# Junie brief — Queue #2: k3s manifest cleanup, `prole-*` filename rename

> **Self-contained brief.** No prior session context required. Mechanical
> rename + a few content sweeps. Should land as a single commit.

---

## 1. Why

`deploy/opentofu/k3s/manifests/knoe/kustomization.yaml` resolves resources by
filename. After the prole→knoe rebrand, the kustomization was updated to
reference `knoe-{configmap,deployment,service,kdc-configmap}.yaml` — but the
files on disk still carry the `prole-` prefix. **Kustomize is broken on the
k3s deploy mode right now**: `kubectl apply -k deploy/opentofu/k3s/manifests/knoe`
errors with "no such file" on the missing `knoe-*.yaml` resources.

This is the same `git mv` pattern that landed the auth-side files in commit
[`b355855`](#) (the `prole-auth-*.yaml` → `knoe-auth-*.yaml` rename). Mirror
that approach.

## 2. The mapping

Files currently in `deploy/opentofu/k3s/manifests/knoe/`:

| Current filename | Rename to | Resource inside (verify) |
|---|---|---|
| `prole-configmap.yaml` | `knoe-configmap.yaml` | ConfigMap `knoe-nginx-config` |
| `prole-deployment.yaml` | `knoe-deployment.yaml` | Deployment `knoe` |
| `prole-service.yaml` | `knoe-service.yaml` | Service `knoe` |
| `prole-kdc-configmap.yaml` | `knoe-kdc-configmap.yaml` | ConfigMap `knoe-kdc-config` |
| `prole-kdc-secrets.example.yaml` | `knoe-kdc-secrets.example.yaml` | Secret template (not in kustomization — example only) |

Use `git mv` for all five so history is preserved.

## 3. Adjacent content sweeps to do in the same commit

Don't ship just the rename. While each file is open, scan for stale
`prole.local` / `PROLE.LOCAL` / `prole-*` references in the **content**:

- **`prole-kdc-configmap.yaml` (post-rename: `knoe-kdc-configmap.yaml`)** —
  the embedded `krb5.conf` currently has `default_realm = PROLE.LOCAL`. The
  Kerberos realm in `authority/` and the rest of the platform is
  `KNOE.LOCAL` (or the production realm; verify by grepping
  `default_realm` across the repo and matching what the running KDC pod
  uses). Update accordingly. If you find a value other than `KNOE.LOCAL` is
  in production use, ASK before changing — don't guess.

- **Any `host: prole.local` / `prole.org` ingress hostnames** in the renamed
  files, or in `ingress.yaml` (which is already the right name). Cross-check
  against the GKE manifests in `deploy/gcp/gke/` for the canonical
  hostnames. If a k3s-only hostname is intentional (different deploy mode),
  leave it but add a comment noting why.

- **`metadata.labels.app: knoe`** is already correct in the deployment +
  service. Verify no `app: prole` label survives.

Anything that isn't a clear "this is stale, no question" — leave a TODO
comment with the specific question and link to this brief, rather than
making the call yourself.

## 4. Verification

1. **Kustomize dry-run resolves all resources cleanly:**
   ```bash
   kubectl kustomize deploy/opentofu/k3s/manifests/knoe/ > /tmp/k3s-rendered.yaml
   echo "exit: $?"
   wc -l /tmp/k3s-rendered.yaml
   ```
   No "file not found" errors. Output rendered manifest has all expected
   resources (knoe Deployment, knoe Service, knoe-nginx-config CM, knoe-kdc-config CM, etc.).

2. **No stragglers:**
   ```bash
   grep -rni 'prole' deploy/opentofu/k3s/manifests/knoe/
   ```
   Expected output: nothing, or only intentional historical comments
   (annotated with the reason).

3. **`git log --follow` works for one of the renamed files:**
   ```bash
   git log --follow --oneline deploy/opentofu/k3s/manifests/knoe/knoe-configmap.yaml | head -5
   ```
   Should show pre-rename history (proof `git mv` preserved it).

4. **Smoke test in k3d if available** (optional but nice): `make k3d-up`
   followed by `kubectl apply -k deploy/opentofu/k3s/manifests/knoe/` — pods
   should start. If k3d isn't available locally, skip; CI will catch it.

## 5. Commit message

```
chore(k3s): rename prole-*.yaml manifests to knoe-* and align contents

Mirrors commit b355855 (auth-side rename). The kustomization at
deploy/opentofu/k3s/manifests/knoe/kustomization.yaml has been
referencing knoe-* names since the rebrand; kustomize was broken
on the k3s deploy mode until this lands.

Five git mv:
  prole-configmap.yaml          -> knoe-configmap.yaml
  prole-deployment.yaml         -> knoe-deployment.yaml
  prole-service.yaml            -> knoe-service.yaml
  prole-kdc-configmap.yaml      -> knoe-kdc-configmap.yaml
  prole-kdc-secrets.example.yaml-> knoe-kdc-secrets.example.yaml

Plus content sweeps for stale prole.local / PROLE.LOCAL realm
references in the embedded krb5.conf.

Closes queue item #2 in docs/TODO.md (drift R5).
```

## 6. Out of scope

- Image refs `knoe-authority` → `knoe-auth` in deployment manifests — that's
  queue item **#3**, separate brief, separate commit. (Touches both
  `deploy/gcp/gke/knoe-auth-deployment.yaml` and the renamed k3s
  `knoe-auth-deployment.yaml`.)
- KDC realm value changes if `default_realm` is currently other than
  `PROLE.LOCAL` in some files — ask before rewriting.

## 7. Definition of done

- [ ] Five `git mv` operations recorded in the commit (preserves history).
- [ ] `kubectl kustomize` produces a clean rendered manifest with no errors.
- [ ] `grep -rni 'prole' deploy/opentofu/k3s/manifests/knoe/` returns clean.
- [ ] Single commit; message starts with `chore(k3s):`.
- [ ] `docs/TODO.md` queue item #2 moved to **Done** section with date and
  commit ref (or, if you prefer, leave that to whoever merges).