chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-24 19:54:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
f1450605c2
prole/docs/plans/junie
History
chrisfu d6586cf1d9 kdc: backport init_kdc.sh trust fixes + add reset-repeatable Junie brief 
Mirrors the knoe-db commit `ff7546d` patches into the prole copy of
`etc/init_kdc.sh` so a re-run of `install.sh --mode k3s --reset` from
this repo produces a working cross-realm trust without manual cluster
surgery. The k3s cluster is provisioned from this repo, so the source
fix must live here (knoe-db remains canonical for GKE).

Changes to etc/init_kdc.sh:

1. Create BOTH cross-realm krbtgts in MIT, not just the outbound one.
   The inbound `krbtgt/<REALM>@<TRUST_REALM>` (issued by Samba,
   decrypted here) was missing entirely; without it, MIT cannot
   decrypt inbound TGTs and the trust never carries traffic.

2. Pin both cross-realm krbtgts to RC4 (`arcfour-hmac:normal`). AES
   keys depend on salt, and Samba's `<remote_realm>+UPN` salt does
   not match MIT's `<local_realm>+<principal-no-realm>`; RC4 has no
   salt so both sides converge from the password alone. Matches the
   already-pinned Samba side (commit `ad1eced`).

3. Replace the broken "remote kadmin to Samba" reciprocal-trust block
   with a documented no-op pointing at
   `infrastructure/playbooks/kerberos_trust_setup.yml`. Samba AD
   does not accept additions over MIT's kadmin protocol; the block
   always failed with "Missing parameters in krb5.conf required for
   kadmin client".

4. Switch the KDC data volume from emptyDir to a PVC
   (claimName `knoe-kdc-data`, parameterized by
   `$PROLE_KDC_STORAGE_SIZE` and `$PROLE_KDC_STORAGE_CLASS`).
   State now survives pod restarts.

Adds Junie brief `docs/plans/junie/kdc-trust-reset-repeatable.md`
with four TDD acceptance criteria for an end-to-end --reset run on
the prole k3s cluster.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 01:24:34 -07:00
..
02-k3s-prole-rename.md docs(plans): file Junie briefs for queue items #2, #6, #7, #13, #15 2026-05-01 16:13:20 -07:00
03-image-rename-knoe-authority-to-knoe-auth.md feat: ship Junie #3 (image rename) + Phase 2 OIDC GKE deploy + k3d chrisfu seed 2026-05-02 13:07:40 -07:00
06-patch-garage-script-fixes.md docs(plans): file Junie briefs for queue items #2, #6, #7, #13, #15 2026-05-01 16:13:20 -07:00
07-init-cnpg-gke-sa-wiring.md docs(plans): file Junie briefs for queue items #2, #6, #7, #13, #15 2026-05-01 16:13:20 -07:00
13-podmonitor-manual-management.md docs(plans): file Junie briefs for queue items #2, #6, #7, #13, #15 2026-05-01 16:13:20 -07:00
15-remove-dead-dashboard-consumer.md docs(plans): file Junie briefs for queue items #2, #6, #7, #13, #15 2026-05-01 16:13:20 -07:00
k3d-knoe-auth-dev-loop.md docs(plans): k3d-mirror-of-GKE plan + Phase 1 brief for Junie 2026-05-02 04:45:28 -07:00
k3d-knoe-auth-pod-deploy.md docs(plans): file Phase 3 brief — knoe-auth as a pod inside k3d 2026-05-02 13:15:29 -07:00
kdc-trust-reset-repeatable.md kdc: backport init_kdc.sh trust fixes + add reset-repeatable Junie brief 2026-05-11 01:24:34 -07:00
phase2-oidc-gke-deploy.md feat: ship Junie #3 (image rename) + Phase 2 OIDC GKE deploy + k3d chrisfu seed 2026-05-02 13:07:40 -07:00
README.md docs(plans): file todo-1 brief — cfg save path refuses non-string widget values 2026-05-05 20:43:44 -04:00
todo-1-cfg-save-path-bug.md docs(plans): file todo-1 brief — cfg save path refuses non-string widget values 2026-05-05 20:43:44 -04:00

README.md

Junie briefs

Self-contained, single-task briefs for Junie to consume from inside the IntelliJ IDE. Each file is a hand-off — Junie reads the brief cold (no shared chat history), implements the change, and opens an MR.

