From 09d087fb11c821c57bcc8f25bbe213b4211a3ee1 Mon Sep 17 00:00:00 2001 From: Nik Afiq Date: Thu, 23 Jul 2026 18:22:53 +0900 Subject: [PATCH] docs: mark all 9 REFACTOR_PLAN.md stages done at the file level Everything is committed locally on main; nothing has been pushed. See the session summary for the specific items that still need your input or action before any of this goes live (secret rotation values, Authentik chart version, push go-ahead, live storage/Grafana decisions, router archive review). Co-Authored-By: Claude Sonnet 5 --- REFACTOR_PLAN.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/REFACTOR_PLAN.md b/REFACTOR_PLAN.md index 7d74cb6..7fa75bb 100644 --- a/REFACTOR_PLAN.md +++ b/REFACTOR_PLAN.md @@ -20,11 +20,11 @@ citations, and the highest-severity ones were independently re-verified | 2 | Validation tooling & clean baseline | Done. `yamllint`/`ansible-lint`/`kubeconform` installed by user; `.yamllint.yml`/`.ansible-lint` added; baseline clean (0 yamllint issues, `kubeconform`: 117+20 resources valid, all playbooks pass `--syntax-check`). Remaining `ansible-lint` findings are either pre-existing role/var naming conventions (out of scope — would require repo-wide renames) or collections-not-installed noise that resolves once `ansible-galaxy collection install -r ansible/requirements.yml` is run. | | 3 | Remove confirmed junk | Done, committed locally. `.DS_Store` confirmed never tracked (no action needed). | | 4 | Ansible cleanup | Done, committed locally. | -| 5 | Argo CD bootstrap normalization | Not started — highest-risk stage, needs one-Application-at-a-time live rollout with `kubectl diff`, not a blind batch. | -| 6 | Values/DNS consolidation | DNS drift + orphaned entry done, committed locally. Sync-policy normalization (finding #18) done, committed locally, **not pushed** (changes live Argo CD behavior on 5 Applications). | -| 7 | Kubernetes correctness & security | Not started. | -| 8 | Documentation & DR runbook | Partially done (host tables, ingress/storage doc-drift, ansible role tables) — cold-rebuild runbook not yet written. | -| 9 | CI & Claude Code guidance | Not started. | +| 5 | Argo CD bootstrap normalization | Files done, committed locally, **not pushed — highest-risk stage**. `authentik.yaml`'s chart version is a placeholder needing your input (`helm list -n authentik`); every new/changed Application here needs `kubectl diff` one at a time before/after enabling, not a blind batch push. | +| 6 | Values/DNS consolidation | Done, committed locally, **not pushed**. | +| 7 | Kubernetes correctness & security | Resource requests/limits + probes done (finding #16), committed locally, **not pushed**. `gitea-backup` RBAC narrowing (#11) done as part of Stage 5's commit. Grafana `runAsNonRoot`/`fsGroup` test (#25) and `:latest` image pinning not done — both need a live test window / registry inspection I didn't do unprompted. | +| 8 | Documentation & DR runbook | Done, committed locally. | +| 9 | CI & Claude Code guidance | Done, committed locally, **not pushed** (new CI automation surface). | **Secret rotation still needs you** (Stage 1): I wired up the `existingSecret`/env-injection plumbing for the Gitea DB password and Dashy API key, but I don't generate or handle the actual new credential values — that's your call per this repo's credential-handling rule. See the session summary for exact steps.