Reconcile staging preflight inventory
This commit is contained in:
parent
544b2f615d
commit
7bafcb4314
4 changed files with 22 additions and 13 deletions
|
|
@ -7,8 +7,9 @@ the separately reviewed no-send service package. It creates one revision-bound
|
|||
receipt and does not deploy the service.
|
||||
|
||||
The checker validates the exact project, VM, machine type, attached service
|
||||
account, exact boot-disk attachment and architecture, private-only VM
|
||||
VPC/subnet attachment, Private Google Access, immutable Docker Artifact
|
||||
account, exact `e2-standard-4` machine type, boot-disk attachment and
|
||||
architecture, private-only VM attachment to `teleo-staging-europe-west6`
|
||||
(`10.60.0.0/20`), Private Google Access, immutable Docker Artifact
|
||||
Registry repository, exact private PostgreSQL 16 Cloud SQL endpoint, host
|
||||
architecture, Docker server, Docker storage floor, unused service/container
|
||||
names, and private TCP/5432 reachability from the VM.
|
||||
|
|
|
|||
|
|
@ -72,6 +72,14 @@ cut over safely and retire the VPS after soak.
|
|||
reading secrets, logging into PostgreSQL, deploying, or restarting. Its
|
||||
bounded IAP/SSH path uses a fixed remote command and a maximum five-minute
|
||||
key lifetime, but no live run is currently authorized.
|
||||
- Historical only: the superseded preflight branch records an earlier live
|
||||
observation of `e2-standard-4` on `teleo-staging-europe-west6`
|
||||
(`10.60.0.0/20`) with an external IPv4 attachment. That observation is not
|
||||
current-revision proof and has not been refreshed in this slice. The checker
|
||||
intentionally fails while any public attachment remains.
|
||||
- The older provisioning baseline names `e2-standard-2` and
|
||||
`teleo-staging-subnet`; reconciling that declarative baseline is a separate
|
||||
infrastructure change, not part of this preflight implementation.
|
||||
- Not yet live-proven: staging VM/container engine, IAM/Secret Manager, Cloud
|
||||
SQL effective identity, restart behavior, or model/database parity.
|
||||
|
||||
|
|
|
|||
|
|
@ -32,14 +32,14 @@ CRITICAL_TRACKED_PATHS = (
|
|||
"hermes-agent/leoclean-bin/cloudsql_memory_tool.py",
|
||||
)
|
||||
REGION = package.ZONE.rsplit("-", 1)[0]
|
||||
MACHINE_TYPE = "e2-standard-2"
|
||||
MACHINE_TYPE = "e2-standard-4"
|
||||
MINIMUM_BOOT_DISK_GB = 80
|
||||
MINIMUM_DOCKER_FREE_BYTES = 10 * 1024**3
|
||||
MINIMUM_DOCKER_MAJOR = 24
|
||||
SSH_KEY_LIFETIME = "5m"
|
||||
NETWORK = "teleo-staging-net"
|
||||
SUBNET = "teleo-staging-subnet"
|
||||
SUBNET_CIDR = ipaddress.ip_network("10.70.0.0/24")
|
||||
SUBNET = "teleo-staging-europe-west6"
|
||||
SUBNET_CIDR = ipaddress.ip_network("10.60.0.0/20")
|
||||
CLOUDSQL_INSTANCE = "teleo-pgvector-standby"
|
||||
ARTIFACT_REPOSITORY = "teleo"
|
||||
|
||||
|
|
@ -190,7 +190,7 @@ def _instance_readback(runner: Runner) -> dict[str, Any]:
|
|||
package.PROJECT,
|
||||
"--zone",
|
||||
package.ZONE,
|
||||
"--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts.email,disks,networkInterfaces,tags.items)",
|
||||
"--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts,disks,networkInterfaces,tags.items)",
|
||||
],
|
||||
runner,
|
||||
)
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ def live_fixtures() -> dict[str, object]:
|
|||
"zone": "https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a",
|
||||
"machineType": (
|
||||
"https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a/"
|
||||
"machineTypes/e2-standard-2"
|
||||
"machineTypes/e2-standard-4"
|
||||
),
|
||||
"cpuPlatform": "Intel Broadwell",
|
||||
"serviceAccounts": [
|
||||
|
|
@ -49,9 +49,9 @@ def live_fixtures() -> dict[str, object]:
|
|||
),
|
||||
"subnetwork": (
|
||||
"https://www.googleapis.com/compute/v1/projects/teleo-501523/regions/europe-west6/"
|
||||
"subnetworks/teleo-staging-subnet"
|
||||
"subnetworks/teleo-staging-europe-west6"
|
||||
),
|
||||
"networkIP": "10.70.0.2",
|
||||
"networkIP": "10.60.0.2",
|
||||
"accessConfigs": [],
|
||||
"ipv6AccessConfigs": [],
|
||||
"stackType": "IPV4_ONLY",
|
||||
|
|
@ -71,10 +71,10 @@ def live_fixtures() -> dict[str, object]:
|
|||
],
|
||||
},
|
||||
"subnet": {
|
||||
"name": "teleo-staging-subnet",
|
||||
"name": "teleo-staging-europe-west6",
|
||||
"region": "https://www.googleapis.com/compute/v1/projects/teleo-501523/regions/europe-west6",
|
||||
"network": "https://www.googleapis.com/compute/v1/projects/teleo-501523/global/networks/teleo-staging-net",
|
||||
"ipCidrRange": "10.70.0.0/24",
|
||||
"ipCidrRange": "10.60.0.0/20",
|
||||
"privateIpGoogleAccess": True,
|
||||
},
|
||||
"artifact": {
|
||||
|
|
@ -202,7 +202,7 @@ def test_exact_read_only_preflight_passes_without_exposing_private_ip() -> None:
|
|||
"teleo-501523",
|
||||
"--zone",
|
||||
"europe-west6-a",
|
||||
"--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts.email,disks,networkInterfaces,tags.items)",
|
||||
"--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts,disks,networkInterfaces,tags.items)",
|
||||
],
|
||||
[
|
||||
"gcloud",
|
||||
|
|
@ -222,7 +222,7 @@ def test_exact_read_only_preflight_passes_without_exposing_private_ip() -> None:
|
|||
"networks",
|
||||
"subnets",
|
||||
"describe",
|
||||
"teleo-staging-subnet",
|
||||
"teleo-staging-europe-west6",
|
||||
"--project",
|
||||
"teleo-501523",
|
||||
"--region",
|
||||
|
|
|
|||
Loading…
Reference in a new issue