claude-botandClaude Fable 5
90aeaf1ef8
Both wrong assessments (#249 openbao 'sealed', #250 three untested hypotheses while one 'kubectl logs' showed the 401) share one root cause: the agents diagnose blind, so they narrate plausible fiction. Labeling unverified claims (previous commit) treats the symptom; this gives them the means to verify: - kubernetes/apps/monitoring/ci-diagnostics-rbac.yaml: ServiceAccount ci-diagnostics with a read-only ClusterRole (workloads, events, pods/log, Flux/ESO/cert-manager/monitoring/ceph CRDs — NO secrets) plus a namespaced services/proxy Role for the Prometheus and Alertmanager HTTP APIs. - scripts/ci/make-diag-kubeconfig.sh: mints a 1h token per run from the admin kubeconfig (no new long-lived secret), builds .ci-diag/kubeconfig, copies the static kubectl binary for the jq-only ci-claude image, smoke-tests with the restricted identity, and degrades to snapshot-only mode when the SA isn't reconciled. - alert-monitor.yml / issue-fix.yml: agents get exactly one extra tool, Bash(./.ci-diag/kubectl:*) — prefix match forbids pipes and any other binary; RBAC forbids mutation and secret reads. - prompts: verification is now mandatory, not aspirational — 'a hypothesis you could have settled with one read-only command but didn't is a defect in your output'; fix agent must test the issue's claims before building on them; minimal-quote rule against dumping logs into public issues. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV7bZzZLeoFUEdAeCSLEei
28 lines
1.1 KiB
YAML
28 lines
1.1 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- grafana-oauth-externalsecret.yaml
|
|
- alertmanager-smtp-externalsecret.yaml
|
|
- pve-exporter-config-externalsecret.yaml
|
|
- pve-exporter-deployment.yaml
|
|
- helmrelease-prometheus.yaml
|
|
- helmrelease-loki.yaml
|
|
- helmrelease-alloy-syslog.yaml
|
|
- helmrelease-blackbox-exporter.yaml
|
|
- loki-basic-auth-externalsecret.yaml
|
|
- loki-basic-auth-middleware.yaml
|
|
- loki-ingress.yaml
|
|
- alertmanager-gate-service.yaml
|
|
- alertmanager-gate-ingress.yaml
|
|
- prometheus-gate-service.yaml
|
|
- prometheus-gate-ingress.yaml
|
|
- ci-diagnostics-rbac.yaml
|
|
- dashboards/
|
|
# prometheusrule-garage.yaml lives in ./monitoring-rules/ and is applied by a
|
|
# separate Flux Kustomization that dependsOn `monitoring` — otherwise the
|
|
# server-side dry-run of the PrometheusRule fails on a fresh cluster
|
|
# ("no matches for kind PrometheusRule") because the CRD is provided by
|
|
# kube-prometheus-stack's chart, which we're applying *in this same
|
|
# Kustomization*. The split lets the chart install (CRDs and all) before
|
|
# Flux tries to admit the rule.
|