119 lines
7.4 KiB
Markdown
119 lines
7.4 KiB
Markdown
# PR knowledge archive, July 2026
|
|
|
|
This document preserves useful knowledge from the PR cleanup. It is not an
|
|
architecture decision and does not keep the old branches alive. Any new work
|
|
starts from current `master`, checks the current code first, and extracts only
|
|
the part needed by the active roadmap.
|
|
|
|
## Application deployment notes
|
|
|
|
### OpenWebUI with external Ollama (#277)
|
|
|
|
The branch was reported as a working deployment used by real users. Preserve
|
|
the recipe, not the stale framework change.
|
|
|
|
- Chart: `open-webui/open-webui` from
|
|
`https://open-webui.github.io/helm-charts/`.
|
|
- Deployment shape: one replica, external Ollama, internal service on port 80
|
|
to container port 8080, 5 GiB RWO persistence, and an OKD edge-terminated
|
|
ingress.
|
|
- Disabled bundled services: Ollama, pipelines, Tika, and websocket support.
|
|
- Security intent: non-root pod, `RuntimeDefault` seccomp, no privilege
|
|
escalation, and all capabilities dropped.
|
|
- Known manual step: the generated ingress did not work and was repaired
|
|
manually.
|
|
- Before restoring the example: pin the chart/image, source
|
|
`WEBUI_SECRET_KEY` from secret management, supply the real Ollama URL, fix and
|
|
test ingress, add resources and a smoke check, and decide the required auth
|
|
and backup behavior.
|
|
|
|
The old branch's Helm interpreter edit is obsolete. Current Helm deployment
|
|
already supports upgrade/install behavior.
|
|
|
|
### Qwen3.5-27B-FP8 with vLLM on RTX 5090 (#254)
|
|
|
|
This branch was also reported as a working deployment. Its 523-line raw
|
|
Kubernetes example does not fit ADR-023, but the hardware and runtime settings
|
|
are useful.
|
|
|
|
- Image used: `vllm/vllm-openai:latest`; pin a tested release or digest before
|
|
reuse.
|
|
- Model: `Qwen/Qwen3.5-27B-FP8` on one NVIDIA RTX 5090 with 32 GiB VRAM.
|
|
- Starting context: 16,384 tokens. The full 262k context did not fit this
|
|
hardware.
|
|
- Runtime flags: `--reasoning-parser qwen3`, automatic tool choice,
|
|
`--tool-call-parser qwen3_coder`, and `--language-model-only`.
|
|
- Resources: one GPU, CPU request/limit 2/10, memory request/limit 10/30 GiB,
|
|
50 GiB RWO Hugging Face cache, and 4 GiB memory-backed `/dev/shm`.
|
|
- Placement: `nvidia.com/gpu.product=NVIDIA-GeForce-RTX-5090`.
|
|
- Rollout and health: one replica, `Recreate`, `/health` readiness after 120s,
|
|
and liveness after 300s.
|
|
- Exposure: service and OKD edge-terminated Route on port 8000.
|
|
- Known manual step: the official image required the `anyuid` SCC because it
|
|
ran as root and wrote under `/root`.
|
|
- Before restoring the recipe: use a non-root image, remove the SCC exception,
|
|
pin vLLM, revalidate GPU utilization and parser flags, add API
|
|
authentication, source the Hugging Face token from secret management, and
|
|
add metrics and a smoke check.
|
|
|
|
The replacement should be a focused deployment Score or use an existing Score.
|
|
Do not restore the raw manifest builder.