What lives here vs. ../

The .. parent directory holds architectural plans — multi-section documents covering an initiative's strategy, schema, and component design. They outlive the implementation and become the architectural reference once shipped.

This subdirectory holds work briefs — smaller, more tactical, scoped to a single MR's worth of changes. They reference the master TODO index (../../TODO.md) and contain enough context for Junie to land the change without escalating questions.

Brief shape (convention)

Each brief follows this skeleton:

  1. Why — one or two paragraphs of context, including the trigger event if any (e.g. "the 4/28 14:00 UTC outage").
  2. What changes — concrete file paths, line numbers, before/after where useful. Don't make Junie re-derive the change.
  3. Verification — runnable commands or helm template diffs that confirm the change. Each brief ends with a Definition of done checklist.
  4. Out of scope — explicit fences. The TODO is interconnected; without this section briefs creep.
  5. Commit shape — proposed commit message + structure.

Status tracking

Every brief here corresponds to a numbered item in ../../TODO.md (or has an explicit "doesn't yet exist in TODO" note). When Junie lands a brief:

  1. Move the corresponding item from the TODO ranked queue into the Done section with date + commit ref (or the convention used by the rest of the file).
  2. Don't delete the brief from this directory — it stays as the design record.

Current briefs (as of 2026-05-02)

Active (in flight)

File Tracked at Subject
k3d-knoe-auth-pod-deploy.md TODO §"In progress"; parent ../k3d-gke-mirror.md §6 Phase 3 Phase 3 of k3d-mirror-of-GKE: build the knoe-auth image, k3d image import, run as a pod inside the cluster. Pre-merge smoke loop with make k3d-knoe-{deploy,redeploy,undeploy}.
todo-1-cfg-save-path-bug.md followup from commit dba8a2d TDD fix: ConfigMixin._save_knoe_cfg must refuse to serialize non-string widget values into conf/<mode>.cfg. Currently leaks <MagicMock …> reprs when widgets aren't real Tk StringVars.

Shipped (kept as design record)

File Queue # Subject
k3d-knoe-auth-dev-loop.md k3d Phase 1 CNPG + KDC in k3d; make k3d-knoe-{up,pf,down}; --mode k3d flag; etc/krb5.local.conf; smoke script; engineer doc. Shipped 2026-05-02.
02-k3s-prole-rename.md #2 Rename k3s prole-*.yaml → knoe-*.yaml (kustomize is broken). Shipped 2026-05-02 (commit fb7e8b7).
06-patch-garage-script-fixes.md #6 Three defects in scripts/patch_garage_cross_cluster.sh. Shipped 2026-05-02 (commits 34a25dd + 5d17325).
07-init-cnpg-gke-sa-wiring.md #7 Wire cnpg-backup-sa into CNPG cluster spec; bump operator to v1.29. Shipped 2026-05-02 (commit c3fae73).
13-podmonitor-manual-management.md #13 Migrate off CNPG-deprecated enablePodMonitor + podMonitorRelabelings. Shipped 2026-05-02 (commit c3fae73).
15-remove-dead-dashboard-consumer.md #15 Remove dead Kong DASHBOARD consumer + basicauth_credentials. Shipped 2026-05-02 (commit c3fae73).
03-image-rename-knoe-authority-to-knoe-auth.md #3 Rename Docker image knoe-authority → knoe-auth; add Dockerfile.app; update 2 manifests. Shipped 2026-05-02.
phase2-oidc-gke-deploy.md Phase 2 GKE Enable OIDC in GKE deployment; Kong /auth route; studioIngress+knoeAuth values defaults. Shipped 2026-05-02.

How a session fires off a batch

The driving session (Claude Code, Cowork+Code, or a human) writes the briefs into this directory and points Junie at one or more of them. Junie reads the brief, implements, runs the verification checklist, opens an MR. Each brief is independent — Junie can take them in any order, or in parallel across separate IDE sessions.

The brief is the contract. If something is unclear, the brief is buggy and should be edited before Junie continues.