Files

T

kacerrandClaude Opus 5.5 5e5b6c506a lab1: 2 GiB workers, CAPMOX memory overcommit, CA install (Step 6), future-tasks

Owner's pending work, committed ahead of the pv1-2 change it underlies:
- lab1.yaml: worker template lab1-worker-2g (2048 MiB, decision #16), MD rollout
  maxSurge 0 / maxUnavailable 1, ProxmoxCluster schedulerHints.memoryAdjustment 160 (#17)
- cluster-autoscaler values: RBAC for proxmoxmachinetemplates, aggressive scale-down
  profile, Cilium startup-taint; runbook Steps 4-7 and troubleshooting rows
- inflate test pods 512Mi; decisions #16/#17; session note on the memory overcommit
- docs/future-tasks.md convention (CLAUDE.md, README) with the namespace-per-cluster task
- AGENTS.md; allowlist entries in .claude/settings.json

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-30 11:05:39 +02:00

2.8 KiB

Raw Blame History

Future tasks

Deferred work, newest first. When a task is picked up it gets a plan in docs/plans/; then tick it here and link the plan.

- [ ] Namespace per workload cluster (`lab1` out of `default`)

Added: 2026-09-28 09:29 CEST · Why deferred: keep phase 1 moving; default works for now.

Problem. cluster-autoscaler has to run in the same namespace as the Cluster. The chart mounts clusterAPIKubeconfigSecret as a Secret volume, which only works within the pod's namespace, and lab1-kubeconfig lives in the Cluster's namespace. lab1 is in default, so CA would be installed into default too. That mixes things in default, and with more clusters (phase 3) you'd get one CA per cluster sitting side by side in default.

Options compared:

Option	Verdict
CA in `default` (current Step 6)	works; poor hygiene, doesn't scale to more clusters
CA in its own namespace with a copy of the kubeconfig Secret	rejected: CAPI rewrites `lab1-kubeconfig` when it rotates the client cert, so the copy goes stale and CA silently loses the workload cluster
One namespace per cluster (`lab1` holds the CAPI objects, `InClusterIPPool`, kubeconfig Secret and CA)	preferred: the usual CAPI multi-cluster layout, one CA per workload cluster, RBAC and cleanup per namespace, matches phase 3

Cost. Namespace is immutable on CAPI objects, so lab1 has to be deleted and recreated. That means about 15 minutes of provisioning plus reinstalling Cilium. clusterctl move is not an option, since it's forbidden with cluster-api-operator. CAPMOX credentials come from the controller's global Secret, so a new namespace needs no extra credentials. The cost grows once workloads and autoscaler state exist on lab1, so do it before the Step 7 results matter, or when creating the next cluster.

Changes:

configs/capi/lab1.yaml: a Namespace lab1 object and metadata.namespace: lab1 on every object, including InClusterIPPool.
configs/cluster-autoscaler/values.yaml: autoDiscovery.namespace: lab1; install with -n lab1 (helm uninstall ca -n default first if it was installed in default).
ansible/group_vars/all.yml: inspector_workload_clusters entry { name: lab1, namespace: lab1 }.
docs/phase-1-proxmox-capi.md: Steps 3, 5 and 6 (namespace in commands and log expectations, MachineDeployment/lab1/lab1-workers).
.claude/agents/cluster-inspector.md: the "Where things live" table says CA runs in default.
docs/decisions.md: new row (namespace per workload cluster).

Run by the owner: kubectl delete -f configs/capi/lab1.yaml (old namespace), wait until the VMs are gone, kubectl apply the new manifest, Cilium helm upgrade --install, ansible-playbook mgmt.yml --tags inspector, then the CA install into lab1.

2.8 KiB Raw Blame History

Future tasks

- [ ] Namespace per workload cluster (lab1 out of default)

2.8 KiB

Raw Blame History

- [ ] Namespace per workload cluster (`lab1` out of `default`)