diff --git a/clientdocs/sweep-receipt.txt b/clientdocs/sweep-receipt.txt index 7273d25..28dfe5e 100644 --- a/clientdocs/sweep-receipt.txt +++ b/clientdocs/sweep-receipt.txt @@ -26,8 +26,8 @@ 840ce47dbff4987121ced9d16fc606fe5240b4820b367a0c44f4e838811197e6 clientdocs/tenant-skill/SKILL.md c7708c35d1d5fceab763268f6a10ed214e23e9458018b115cb944b6a3168f182 clientdocs/tenant-skill/references/ci-automation.md 42c8dc4f451befdba2fb8f75e9023255ae65698f81af7b7273c0b5a1291ec555 clientdocs/tenant-skill/references/day2-operations.md -7a253a17f7499c614ccf6ab23d94c940b7c1b37c7e48b7c9960c3bb53a390674 clientdocs/tenant-skill/references/kubernetes.md -e3de5c8af90464c62fc9e754116f8962021788b1d285a7dc717e620445e6ca8a clientdocs/tenant-skill/references/troubleshooting.md +abf6fb444bd71ed6131d1849e0ab44a61749d7258d21e0145a78af47e552c060 clientdocs/tenant-skill/references/kubernetes.md +aaec858ab9da3cca8364c914170f8c3d1d80bd0f9555ea4623091c781fd27999 clientdocs/tenant-skill/references/troubleshooting.md 3e13aaf7987c952c0970ce1126d7de93514165bf027b46a01925a34a2963f2e1 clientdocs/welcome.md e00900e6d08d19c195edee6cab5d8198295a35371cd6333a50ca5ad28940b129 docs/tenant-onboarding-contract.md 64f99b638a1855b02180e907c9535db8bddc5847a502759a9e0d63c513b63077 policies/domain-manager-policy.yaml diff --git a/clientdocs/tenant-skill/references/kubernetes.md b/clientdocs/tenant-skill/references/kubernetes.md index 74b480b..829e1f3 100644 --- a/clientdocs/tenant-skill/references/kubernetes.md +++ b/clientdocs/tenant-skill/references/kubernetes.md @@ -69,6 +69,24 @@ export KUBECONFIG=/config kubectl get nodes +The kubeconfig's client certificate is TIME-LIMITED. If kubectl or a +pipeline that worked before starts failing to authenticate, the cert has +expired -- re-fetch with the same command and update the stored +credential. Read the expiry with: + + kubectl config view --raw \ + -o jsonpath='{.users[0].user.client-certificate-data}' \ + | base64 -d | openssl x509 -noout -enddate + +Cluster create, resize, and delete can be done in the dashboard OR on the +command line; everything from the kubeconfig onward (kubectl, CI) is +command-line ONLY -- the dashboard cannot drive kubectl. + +Resize (add or remove workers after the cluster is up -- same account, +same free-capacity limit as create): + + openstack coe cluster resize + Delete (confirm with the human first, by name): openstack coe cluster delete @@ -153,6 +171,20 @@ from YOUR quota -- prefer a single ingress controller of type LoadBalancer fronting many Services over one LoadBalancer per app. +A LoadBalancer Service (or an ingress) gets an IP, not a hostname: the +platform provides no DNS. Map your own hostnames to that IP in whatever +DNS you run. Ingress how-to: the Jenkins + Kubernetes Guide, section 5.4. + +## Persistent storage + +Stateless workloads need nothing extra. A stateful one (a database, a +cache with persistence) needs a PersistentVolume, which comes from a +StorageClass -- check with `kubectl get storageclass`. If a class is +marked `(default)`, a PersistentVolumeClaim binds to it automatically; +if NONE is listed, the cluster has no persistent-volume support and a +PVC stays Pending -- raise it with {{ACCOUNT_CONTACT}}. Never work around +it by writing to node-local disk (lost when a pod moves nodes). + ## Clusters and CI (the recommended split) For the full worked pipeline (kubeconfig as a Jenkins credential, a deploy @@ -168,6 +200,9 @@ clusters. If your workflow genuinely needs cluster-per-run, raise it with {{ACCOUNT_CONTACT}} first -- there are capacity and quota implications. +- For day-to-day build agents, a scoped Kubernetes ServiceAccount token + (namespace-limited) is better practice than handing CI the full-admin + kubeconfig. The Jenkins + Kubernetes Guide (section 6.1) has the steps. Day-2 cloud work around the cluster (networks, floating IPs, volumes, extra load balancers) still runs as `-svc` per diff --git a/clientdocs/tenant-skill/references/troubleshooting.md b/clientdocs/tenant-skill/references/troubleshooting.md index c86f0c2..372cc6f 100644 --- a/clientdocs/tenant-skill/references/troubleshooting.md +++ b/clientdocs/tenant-skill/references/troubleshooting.md @@ -83,6 +83,14 @@ registry, create an image-pull secret and reference it from the Deployment (Kubernetes reference, "Images: bring your own registry"). The platform hosts no registry -- push to one you control. +- A PersistentVolumeClaim stuck `Pending`: nothing bound it. Run + `kubectl get storageclass`; if none is listed the cluster has no + persistent-volume support -- raise it with {{ACCOUNT_CONTACT}}. +- `kubectl` suddenly reports "Unable