pikasTech-HWLAB/reports/d601-k3s-readonly-observability.json

{
  "$schema": "https://hwlab.pikastech.local/schemas/d601-k3s-readonly-observability-report.schema.json",
  "$id": "https://hwlab.pikastech.local/reports/d601-k3s-readonly-observability.json",
  "reportVersion": "v1",
  "reportKind": "d601-k3s-readonly-observability",
  "issue": "pikasTech/HWLAB#46",
  "supports": [
    "pikasTech/HWLAB#7",
    "pikasTech/HWLAB#33",
    "pikasTech/HWLAB#36",
    "pikasTech/HWLAB#38",
    "pikasTech/HWLAB#39",
    "pikasTech/HWLAB#42"
  ],
  "generatedAt": "2026-05-21T17:34:15.046Z",
  "mode": "read-only",
  "devOnly": true,
  "prodDisabled": true,
  "namespace": "hwlab-dev",
  "runtimeTarget": {
    "runner": "D601 Code Queue",
    "cluster": "D601 k3s",
    "namespace": "hwlab-dev",
    "resources": [
      "pods",
      "services",
      "configmaps"
    ]
  },
  "safety": {
    "noProd": true,
    "noSecretsPrinted": true,
    "noSecretResourcesRead": true,
    "noClusterMutation": true,
    "noRuntimeRestart": true,
    "noHeavyE2E": true
  },
  "forbiddenActions": [
    "prod-access",
    "secret-material-read",
    "cluster-mutation",
    "runtime-restart",
    "heavy-e2e",
    "master-server-heavy-check"
  ],
  "validationCommands": [
    "node --check scripts/d601-k3s-readonly-observability.mjs",
    "node --check scripts/src/d601-k3s-readonly-observability.mjs",
    "node scripts/d601-k3s-readonly-observability.mjs"
  ],
  "conclusion": "blocked",
  "environment": {
    "binaries": {
      "kubectl": {
        "name": "kubectl",
        "available": false,
        "path": null
      },
      "k3s": {
        "name": "k3s",
        "available": false,
        "path": null
      },
      "k3sctl": {
        "name": "k3sctl",
        "available": false,
        "path": null
      },
      "ssh": {
        "name": "ssh",
        "available": true,
        "path": "/usr/bin/ssh",
        "version": {
          "ok": true,
          "command": "ssh -V",
          "output": "OpenSSH_10.0p2 Debian-7+deb13u2, OpenSSL 3.5.5 27 Jan 2026"
        }
      }
    },
    "kubeconfig": [
      {
        "source": "default",
        "path": "~/.kube/config",
        "exists": false,
        "readable": false,
        "error": "ENOENT"
      },
      {
        "source": "default",
        "path": "/etc/rancher/k3s/k3s.yaml",
        "exists": false,
        "readable": false,
        "error": "ENOENT"
      },
      {
        "source": "default",
        "path": "/var/lib/rancher/k3s/server/cred/admin.kubeconfig",
        "exists": false,
        "readable": false,
        "error": "ENOENT"
      }
    ],
    "sshBridge": {
      "sshBinaryAvailable": true,
      "env": [
        {
          "name": "HWLAB_D601_SSH_HOST",
          "set": false,
          "valueRedacted": null
        },
        {
          "name": "HWLAB_D601_SSH_TARGET",
          "set": false,
          "valueRedacted": null
        },
        {
          "name": "HWLAB_D601_MAINTENANCE_HOST",
          "set": false,
          "valueRedacted": null
        },
        {
          "name": "D601_SSH_HOST",
          "set": false,
          "valueRedacted": null
        },
        {
          "name": "HWLAB_MAINTENANCE_SSH",
          "set": false,
          "valueRedacted": null
        }
      ],
      "paths": [
        {
          "path": "~/.ssh",
          "exists": true,
          "readable": true,
          "type": "directory"
        },
        {
          "path": "~/.ssh/config",
          "exists": false,
          "readable": false,
          "error": "ENOENT"
        },
        {
          "path": "~/.ssh/known_hosts",
          "exists": true,
          "readable": true,
          "type": "file",
          "sizeBytes": 4208
        }
      ],
      "configured": false,
      "note": "SSH bridge discovery checks only binary, environment variable presence, and file metadata; it does not read SSH config or private keys."
    }
  },
  "cluster": {
    "namespace": "hwlab-dev",
    "attemptedExecutors": [],
    "readable": false,
    "executors": []
  },
  "blockers": [
    {
      "status": "open",
      "type": "environment_blocker",
      "scope": "d601-k3s-client-binary",
      "summary": "Neither kubectl nor k3s is installed in this runner PATH.",
      "nextTask": "Install kubectl in the D601 Code Queue runner image, or mount an approved k3s kubectl client path for read-only hwlab-dev observation."
    },
    {
      "status": "open",
      "type": "environment_blocker",
      "scope": "d601-kubeconfig-path",
      "summary": "No readable KUBECONFIG/default k3s kubeconfig path was found by metadata checks.",
      "nextTask": "Mount a read-only kubeconfig for hwlab-dev, or document the approved k3s local kubeconfig path without exposing token material."
    },
    {
      "status": "open",
      "type": "environment_blocker",
      "scope": "d601-maintenance-ssh-bridge",
      "summary": "No SSH maintenance bridge was detected from ssh binary plus known environment variables or ~/.ssh/config metadata.",
      "nextTask": "Provide a documented read-only maintenance bridge variable or config path if kubectl cannot be mounted directly in the runner."
    }
  ],
  "runnerImageFollowUp": {
    "needed": true,
    "suggestedUniDeskIssue": "Code Queue runner image should include kubectl and a documented read-only hwlab-dev kubeconfig mount/permission path; keep Secret resources and token material inaccessible to reports."
  },
  "notes": "This report uses command availability checks, file metadata checks, kubectl/k3s kubectl read-only get probes, and auth can-i checks only. It does not print kubeconfig contents, token material, Secret resources, ConfigMap values, SSH config contents, or private keys."
}