From 1de7071ea909630ac3b895acb0f311f9b273e86d Mon Sep 17 00:00:00 2001 From: atlas-bot Date: Fri, 25 Sep 2026 23:09:27 +0000 Subject: [PATCH] docs(paperclip): record why this KS has no `monitoring` edge (REN-86) REN-86 asked for one field: `- name: monitoring` on the `paperclip` Kustomization's dependsOn, because apps/paperclip/prometheus-read-rbac.yaml (PR #984) puts a Role and a RoleBinding in namespace `monitoring` and a from-scratch bootstrap was expected to fail applying them. The premise does not hold, so the field is not added and the reasoning is written down instead: - Namespace `monitoring` is not created by the `monitoring` Kustomization. It is declared in kubernetes/infrastructure/namespaces/namespaces.yaml, applied by `infrastructure`, which this Kustomization already dependsOn. - `infrastructure` runs wait: false, so it applies the namespaces on its first pass and only its healthChecks gate readiness. It cannot report Ready before the namespace exists, and this Kustomization cannot start before that. - Role and RoleBinding are core rbac.authorization.k8s.io/v1 kinds, and a RoleBinding may reference a Role that does not exist yet. Nothing on this path needs a kube-prometheus-stack CRD or workload, so there is no analogue of the monitoring-rules/PrometheusRule split. Adding the edge would also couple the Kustomization that carries the paperclip pod to `monitoring` readiness, which itself waits on grafana-db, kube-prometheus-stack, Loki, Alloy and blackbox-exporter for up to 30m. Comments only: the parsed manifest is identical to master. Co-Authored-By: Claude Opus 5 --- kubernetes/clusters/homelab/paperclip.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/kubernetes/clusters/homelab/paperclip.yaml b/kubernetes/clusters/homelab/paperclip.yaml index fbd95f6a..efbd6d8d 100644 --- a/kubernetes/clusters/homelab/paperclip.yaml +++ b/kubernetes/clusters/homelab/paperclip.yaml @@ -14,6 +14,25 @@ spec: prune: true wait: true dependsOn: + # Deliberately NOT dependsOn: monitoring, even though + # apps/paperclip/prometheus-read-rbac.yaml puts a Role and a RoleBinding in + # namespace `monitoring` (REN-86). + # + # The only thing those two objects need first is the namespace, and the + # namespace does not come from the `monitoring` Kustomization — it is + # declared in infrastructure/namespaces/namespaces.yaml and applied by + # `infrastructure`, listed right below. `infrastructure` runs wait: false, so + # it applies the namespaces on its first pass and only its healthChecks hold + # its readiness, which is strictly later; by the time this Kustomization + # starts, `monitoring` exists. Role and RoleBinding are core RBAC kinds, and + # a RoleBinding is allowed to name a Role that does not exist yet, so + # nothing on this path waits on kube-prometheus-stack's CRDs or workloads. + # + # The edge would not be free either. `monitoring` dependsOn `grafana-db` and + # itself waits (wait: true, 30m) on kube-prometheus-stack, Loki, Alloy and + # blackbox-exporter. Adding it would stop the Kustomization that carries the + # paperclip pod from reconciling whenever any of that is unhealthy — a real + # coupling bought for a bootstrap-ordering problem that does not exist. - name: infrastructure - name: infrastructure-crds - name: infrastructure-ceph-cluster -- 2.54.0