to connect" or a certificate error + on a cluster that worked before: the kubeconfig's client certificate is + time-limited and has expired. Re-fetch it (`openstack coe cluster + config`), update the stored CI credential, and keep pointing at the + delivered CA. - Subnet create rejected for overlap: pick a range that does not collide with `{{TENANT_SHORT_NAME}}-subnet` or your other networks. - Network delete refused: it still has ports -- delete the servers diff --git a/docs/session-ledger.md b/docs/session-ledger.md index f7720ff..8480307 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -463,6 +463,15 @@ references/troubleshooting.md; skill harness 8/8, gauntlet 39/39; package skill files re-instantiated. Committed + pushed. (Skill-lag class; watch for it on future guide changes.) +- **DONE -- DOCFIX-136 (addendum 52): tenant AI skill FULL SWEEP vs DOCFIX-130.** + Operator asked for a full sweep after the registry gap. Grep-audit found 6 more + guide topics absent; all added concise (pointer to guide for detail): resize + command, kubeconfig cert-expiry (+openssl read), dashboard-vs-CLI split, no-DNS, + NEW Persistent storage section, ServiceAccount pointer; + PVC-Pending and + cert-expired troubleshooting signatures. Skill now covers the full DOCFIX-130 set + (ingress stays recommendation+pointer by design). Harness 8/8, gauntlet 39/39, + package re-instantiated. Committed + pushed. STANDING LESSON: guide changes must + sweep the skill in the same change -- skill-lag caught twice (DOCFIX-135/136). - **S-CLASS BATCH STATUS:** DONE = S7, S4, S8a (DOCFIX-132/133/134). HELD/DEFERRED = S8b, S8c, and S1/S2/S3/S5 (lib-validate adoption -- until DOCFIX-126/127 live-verify). S6 was ruled no-action earlier. Next operator decision: S8b/S8c diff --git a/docs/v1-redeploy-changelog.md b/docs/v1-redeploy-changelog.md index 3eace91..1a91124 100644 --- a/docs/v1-redeploy-changelog.md +++ b/docs/v1-redeploy-changelog.md @@ -3357,4 +3357,34 @@ - Numbers consumed: DOCFIX-135. REVERT: git checkout HEAD~ -- clientdocs/tenant-skill/references/kubernetes.md clientdocs/tenant-skill/references/troubleshooting.md clientdocs/sweep-receipt.txt docs/v1-redeploy-changelog.md docs/session-ledger.md; then bash scripts/repo-lint.sh --record-clientdocs-sweep; re-instantiate the package skill files. -Next-free after this push (per scan, keep this line unwrapped): D-076, DOCFIX-136, BUNDLEFIX-012. +### 2026-07-08 (addendum 52, jumphost stream) -- DOCFIX-136: tenant AI skill full sweep, close remaining DOCFIX-130 skill-lag (6 topics) + +Operator-requested full sweep of the skill against the DOCFIX-130 guide (after the +registry gap, DOCFIX-135). Grep-audit found 6 guide topics absent from the skill; +all added concise (skill stays terse; full detail defers to the guide by pointer). +Additive, leak-clean, no new token. +- references/kubernetes.md: + - Cluster resize command (`openstack coe cluster resize`) -- was prose "scale the + worker count" with no command. + - kubeconfig client-cert expiry: time-limited; re-fetch; openssl one-liner to read + the expiry (skill previously covered only app-cred expiry). + - dashboard-vs-CLI split: create/resize/delete either way, kubeconfig onward is + CLI-only (the dashboard cannot drive kubectl) -- for GUI-first tenants. + - no platform DNS: LoadBalancer/ingress give an IP not a hostname; pointer to the + guide section 5.4 ingress how-to. + - NEW "Persistent storage" section: kubectl get storageclass; (default) binds, + none = no PV support / PVC stays Pending -> contact. + - ServiceAccount pointer: scoped SA token > full-admin kubeconfig for build agents + (guide section 6.1). +- references/troubleshooting.md: two new signatures -- PVC Pending (no StorageClass) + and kubeconfig cert-expired ("worked before, now a cert error"). +- Skill harness 8/8 (T3 leak, T4 placeholder set unchanged, T6 ASCII); gauntlet + 39/39; repo-lint 0 fail; L7 receipt re-recorded. +- Package re-instantiated: ~/devteam-package/tenant-skill/references/{kubernetes, + troubleshooting}.md. +- Skill now covers the full DOCFIX-130 topic set; ingress kept as recommendation + + guide pointer (full helm how-to stays guide-only, by design). +- Numbers consumed: DOCFIX-136. +REVERT: git checkout HEAD~ -- clientdocs/tenant-skill/references/kubernetes.md clientdocs/tenant-skill/references/troubleshooting.md clientdocs/sweep-receipt.txt docs/v1-redeploy-changelog.md docs/session-ledger.md; then bash scripts/repo-lint.sh --record-clientdocs-sweep; re-instantiate the package skill files. + +Next-free after this push (per scan, keep this line unwrapped): D-076, DOCFIX-137, BUNDLEFIX-012.