kacerrandClaude Opus 5.5
5e5b6c506a
Owner's pending work, committed ahead of the pv1-2 change it underlies: - lab1.yaml: worker template lab1-worker-2g (2048 MiB, decision #16), MD rollout maxSurge 0 / maxUnavailable 1, ProxmoxCluster schedulerHints.memoryAdjustment 160 (#17) - cluster-autoscaler values: RBAC for proxmoxmachinetemplates, aggressive scale-down profile, Cilium startup-taint; runbook Steps 4-7 and troubleshooting rows - inflate test pods 512Mi; decisions #16/#17; session note on the memory overcommit - docs/future-tasks.md convention (CLAUDE.md, README) with the namespace-per-cluster task - AGENTS.md; allowlist entries in .claude/settings.json Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
46 lines
2.8 KiB
Markdown
46 lines
2.8 KiB
Markdown
# Future tasks
|
|
|
|
Deferred work, newest first. When a task is picked up it gets a plan in `docs/plans/`; then tick
|
|
it here and link the plan.
|
|
|
|
## - [ ] Namespace per workload cluster (`lab1` out of `default`)
|
|
|
|
**Added:** 2026-09-28 09:29 CEST · **Why deferred:** keep phase 1 moving; `default` works for now.
|
|
|
|
**Problem.** cluster-autoscaler has to run in the same namespace as the Cluster. The chart mounts
|
|
`clusterAPIKubeconfigSecret` as a Secret volume, which only works within the pod's namespace, and
|
|
`lab1-kubeconfig` lives in the Cluster's namespace. `lab1` is in `default`, so CA would be installed
|
|
into `default` too. That mixes things in `default`, and with more clusters (phase 3) you'd get one
|
|
CA per cluster sitting side by side in `default`.
|
|
|
|
**Options compared:**
|
|
|
|
| Option | Verdict |
|
|
| --- | --- |
|
|
| CA in `default` (current Step 6) | works; poor hygiene, doesn't scale to more clusters |
|
|
| CA in its own namespace with a copy of the kubeconfig Secret | rejected: CAPI rewrites `lab1-kubeconfig` when it rotates the client cert, so the copy goes stale and CA silently loses the workload cluster |
|
|
| **One namespace per cluster** (`lab1` holds the CAPI objects, `InClusterIPPool`, kubeconfig Secret and CA) | preferred: the usual CAPI multi-cluster layout, one CA per workload cluster, RBAC and cleanup per namespace, matches phase 3 |
|
|
|
|
**Cost.** Namespace is immutable on CAPI objects, so `lab1` has to be deleted and recreated. That
|
|
means about 15 minutes of provisioning plus reinstalling Cilium. `clusterctl move` is not an option,
|
|
since it's forbidden with cluster-api-operator. CAPMOX credentials come from the controller's
|
|
global Secret, so a new namespace needs no extra credentials. The cost grows once workloads and
|
|
autoscaler state exist on `lab1`, so do it before the Step 7 results matter, or when creating the
|
|
next cluster.
|
|
|
|
**Changes:**
|
|
|
|
- `configs/capi/lab1.yaml`: a `Namespace lab1` object and `metadata.namespace: lab1` on every
|
|
object, including `InClusterIPPool`.
|
|
- `configs/cluster-autoscaler/values.yaml`: `autoDiscovery.namespace: lab1`; install with `-n lab1`
|
|
(`helm uninstall ca -n default` first if it was installed in `default`).
|
|
- `ansible/group_vars/all.yml`: `inspector_workload_clusters` entry `{ name: lab1, namespace: lab1 }`.
|
|
- `docs/phase-1-proxmox-capi.md`: Steps 3, 5 and 6 (namespace in commands and log expectations,
|
|
`MachineDeployment/lab1/lab1-workers`).
|
|
- `.claude/agents/cluster-inspector.md`: the "Where things live" table says CA runs in `default`.
|
|
- `docs/decisions.md`: new row (namespace per workload cluster).
|
|
|
|
**Run by the owner:** `kubectl delete -f configs/capi/lab1.yaml` (old namespace), wait until the
|
|
VMs are gone, `kubectl apply` the new manifest, Cilium `helm upgrade --install`,
|
|
`ansible-playbook mgmt.yml --tags inspector`, then the CA install into `lab1`.
|