|
|
|
|
## Fleet knowledge to retain
|
|
|
|
| PR | Useful knowledge | Missing or unsafe part | Current use |
|
|
|---|---|---|---|
|
|
| #328 | Operator restart recovery, replay signal, orphan cleanup scenarios | Failed deletes can be forgotten; watcher failures are hidden; E2E is not in normal CI | Input to post-release Fleet recovery work |
|
|
| #329 | Two-second HTMX device log tail with conditional auto-scroll | No load bound, fan-out, or browser test | Input to a small operational logs feature |
|
|
| #330 | ADR-022 upgrade state machine, version heartbeat, staged binary verification and operator handoff | Draining, signed artifacts, attempt-scoped stop, rollback guarantees, and device E2E are incomplete | Deferred until the production release is stable |
|
|
| #331 | Container-ID tracking and graceful workload replacement | Restart adoption and partial multi-service failures can preserve or report the wrong state | Keep as upgrade/convergence test cases, not code to port |
|
|
| #293 | Route authorization middleware and typed claim parsing | Uses the retired role-map vocabulary rather than ADR-025/027 groups | Input to dashboard authorization design |
|
|
| #294 | Twenty operator restart/recovery scenarios | Only one weak scenario was implemented | Preserve the scenario list for production E2E planning |
|
|
| #299 | A smaller smoke companion than #292 | Still abstract, unenforced, and has no production consumer | Input to the dedicated readiness/idempotency design |
|
|
| #319/#332 | Evolution from JWT deployment claims to entity policies | Both models were superseded at Fleet scale | Historical rationale is preserved in ADR-025 |
|
|
| #313 | Staging OpenBao/config bootstrap experience | Old config paths and secret assumptions conflict with current Fleet code | Recheck only for missing operational steps |
|
|
| #300 | Tag-driven image and chart publication | Superseded implementation | Current release path owns this behavior |
|
|
|
|
## Framework and infrastructure knowledge to retain
|
|
|
|
| PR | Useful knowledge | Missing or unsafe part | Current use |
|
|
|---|---|---|---|
|
|
| #261 | Multiple named instances of one config type are needed for firewall pairs and similar deployments | Old API, unvalidated names, path/env collisions, no current consumer | Backlog under `ROADMAP/11-named-config-instances.md` |
|
|
| #255 | Brocade VLAN CRUD, interface speed, port-channel IDs, and LACP configuration | Broad API break, reachable `todo!()`, weak idempotency and tests | Input to the OPNsense/bare-metal track |
|
|
| #285 | OPNsense bootstrap sequence, firmware/package setup, NIC pinning, and LAN migration | Too broad, stale config path, failing CI | Split only when the bare-metal track resumes |
|
|
| #297 | Rook operator/cluster/storage/object-store resource requirements | Runtime `todo!()`, handwritten schema drift, raw example manifests, no E2E | Storage backlog; no current sprint work |
|
|
| #238 | Monitoring installation-plan idea across several backends | 127-file redesign before selecting the capability boundary | Design input for `ROADMAP/14-tenant-application-monitoring.md` |
|
|
| #212 | Missing certificate capability documentation | Old text is stale and too long | Small documentation backlog item |
|
|
|
|
## Closed work with no remaining implementation to recover
|
|
|
|
| PR | What happened |
|
|
|---|---|
|
|
| #340 | Compose build arguments and Zitadel readiness landed through #341 |
|
|
| #316 | Login return-path behavior reached master through later work |
|
|
| #311 | SSO example cleanup became stale after config and identity changes |
|
|
| #292 | The first smoke framework was replaced by the smaller #299 design |
|
|
| #295 | Log querying was incomplete and attached to the wrong Score abstraction |
|
|
| #281 | Redpanda benchmark knowledge was tied to raw `kubectl apply`; recreate through Scores only if prioritized |
|
|
| #260 | Arbitrary shell desired state was replaced by typed Fleet reconciliation |
|
|
| #253 | SQLite configuration support landed and evolved on master |
|
|
| #247 | KVM support landed, gained tests, and now supports Fleet E2E |
|
|
| #236 | Earlier version of #238 with no separate knowledge to preserve |
|
|
| #215 | Docker autoinstall was incomplete, unsafe, and based on obsolete tooling |
|
|
|
|
## Prioritization rule
|
|
|
|
The current return order is:
|
|
|
|
1. production Fleet deployment UX/DX;
|
|
2. next customer release;
|
|
3. Fleet deployment E2E on the test cluster;
|
|
4. focused readiness and idempotency design;
|
|
5. small framework extractions proven by the Fleet work;
|
|
6. application recipes and infrastructure backlog when they serve an active
|
|
deployment.
|
|
|
|
Branch history remains available in Git if a detail is needed. Do not copy an
|
|
old implementation wholesale; reproduce the proven behavior with the current
|
|
framework.
|