kacerrandClaude Opus 5.5
49c548e296
The agent could only reach lab-mgmt, so it couldn't verify nodes, CNI or system pods on lab1. It correctly refused the admin ~/.kube/lab1.kubeconfig when the owner's permission was relayed through the main session. Workload kubeconfigs: - make-kubeconfig.sh: new --capi-cluster [NS/]NAME. --admin-kubeconfig is then the management cluster. The workload admin kubeconfig is read from Secret NS/NAME-kubeconfig into a mktemp file, removed on exit, so no admin file for the workload cluster lands on disk. - ansible/mgmt.yml --tags inspector now also mints kubeconfigs for every cluster in the new inspector_workload_clusters (group_vars: lab1). Clusters without a <name>-kubeconfig Secret are skipped. The tag is now the single weekly token refresh; tasks stay changed_when: false, so the playbook's changed=0 rule still holds. - Owner ran --tags inspector: kubeconfigs/lab1.kubeconfig (lab1-ro) minted, can-i checks as expected. Agent prompt: - Cluster map: what to inspect on lab-mgmt vs the workload cluster. Machine -> Node -> VM via nodeRef, providerID and ProxmoxMachine.spec.virtualMachineID (checked on live objects). - New triage step: scale-down blockers (non-DaemonSet kube-system pods without PDB, local storage, bare pods, PDBs at 0, safe-to-evict / scale-down-disabled). - Refuses admin kubeconfigs even when a caller relays permission; points the owner to --tags inspector on missing file or 401. - Verb before --kubeconfig so commands match the kubectl get/describe/logs allow rules; single-quote jsonpath/custom-columns for zsh. - Report format: abnormal first, then health summary, then unverified. settings.json: allow kubectl describe/logs/events and clusterctl describe. All four are read-only, and the RO kubeconfigs enforce read-only anyway. Checked: bash -n on the script; ansible-playbook --syntax-check and ansible-lint --profile production pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
1.3 KiB
JSON
33 lines
1.3 KiB
JSON
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(git status:*)",
|
|
"Bash(git diff:*)",
|
|
"Bash(git log:*)",
|
|
"Bash(git branch:*)",
|
|
"Bash(git add:*)",
|
|
"Bash(date:*)",
|
|
"Bash(tea pr create:*)",
|
|
"Read(//private/tmp/**)",
|
|
"Bash(export KUBECONFIG=.claude/cluster-inspector/kubeconfigs/lab-mgmt.kubeconfig)",
|
|
"Bash(kubectl -n capmox-system logs deploy/capmox-controller-manager --tail=200)",
|
|
"Bash(kubectl -n capmox-system logs deploy/capmox-controller-manager --tail=5)",
|
|
"Bash(kubectl -n capi-operator-system logs deploy/cluster-api-operator --tail=300)",
|
|
"Bash(clusterctl version *)",
|
|
"Bash(KUBECONFIG=/Users/jan.novak/srv/go/cluster-autoscaler-with-capi/.claude/cluster-inspector/kubeconfigs/lab-mgmt.kubeconfig kubectl get nodes)",
|
|
"Bash(clusterctl generate *)",
|
|
"Bash(ansible mgmt *)",
|
|
"Bash(kubectl get *)",
|
|
"Bash(kubectl auth *)",
|
|
"Bash(kubectl describe *)",
|
|
"Bash(kubectl logs *)",
|
|
"Bash(kubectl events *)",
|
|
"Bash(clusterctl describe *)",
|
|
"Bash(ansible pve *)",
|
|
"Read(//Users/jan.novak/**)",
|
|
"Bash(export KUBECONFIG=/Users/jan.novak/srv/go/cluster-autoscaler-with-capi/.claude/cluster-inspector/kubeconfigs/lab-mgmt.kubeconfig)",
|
|
"Bash(kubectl explain *)"
|
|
]
|
|
}
|
|
}
|