quota; builds take TENS OF -MINUTES -- poll slowly or just wait): +Create (builds take TENS OF MINUTES -- poll slowly or just wait). Size +`` against TWO limits, not one: your quota, AND the physical capacity +free on the platform right now. A request inside your quota can still fail +to place a node -- the symptom is a node stuck in ERROR with "No valid +host was found. There are not enough hosts available", which is NOT a +quota problem. Start small (1 control + 1-2 workers), confirm it comes up, +then scale the worker count: openstack coe cluster create \ --cluster-template {{TENANT_SHORT_NAME}}-k8s \ @@ -127,6 +132,11 @@ ## Clusters and CI (the recommended split) +For the full worked pipeline (kubeconfig as a Jenkins credential, a deploy +stage, and using the cluster as a build-agent pool), the delivered Jenkins + +Kubernetes Implementation Guide is the single end-to-end reference. The split +below is the principle it follows. + - Create long-lived clusters manually (or on a controlled schedule) as `-cluster`, OUTSIDE CI. - Pipelines then deploy INTO the cluster using its kubeconfig, stored diff --git a/clientdocs/tenant-skill/references/troubleshooting.md b/clientdocs/tenant-skill/references/troubleshooting.md index b10a2b7..05dec85 100644 --- a/clientdocs/tenant-skill/references/troubleshooting.md +++ b/clientdocs/tenant-skill/references/troubleshooting.md @@ -66,6 +66,18 @@ `references/kubernetes.md`. - Cluster create fails instantly with the `-svc` credential: boundary (table above), not an outage. +- Cluster TEMPLATE create fails; dashboard shows only "Error: Unable to + create cluster template": the Public or Hidden flag is set. Publishing + a template cloud-wide is operator-only; leave both unchecked (templates + are already usable across your project). See `references/kubernetes.md`. +- Cluster stuck in CREATE_IN_PROGRESS far past the normal build time and + never completing: almost always the network driver. Rebuild the + template with calico; flannel does not converge on this platform. +- Cluster create fails with a node in ERROR, "No valid host was found. + There are not enough hosts available": the request is too big for the + free capacity right now, even if it is within quota -- NOT a quota + problem, and a quota raise will not help. Use a smaller node count or a + smaller flavor; start small (1 control + 1-2 workers) and scale up. - Subnet create rejected for overlap: pick a range that does not collide with `{{TENANT_SHORT_NAME}}-subnet` or your other networks. - Network delete refused: it still has ports -- delete the servers diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 0b29b22..62c19fa 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -31,8 +31,8 @@ - **OPEN security rows:** SEC-001 (rotate at v1 close, re-ruled 2026-07-06), SEC-003 (custodians + second-person unseal -- DEFERRED; keeps d011-06 MANUAL), SEC-004 (flip repo to private at v1 close -- deferral reaffirmed). -- **Next-free numbers:** D = 076, DOCFIX = 129, BUNDLEFIX = 012. - (Seeded from the 2026-07-08 scan, post-addendum-46.) +- **Next-free numbers:** D = 076, DOCFIX = 130, BUNDLEFIX = 012. + (Seeded from the 2026-07-08 scan, post-addendum-47.) --- @@ -319,6 +319,12 @@ - **OPERATOR RULINGS (on return, 2026-07-08 PM) + status:** 1. devteam cluster: DELETE + DELIVER TEMPLATE ruled. DONE (addendum 42): TestCluster2 confirmed gone + devteam-k8s calico template delivered. + 2b. Handover package RE-consolidation (operator re-ruling, addenda 46-47): + glossary folded into handover-pack + glossary.md removed + account-table + hard de-dup (DOCFIX-128); tenant AI skill aligned to the consolidated + package -- 3 missing failure signatures added, capacity caveat, Jenkins- + guide integration (DOCFIX-129). Top-level docs 9->8. Package re-instantiated + (glossary appendix in handover-pack, skill refreshed). DONE. 2. Consolidation review M1-M7: ALL APPROVED. DONE (addendum 43, DOCFIX-124): M5 error-holes in self-service-guide; M3 entry point + goal-map in welcome; M1/M2 single-source-of-truth + pointers (softer than hard-delete -- flagged, diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md index 93a635f..eb301e9 100644 --- a/docs/v1-redeploy-changelog.md +++ b/docs/v1-redeploy-changelog.md @@ -3157,4 +3157,40 @@ - Numbers consumed: DOCFIX-128. REVERT: git checkout HEAD~ -- clientdocs tests/clientdocs-skill/run-tests.sh docs/v1-redeploy-changelog.md docs/session-ledger.md; git checkout HEAD~ -- clientdocs/glossary.md (restore deleted file); then bash scripts/repo-lint.sh --record-clientdocs-sweep. -Next-free after this push (per scan, keep this line unwrapped): D-076, DOCFIX-129, BUNDLEFIX-012. +### 2026-07-08 (addendum 47, jumphost stream) -- DOCFIX-129: tenant AI skill aligned to the consolidated handover package (phase 2) + +Operator: "once the files are complete you can rewrite the skill based on the +current handover package." Assessment on reading the skill: SKILL.md + the four +references were already well-structured and consistent with the consolidated +docs (the account model is an operating summary that defers to the Handover Pack +as authoritative; the boundary model, auth, and discipline all match). A +from-scratch regeneration would have risked regressing that polished content +(DOCFIX-109) for no gain, so this is a thorough ALIGNMENT/REFRESH that closes the +real gaps -- the skill predated tonight's consolidation and was missing the exact +error signatures the consolidation was about. (If a deeper regeneration is +wanted, it is a follow-up.) + +- **references/troubleshooting.md -- three failure signatures added** to the + "known signatures" list (these were the error-holes the consolidation + targeted, and the AI skill lacked them): cluster TEMPLATE create fails / + "Unable to create cluster template" = Public/Hidden flag; cluster stuck + CREATE_IN_PROGRESS = flannel (rebuild with calico); "No valid host was found" + = capacity, not quota, size down. +- **references/kubernetes.md** -- cluster-create section now carries the + right-size-to-capacity (NoValidHost) caveat (was quota-only); the "Clusters + and CI" section points to the delivered Jenkins + Kubernetes Implementation + Guide as the single end-to-end pipeline reference. +- **SKILL.md** -- Companion Documents rewritten to list all delivered docs + including the Jenkins + Kubernetes Implementation Guide and to note the + Glossary now lives at the end of the Handover Pack; routing gains a pointer to + the Jenkins guide for the full Jenkins-to-Kubernetes workflow. +- Skill harness 8/8 (T4 placeholder set, T5 routing reachability, leakage, ASCII + all still hold); gauntlet 38/38; L7 receipt 30 files. +- **Package re-instantiated (~/devteam-package):** glossary.md removed; the + Glossary appendix folded into the package handover-pack.md (devteam- + substituted, client-specific values preserved); all skill/reference files + refreshed; zero unfilled tokens except the flagged {{CUSTODIAN_1/2}}. +- Numbers consumed: DOCFIX-129. +REVERT: git checkout HEAD~ -- clientdocs/tenant-skill clientdocs/sweep-receipt.txt docs/v1-redeploy-changelog.md docs/session-ledger.md; then bash scripts/repo-lint.sh --record-clientdocs-sweep; re-run the instantiation helper to rebuild the package. + +Next-free after this push (per scan, keep this line unwrapped): D-076, DOCFIX-130, BUNDLEFIX-012.