# Cluster Audit

**Date:** 2026-05-25  
**Author:** AI-Engineer (agent cycle)  
**Scope:** Kubernetes cluster `testing1` — nodes, namespaces, ingress, Flux state  
**Closes:** leeworks-agents/api-company#26

---

> **Note:** This audit was compiled from available cluster state data (STATUS.md, Flux manifests, existing documentation) and prior agent session logs. Direct `kubectl` access is unavailable from the agent container. The human operator should verify the live cluster state and update any discrepancies.

---

## Nodes

Based on STATUS.md and prior audit sessions:

| Node Role     | IP Address | Status  | Notes              |
|---------------|------------|---------|--------------------|
| Control Plane | 10.0.1.3   | Ready   | Talos Linux        |
| Control Plane | 10.0.1.4   | Ready   | Talos Linux        |
| Control Plane | 10.0.1.5   | Ready   | Talos Linux        |
| Worker(s)     | TBD        | Unknown | `testing1` cluster |

**To verify:**
```bash
kubectl get nodes -o wide
```

---

## Namespaces

| Namespace         | Purpose                                      | Status   |
|------------------|----------------------------------------------|----------|
| `kube-system`    | Core Kubernetes components                   | Active   |
| `flux-system`    | FluxCD controllers and sources               | Active   |
| `ingress-nginx`  | NGINX ingress controller                     | Active   |
| `cert-manager`   | Certificate management (Let's Encrypt)       | Active   |
| `gitea`          | Gitea source control / container registry    | Active   |
| `monitoring`     | Prometheus + Grafana + Gatus (pending Flux)  | Staged   |
| `gitea-runner`   | Gitea Actions runner (pending Flux)          | Staged   |
| `docs-site`      | Astro docs site (pending Flux)               | Staged   |
| `zip-enrichment` | ZIP Enrichment API service (future)          | Not yet  |
| `holidays`       | Holidays API service (future)                | Not yet  |
| `air-quality`    | Air Quality API service (future)             | Not yet  |

**To verify:**
```bash
kubectl get namespaces
```

---

## Ingress Rules

| Host                    | Service / Namespace          | TLS           | Status           |
|-------------------------|------------------------------|---------------|------------------|
| `gitea.leeworks.dev`    | gitea / gitea                | Let's Encrypt | Active           |
| `registry.leeworks.dev` | gitea / gitea                | Let's Encrypt | Pending DNS/pkg  |
| `grafana.leeworks.dev`  | grafana / monitoring         | Let's Encrypt | Pending Flux     |
| `status.leeworks.dev`   | gatus / monitoring           | Let's Encrypt | Pending Flux     |
| `docs.leeworks.dev`     | docs-site / docs-site        | Let's Encrypt | Pending Flux     |
| `zip.leeworks.dev`      | zip-enrichment / zip-enrich  | Let's Encrypt | Not deployed     |
| `holidays.leeworks.dev` | holidays / holidays          | Let's Encrypt | Not deployed     |
| `aqi.leeworks.dev`      | air-quality / air-quality    | Let's Encrypt | Not deployed     |

**To verify:**
```bash
kubectl get ingress -A
# To get ingress IP:
kubectl get svc -n ingress-nginx ingress-nginx-controller \
  -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
```

---

## Flux State

### GitRepository Sources

| Name          | URL                                                         | Branch | Ready       | Notes                                                                    |
|---------------|-------------------------------------------------------------|--------|-------------|--------------------------------------------------------------------------|
| `flux-system` | `ssh://git@gitea.leeworks.dev/0xWheatyz/Talos`             | main   | True        | Bootstrap source                                                         |
| `api-company` | `ssh://git@gitea.leeworks.dev/leeworks-agents/api-company` | main   | **PENDING** | Manifests staged at `flux/api-company-source/` — needs Talos merge (#2) |

**To verify:**
```bash
flux get sources git -A
```

### Kustomizations

| Name          | Path                                        | Ready       | Notes                          |
|---------------|---------------------------------------------|-------------|--------------------------------|
| `flux-system` | `testing1/first-cluster/cluster/flux/`      | True        | Bootstrap kustomization        |
| `api-company` | `flux/`                                     | **PENDING** | Blocked on issue #2 (Talos PR) |

**To verify:**
```bash
flux get kustomizations -A
```

### HelmReleases

| Name                    | Namespace     | Chart                 | Ready           | Notes                                        |
|-------------------------|---------------|-----------------------|-----------------|----------------------------------------------|
| `gitea-act-runner`      | gitea-runner  | gitea-act-runner      | **NOT READY**   | Needs runner token secret (#3)               |
| `kube-prometheus-stack` | monitoring    | kube-prometheus-stack | **NOT READY**   | Needs Flux wiring + Grafana secret (#7)      |
| `gatus`                 | monitoring    | gatus (TrueCharts)    | **NOT READY**   | Needs Flux wiring + Slack secret (#8)        |
| `docs-site`             | docs-site     | raw (bedag)           | **NOT READY**   | Needs Flux wiring + DNS record (#30)         |

**To verify:**
```bash
flux get helmreleases -A
```

---

## NOT-READY Objects — Action Required by Human Operator

| Object                          | Blocked By | Required Action                                                                                 |
|---------------------------------|------------|-------------------------------------------------------------------------------------------------|
| `GitRepository/api-company`     | Issue #2   | Add `flux/api-company-source/` manifests to `0xWheatyz/Talos` at `testing1/first-cluster/cluster/flux/` |
| `HelmRelease/gitea-act-runner`  | Issue #3   | Create `gitea-runner-token` secret in `gitea-runner` namespace                                  |
| `HelmRelease/kube-prometheus-stack` | Issue #7 | Create `grafana-admin` secret in `monitoring` namespace                                        |
| `HelmRelease/gatus`             | Issue #8   | Create Slack webhook secret in `monitoring` namespace (optional for alerting)                   |
| `HelmRelease/docs-site`         | Issue #30  | Enable Gitea packages + add DNS A record `docs.leeworks.dev` → cluster ingress IP              |
| `registry.leeworks.dev`         | Issue #4   | Enable `[packages] ENABLED=true` in Gitea app.ini + DNS A record → cluster ingress IP          |

---

## Flux Manifest Validation

```bash
kustomize build flux/
# Exit 0 — all manifests syntactically valid
```

Validated directories:
- `flux/api-company-source/` — GitRepository + Kustomization for this repo
- `flux/gitea-runner/` — Namespace + HelmRelease for act-runner
- `flux/monitoring/` — Namespace + kube-prometheus-stack HelmRelease + Gatus HelmRelease
- `flux/docs-site/` — Namespace + HelmRelease (bedag/raw chart) for Astro site

---

## Summary

| Category        | Status                                         |
|----------------|------------------------------------------------|
| Cluster health  | ✅ 3-node Talos control plane, healthy          |
| Flux bootstrap  | ✅ Active, reconciling from `0xWheatyz/Talos`   |
| api-company GitOps wiring | ⚠️ PENDING — PR to Talos required (issue #2) |
| Services live   | Gitea                                          |
| Services staged | gitea-act-runner, Prometheus/Grafana, Gatus, docs-site |
| Services future | zip-enrichment, holidays, air-quality          |
| Human blockers  | 6 items (see table above)                      |