pikasTech-HWLAB/docs/d601-k3s-readonly-observability.md

D601 k3s Readonly Observability

This entry point supports pikasTech/HWLAB#46 and the DEV runtime blockers in #7, #33, #36, #38, #39, and #42. It is a read-only preflight for the D601 Code Queue runner and the hwlab-dev namespace.

It does not authorize PROD, read Secret resources, print kubeconfig/token material, print ConfigMap values, mutate cluster state, restart runtime services, or run heavy checks on the master server.

Command

Run from the repository root:

node --check scripts/d601-k3s-readonly-observability.mjs
node --check scripts/src/d601-k3s-readonly-observability.mjs
node scripts/d601-k3s-readonly-observability.mjs

The command writes reports/d601-k3s-readonly-observability.json and prints a short JSON summary. A blocked conclusion means the preflight ran and recorded the missing binary, kubeconfig path, SSH bridge, or read permission. Use --fail-on-blocked only in CI jobs that should fail when observability is not ready.

Useful options:

node scripts/d601-k3s-readonly-observability.mjs --pretty
node scripts/d601-k3s-readonly-observability.mjs --timeout-ms 5000
node scripts/d601-k3s-readonly-observability.mjs --no-write
node scripts/d601-k3s-readonly-observability.mjs --report reports/d601-k3s-readonly-observability.json

What It Checks

• kubectl, k3s, k3sctl, and ssh availability and version output.
• KUBECONFIG, ~/.kube/config, /etc/rancher/k3s/k3s.yaml, and the k3s admin kubeconfig path by file metadata only.
• SSH maintenance bridge hints from known environment variable names and ~/.ssh metadata only.
• If a Kubernetes executor is available, read-only access to hwlab-dev namespace, pods, services, and ConfigMaps.
• Summaries for pods, services, and ConfigMap key names only. ConfigMap data values are not printed.

Ready Criteria

ready requires a direct executor, such as kubectl or k3s kubectl, to read pods, services, and ConfigMaps from hwlab-dev and no open environment or observability blocker.

blocked keeps the report consumable by follow-up issues. The report includes open blockers with scope, summary, and nextTask fields so runner image or mount work can be tracked without guessing which binary, permission, or path is missing.