# Changelog

## 2026-09-27 10:40 CEST — Management cluster running, built by an idempotent Ansible playbook

- Phase 1 Step 2 done: `ansible/mgmt.yml` creates VM 201 `lab-mgmt` (192.168.4.21) on `pv1-1`
  from the pinned Ubuntu cloud image, installs k3s v1.35.8+k3s1, cert-manager v1.21.2 and
  cluster-api-operator 0.28.0, and CAPI v1.12.11 / CAPMOX v0.9.1 / IPAM v1.1.1 as operator
  Provider CRs (all READY). A second full run reports `changed=0`.
- `clusterctl init` is gone from the runbook; `clusterctl` (v1.12.11 in `~/bin`) is used only for
  `generate`/`describe`/`get kubeconfig`. Proxmox credentials moved to `ansible/secrets.yml`.
- cluster-inspector role can now read Provider CRs, HelmCharts and nodes.
- Files: `ansible/`, `docs/phase-1-proxmox-capi.md`, `docs/versions.md`, `docs/decisions.md`
  (#12–14), `configs/capi/clusterctl.yaml.example`, `CLAUDE.md`, `README.md`.

## 2026-09-27 00:02 CEST — Read-only cluster-inspector credentials next to the agent

- Moved inspector RBAC from `configs/rbac/` to `.claude/cluster-inspector/` with `make-kubeconfig.sh`
  (applies RBAC once, mints a short-lived TokenRequest token, writes gitignored
  `kubeconfigs/<name>.kubeconfig`, runs `can-i` checks) and a setup README.
- Dropped the long-lived `service-account-token` Secret; tokens default to 7 days, refresh by re-running.
- `cluster-inspector` agent now reads only `.claude/cluster-inspector/kubeconfigs/*`; `.gitignore`
  covers that dir and `.claude/settings.local.json`.
- Files: `.claude/cluster-inspector/`, `.claude/agents/cluster-inspector.md`, `CLAUDE.md`, `README.md`,
  `.gitignore`, `docs/decisions.md`.

## 2026-09-26 23:55 CEST — Project history conventions

- Adopted plan / execution-log / prompt / review / changelog conventions from
  egress-proxies-operator, plus new `docs/decisions.md` (back-filled) and `docs/sessions/`.
- Git flow: docs straight to `main`, phase-3 code via `feat/` branch + `tea` MR; `/ship` command.
- Files: `CLAUDE.md`, `docs/decisions.md`, `docs/sessions/`, `.claude/`.