HWLAB Code Queue
58 lines
2.2 KiB
Markdown
58 lines
2.2 KiB
Markdown
# D601 k3s Readonly Observability
|
|
|
|
This entry point supports `pikasTech/HWLAB#46` and the DEV runtime blockers in
|
|
`#7`, `#33`, `#36`, `#38`, `#39`, and `#42`. It is a read-only preflight for
|
|
the D601 Code Queue runner and the `hwlab-dev` namespace.
|
|
|
|
It does not authorize PROD, read Secret resources, print kubeconfig/token
|
|
material, print ConfigMap values, mutate cluster state, restart runtime
|
|
services, or run heavy checks on the master server.
|
|
|
|
## Command
|
|
|
|
Run from the repository root:
|
|
|
|
```sh
|
|
node --check scripts/d601-k3s-readonly-observability.mjs
|
|
node --check scripts/src/d601-k3s-readonly-observability.mjs
|
|
node scripts/d601-k3s-readonly-observability.mjs
|
|
```
|
|
|
|
The command writes `reports/d601-k3s-readonly-observability.json` and prints a
|
|
short JSON summary. A `blocked` conclusion means the preflight ran and recorded
|
|
the missing binary, kubeconfig path, SSH bridge, or read permission. Use
|
|
`--fail-on-blocked` only in CI jobs that should fail when observability is not
|
|
ready.
|
|
|
|
Useful options:
|
|
|
|
```sh
|
|
node scripts/d601-k3s-readonly-observability.mjs --pretty
|
|
node scripts/d601-k3s-readonly-observability.mjs --timeout-ms 5000
|
|
node scripts/d601-k3s-readonly-observability.mjs --no-write
|
|
node scripts/d601-k3s-readonly-observability.mjs --report reports/d601-k3s-readonly-observability.json
|
|
```
|
|
|
|
## What It Checks
|
|
|
|
- `kubectl`, `k3s`, `k3sctl`, and `ssh` availability and version output.
|
|
- `KUBECONFIG`, `~/.kube/config`, `/etc/rancher/k3s/k3s.yaml`, and the k3s
|
|
admin kubeconfig path by file metadata only.
|
|
- SSH maintenance bridge hints from known environment variable names and
|
|
`~/.ssh` metadata only.
|
|
- If a Kubernetes executor is available, read-only access to `hwlab-dev`
|
|
namespace, pods, services, and ConfigMaps.
|
|
- Summaries for pods, services, and ConfigMap key names only. ConfigMap data
|
|
values are not printed.
|
|
|
|
## Ready Criteria
|
|
|
|
`ready` requires a direct executor, such as `kubectl` or `k3s kubectl`, to read
|
|
pods, services, and ConfigMaps from `hwlab-dev` and no open environment or
|
|
observability blocker.
|
|
|
|
`blocked` keeps the report consumable by follow-up issues. The report includes
|
|
open blockers with `scope`, `summary`, and `nextTask` fields so runner image or
|
|
mount work can be tracked without guessing which binary, permission, or path is
|
|
missing.
|