wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 4 Packages Projects Releases Wiki Activity

docs(iwooos): 記錄 k8s gitops 驗證 [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-06-15 02:44:01 +08:00
parent 0976f46640
commit 634dadac70
1 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
docs/LOGBOOK.md
View File

@@ -1,3 +1,46 @@
## 2026-06-15｜K8s / ArgoCD GitOps 變更證據驗收正式部署與 production 驗證完成
**背景**：110 冷啟動事件中曾出現 ArgoCD `Synced / Degraded`、drift-scanner pod pending、部分服務依賴啟動順序不穩等訊號。既有高價值配置控管已把 K8s / ArgoCD GitOps 列為 C0，但仍缺少專門針對 manifest diff、ArgoCD readback、sync revision、rollout evidence、NetworkPolicy / Secret / RBAC / NodePort 影響與 rollback owner 的只讀驗收帳本。若缺少此層，後續容易把「UI 看得到 GitOps 風險」誤判成 `argocd sync`、`kubectl apply`、Helm upgrade 或 live patch 已獲授權。
**完成項目**：
- 新增 `scripts/security/k8s-argocd-change-evidence-acceptance.py`，從 `k8s/` production GitOps manifest 產生 metadata-only change evidence acceptance ledger。
- 新增 `docs/security/k8s-argocd-change-evidence-acceptance.snapshot.json`，固定 `change_evidence_candidate_count=4`、`c0_change_evidence_candidate_count=3`、`write_capable_candidate_count=4`、`required_evidence_field_count=18`、`reviewer_check_count=18`、`outcome_lane_count=8`、`blocked_action_count=28`。
- 新增 `docs/security/K8S-ARGOCD-CHANGE-EVIDENCE-ACCEPTANCE.md`，明確要求 source manifest diff、rendered manifest diff、ArgoCD application readback、sync revision、rollout evidence、route smoke、metrics / alert evidence、maintenance window、rollback owner 與 runtime approval package。
- `high-value-config-control-coverage.snapshot.json` 已同步 K8s production GitOps maturity `62% -> 64%`；高價值配置平均只讀成熟度維持 `68%`，IwoooS headline 維持 `64%`。
- `/zh-TW/iwooos` 前端 evidence marker 已同步 `k8s_argocd_change_evidence_acceptance_candidate_count=4`、`k8s_production_gitops_coverage_percent=64`、`argocd_api_read_authorized=false`、`kubectl_action_authorized=false` 與 `64% / sync 0`。
- `security-mirror-progress-guard.py` 已鎖住新 snapshot schema、summary、candidate ids、reviewer checks、outcome lanes、blocked actions、false flags、coverage 64%、posture source paths 與前端 marker。
**本地驗證**：
- 產生器 smoke：`K8S_ARGOCD_CHANGE_EVIDENCE_ACCEPTANCE_OK candidates=4 c0=3 write_capable=4 checks=18 lanes=8 accepted=0 runtime_gate=0`。
- high-value config coverage 重產：`HIGH_VALUE_CONFIG_CONTROL_COVERAGE_OK categories=14 c0=8 avg=68 runtime_gate=0`。
- `python3 -m py_compile scripts/security/k8s-argocd-change-evidence-acceptance.py scripts/security/high-value-config-control-coverage.py scripts/security/security-mirror-progress-guard.py` 通過。
- JSON parse：K8s / ArgoCD acceptance snapshot、high-value coverage snapshot、IwoooS posture projection snapshot、`apps/web/messages/zh-TW.json`、`apps/web/messages/en.json` 通過。
- `python3 scripts/security/security-mirror-progress-guard.py --root .` → `SECURITY_MIRROR_PROGRESS_GUARD_OK`。
- `python3 scripts/security/source-control-owner-response-guard.py --root .` → `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。
