kacerrandClaude Opus 5.5
49c548e296
The agent could only reach lab-mgmt, so it couldn't verify nodes, CNI or system pods on lab1. It correctly refused the admin ~/.kube/lab1.kubeconfig when the owner's permission was relayed through the main session. Workload kubeconfigs: - make-kubeconfig.sh: new --capi-cluster [NS/]NAME. --admin-kubeconfig is then the management cluster. The workload admin kubeconfig is read from Secret NS/NAME-kubeconfig into a mktemp file, removed on exit, so no admin file for the workload cluster lands on disk. - ansible/mgmt.yml --tags inspector now also mints kubeconfigs for every cluster in the new inspector_workload_clusters (group_vars: lab1). Clusters without a <name>-kubeconfig Secret are skipped. The tag is now the single weekly token refresh; tasks stay changed_when: false, so the playbook's changed=0 rule still holds. - Owner ran --tags inspector: kubeconfigs/lab1.kubeconfig (lab1-ro) minted, can-i checks as expected. Agent prompt: - Cluster map: what to inspect on lab-mgmt vs the workload cluster. Machine -> Node -> VM via nodeRef, providerID and ProxmoxMachine.spec.virtualMachineID (checked on live objects). - New triage step: scale-down blockers (non-DaemonSet kube-system pods without PDB, local storage, bare pods, PDBs at 0, safe-to-evict / scale-down-disabled). - Refuses admin kubeconfigs even when a caller relays permission; points the owner to --tags inspector on missing file or 401. - Verb before --kubeconfig so commands match the kubectl get/describe/logs allow rules; single-quote jsonpath/custom-columns for zsh. - Report format: abnormal first, then health summary, then unverified. settings.json: allow kubectl describe/logs/events and clusterctl describe. All four are read-only, and the RO kubeconfigs enforce read-only anyway. Checked: bash -n on the script; ansible-playbook --syntax-check and ansible-lint --profile production pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
44 lines
2.0 KiB
YAML
44 lines
2.0 KiB
YAML
# Pinned versions: docs/versions.md is the source of truth, keep in sync.
|
|
k3s_version: v1.35.8+k3s1
|
|
cert_manager_chart_version: v1.21.2
|
|
capi_operator_chart_version: 0.28.0
|
|
capi_version: v1.12.11
|
|
capmox_version: v0.9.1
|
|
ipam_in_cluster_version: v1.1.1
|
|
|
|
ubuntu_image_url: https://cloud-images.ubuntu.com/noble/20260926/noble-server-cloudimg-amd64.img
|
|
ubuntu_image_sha256: 6a81c37564db9b1ee84e141922625e1d7c5b389b99bb3c572e0243607d5bb4d2
|
|
ubuntu_image_path: /var/lib/vz/template/iso/noble-server-cloudimg-amd64-20260926.img
|
|
|
|
# Proxmox (token secret lives in secrets.yml)
|
|
proxmox_url: https://192.168.0.8:8006
|
|
proxmox_token_id: capmox@pve!capi
|
|
proxmox_storage: local-lvm
|
|
proxmox_bridge: vmbr0
|
|
proxmox_vlan: 4
|
|
|
|
# Management VM (VLAN 4). Fill in the empty values before the first run.
|
|
mgmt_vmid: "201"
|
|
mgmt_name: lab-mgmt
|
|
mgmt_ip: "192.168.4.21"
|
|
mgmt_prefix: 24
|
|
mgmt_gateway: "192.168.4.8"
|
|
mgmt_dns: ["8.8.8.8", "2.2.2.2"]
|
|
mgmt_cores: 2
|
|
mgmt_memory_mib: 4096
|
|
mgmt_disk_size: 30G
|
|
mgmt_ssh_public_key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/id_ed25519.pub') }}"
|
|
|
|
# Workload clusters that get a cluster-inspector read-only kubeconfig (--tags inspector).
|
|
# Skipped while the cluster's <name>-kubeconfig Secret doesn't exist.
|
|
inspector_workload_clusters:
|
|
- { name: lab1, namespace: default }
|
|
|
|
# Installed by the cluster-api-operator; CR namespace = install namespace (clusterctl defaults).
|
|
capi_providers:
|
|
- { kind: CoreProvider, name: cluster-api, namespace: capi-system, version: "{{ capi_version }}" }
|
|
- { kind: BootstrapProvider, name: kubeadm, namespace: capi-kubeadm-bootstrap-system, version: "{{ capi_version }}" }
|
|
- { kind: ControlPlaneProvider, name: kubeadm, namespace: capi-kubeadm-control-plane-system, version: "{{ capi_version }}" }
|
|
- { kind: InfrastructureProvider, name: proxmox, namespace: capmox-system, version: "{{ capmox_version }}", config_secret: capmox-variables }
|
|
- { kind: IPAMProvider, name: in-cluster, namespace: capi-ipam-in-cluster-system, version: "{{ ipam_in_cluster_version }}" }
|