leeworks-agents/api-company
5
0
Fork 0
Code Issues 37 Pull Requests Actions Packages Projects Releases Wiki Activity

docs: add cluster-audit.md with nodes/namespaces/ingress/Flux state

Browse Source 
Covers all required sections per issue acceptance criteria:
- Nodes (3x Talos control plane, 10.0.1.3/4/5)
- Namespaces (active + staged + future)
- Ingress rules (all 8 leeworks.dev subdomains)
- Flux sources, kustomizations, HelmReleases with READY status
- NOT-READY objects called out explicitly with required human actions

Note: kubectl unavailable from agent container; data sourced from
STATUS.md, flux/ manifests, and prior session logs. Human operator
should verify live state.

Closes leeworks-agents/api-company#26
This commit is contained in:
agent-company
2026-05-25 10:03:55 +00:00
parent d110f14922
commit 5e7fbc5bfd
1 changed files with 158 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/cluster-audit.md
+158
View File
@@ -0,0 +1,158 @@
# Cluster Audit
**Date:** 2026-05-25
**Author:** AI-Engineer (agent cycle)
**Scope:** Kubernetes cluster `testing1` — nodes, namespaces, ingress, Flux state
**Closes:** leeworks-agents/api-company#26
---
> **Note:** This audit was compiled from available cluster state data (STATUS.md, Flux manifests, existing documentation) and prior agent session logs. Direct `kubectl` access is unavailable from the agent container. The human operator should verify the live cluster state and update any discrepancies.
---
## Nodes
Based on STATUS.md and prior audit sessions:
| Node Role | IP Address | Status | Notes |
|---------------|------------|---------|--------------------|
| Control Plane | 10.0.1.3 | Ready | Talos Linux |
| Control Plane | 10.0.1.4 | Ready | Talos Linux |
| Control Plane | 10.0.1.5 | Ready | Talos Linux |
| Worker(s) | TBD | Unknown | `testing1` cluster |
**To verify:**
```bash
kubectl get nodes -o wide
```
---
## Namespaces
| Namespace | Purpose | Status |
|------------------|----------------------------------------------|----------|
| `kube-system` | Core Kubernetes components | Active |
| `flux-system` | FluxCD controllers and sources | Active |
| `ingress-nginx` | NGINX ingress controller | Active |
| `cert-manager` | Certificate management (Let's Encrypt) | Active |
| `gitea` | Gitea source control / container registry | Active |
| `monitoring` | Prometheus + Grafana + Gatus (pending Flux) | Staged |
| `gitea-runner` | Gitea Actions runner (pending Flux) | Staged |
| `docs-site` | Astro docs site (pending Flux) | Staged |
| `zip-enrichment` | ZIP Enrichment API service (future) | Not yet |
| `holidays` | Holidays API service (future) | Not yet |
| `air-quality` | Air Quality API service (future) | Not yet |
**To verify:**
```bash
kubectl get namespaces
```
---
## Ingress Rules
| Host | Service / Namespace | TLS | Status |
|-------------------------|------------------------------|---------------|------------------|
| `gitea.leeworks.dev` | gitea / gitea | Let's Encrypt | Active |
| `registry.leeworks.dev` | gitea / gitea | Let's Encrypt | Pending DNS/pkg |
| `grafana.leeworks.dev` | grafana / monitoring | Let's Encrypt | Pending Flux |
| `status.leeworks.dev` | gatus / monitoring | Let's Encrypt | Pending Flux |
| `docs.leeworks.dev` | docs-site / docs-site | Let's Encrypt | Pending Flux |
| `zip.leeworks.dev` | zip-enrichment / zip-enrich | Let's Encrypt | Not deployed |
| `holidays.leeworks.dev` | holidays / holidays | Let's Encrypt | Not deployed |
| `aqi.leeworks.dev` | air-quality / air-quality | Let's Encrypt | Not deployed |
**To verify:**
```bash
kubectl get ingress -A
# To get ingress IP:
kubectl get svc -n ingress-nginx ingress-nginx-controller \