- `python3 scripts/ops/doc-secrets-sanity-check.py docs .gitea` → `DOC_SECRET_SANITY_OK scanned_files=854`。
- `git diff --check` 通過。
- `pnpm --dir apps/web typecheck` 通過。
- `NEXT_PUBLIC_API_URL=https://awoooi.wooo.work SENTRY_SUPPRESS_GLOBAL_ERROR_HANDLER_FILE_WARNING=1 pnpm --dir apps/web build` 通過，92/92 static pages generated。
- local build artifact scan：`/iwooos` bundle 可見 `k8s_argocd_change_evidence_acceptance_candidate_count=4`、K8s `64% / sync 0`、DNS / TLS `78% / probe 0`、`runtime_execution_authorized=false`；raw owner namespace、外部 raw namespace 與內部工作片語均未命中。
**Gitea / CD**：
- Code commit：`f055a973 fix(iwooos): 新增 k8s gitops 變更證據驗收`，已正常 push 到 `gitea/main`，無 force push。
- Code Review：Gitea Actions run `2994` / `ai-code-review` Success。
- CD：Gitea Actions run `2993` 已產生 deploy marker `0976f466 chore(cd): deploy f055a97 [skip ci]`，`gitea/main` 已快轉到該 marker。
**Production 只讀驗證（deploy marker `0976f466`）**：
- In-app browser desktop `1440x900`：`/zh-TW/iwooos?_v=f055a973-k8s-gitops-prod-desktop` 可見 K8s / ArgoCD change evidence acceptance marker、K8s `64% / sync 0`、DNS / TLS `78% / probe 0`、runtime gate `0`、`argocd_api_read_authorized=false` 與 `kubectl_action_authorized=false`；`innerWidth=1440`、`scrollWidth=1434`、`horizontalOverflow=false`；raw owner namespace 與工作視窗片語均為 `false`。
- In-app browser mobile `390x844`：`/zh-TW/iwooos?_v=f055a973-k8s-gitops-prod-mobile` 可見 K8s / ArgoCD change evidence acceptance marker、K8s `64% / sync 0`、DNS / TLS `78% / probe 0`、runtime gate `0`、`argocd_api_read_authorized=false` 與 `kubectl_action_authorized=false`；`innerWidth=390`、`scrollWidth=384`、`horizontalOverflow=false`；raw owner namespace 與工作視窗片語均為 `false`。
- In-app browser mobile `390x844`：`/zh-TW/awooop/tenants?_v=f055a973-k8s-gitops-tenants-mobile` 可見脫敏範圍代號與 redaction boundary；`innerWidth=390`、`scrollWidth=384`、`horizontalOverflow=false`；raw owner namespace、raw repo 範例與工作視窗片語均為 `false`。
**完成度與邊界**：
- K8s / ArgoCD change evidence acceptance artifact：`100%`。
- K8s production GitOps 只讀治理成熟度：`62% -> 64%`。
- 高價值配置平均只讀成熟度：維持 `68%`。
- IwoooS headline：維持 `64%`；active runtime gate：維持 `0`。
- source manifest diff、rendered manifest diff、ArgoCD application readback、sync revision、rollout evidence、route smoke、metrics / alert evidence、runtime approval package、owner response accepted 全部維持 `0 / false`。
- `argocd sync`、ArgoCD API read、`kubectl apply`、live patch、Helm upgrade、Kustomize build、NetworkPolicy apply、NodePort change、RBAC change、Secret change、runtime gate、action button 全部維持 `0 / false`。
## 2026-06-15｜端口 / 防火牆變更證據驗收正式部署與 production 驗證完成
**背景**：110 端口關閉事件已造成 Ollama、ArgoCD、drift-scanner 與相關 route 異常，且使用者明確要求「所有重要配置都要被管控」。既有 SSH / network owner response acceptance 只能描述存取路徑與 owner response gate，仍缺少專門針對端口開關、防火牆規則、服務影響、跨專案同步、維護窗口、rollback owner 與 post-check evidence 的只讀驗收帳本；若缺少此層，未來很容易把「看得到端口異常」誤判成「已授權關閉 / 開啟 / 修復」。