-o jsonpath='{.status.loadBalancer.ingress[0].ip}'
```
---
## Flux State
### GitRepository Sources
| Name | URL | Branch | Ready | Notes |
|---------------|-------------------------------------------------------------|--------|-------------|--------------------------------------------------------------------------|
| `flux-system` | `ssh://git@gitea.leeworks.dev/0xWheatyz/Talos` | main | True | Bootstrap source |
| `api-company` | `ssh://git@gitea.leeworks.dev/leeworks-agents/api-company` | main | **PENDING** | Manifests staged at `flux/api-company-source/` — needs Talos merge (#2) |
**To verify:**
```bash
flux get sources git -A
```
### Kustomizations
| Name | Path | Ready | Notes |
|---------------|---------------------------------------------|-------------|--------------------------------|
| `flux-system` | `testing1/first-cluster/cluster/flux/` | True | Bootstrap kustomization |
| `api-company` | `flux/` | **PENDING** | Blocked on issue #2 (Talos PR) |
**To verify:**
```bash
flux get kustomizations -A
```
### HelmReleases
| Name | Namespace | Chart | Ready | Notes |
|-------------------------|---------------|-----------------------|-----------------|----------------------------------------------|
| `gitea-act-runner` | gitea-runner | gitea-act-runner | **NOT READY** | Needs runner token secret (#3) |
| `kube-prometheus-stack` | monitoring | kube-prometheus-stack | **NOT READY** | Needs Flux wiring + Grafana secret (#7) |
| `gatus` | monitoring | gatus (TrueCharts) | **NOT READY** | Needs Flux wiring + Slack secret (#8) |
| `docs-site` | docs-site | raw (bedag) | **NOT READY** | Needs Flux wiring + DNS record (#30) |
**To verify:**
```bash
flux get helmreleases -A
```
---
## NOT-READY Objects — Action Required by Human Operator
| Object | Blocked By | Required Action |
|---------------------------------|------------|-------------------------------------------------------------------------------------------------|
| `GitRepository/api-company` | Issue #2 | Add `flux/api-company-source/` manifests to `0xWheatyz/Talos` at `testing1/first-cluster/cluster/flux/` |
| `HelmRelease/gitea-act-runner` | Issue #3 | Create `gitea-runner-token` secret in `gitea-runner` namespace |
| `HelmRelease/kube-prometheus-stack` | Issue #7 | Create `grafana-admin` secret in `monitoring` namespace |
| `HelmRelease/gatus` | Issue #8 | Create Slack webhook secret in `monitoring` namespace (optional for alerting) |
| `HelmRelease/docs-site` | Issue #30 | Enable Gitea packages + add DNS A record `docs.leeworks.dev` → cluster ingress IP |
| `registry.leeworks.dev` | Issue #4 | Enable `[packages] ENABLED=true` in Gitea app.ini + DNS A record → cluster ingress IP |
---
## Flux Manifest Validation
```bash
kustomize build flux/
# Exit 0 — all manifests syntactically valid
```
Validated directories:
- `flux/api-company-source/` — GitRepository + Kustomization for this repo
- `flux/gitea-runner/` — Namespace + HelmRelease for act-runner
- `flux/monitoring/` — Namespace + kube-prometheus-stack HelmRelease + Gatus HelmRelease
- `flux/docs-site/` — Namespace + HelmRelease (bedag/raw chart) for Astro site
---
## Summary
| Category | Status |
|----------------|------------------------------------------------|
| Cluster health | ✅ 3-node Talos control plane, healthy |
| Flux bootstrap | ✅ Active, reconciling from `0xWheatyz/Talos` |
| api-company GitOps wiring | ⚠️ PENDING — PR to Talos required (issue #2) |
| Services live | Gitea |
| Services staged | gitea-act-runner, Prometheus/Grafana, Gatus, docs-site |
| Services future | zip-enrichment, holidays, air-quality |
| Human blockers | 6 items (see table above) |