Seven minors in sequence, each with the latest patch, exactly as the
documentation requires. Every step was verified before the next one started:
three deployments on the new version and fifteen certificates Ready.
The measured point of the exercise: v1.14.0 carried 8 critical and 128 high
findings across controller, webhook and cainjector; v1.21.1 carries 0 and 24.
The next scan round will show it in the dashboard rather than in this message.
This is the step with the RBAC narrowing: the cert-manager-edit aggregate
ClusterRole no longer grants create on challenges or create, patch and update on
orders. Those resources belong to cert-manager's own ACME workflow. Nothing here
is bound to that ClusterRole — zero bindings across all namespaces — so no
tooling loses a permission it was using.
Previous step verified: three deployments on v1.19.6, fifteen certificates
Ready.
This is the step with the ACME metric label change: the high-cardinality path
label on certmanager_acme_client_request_count and _duration_seconds is replaced
by a bounded action label. Nothing here uses those metrics — neither the
operating stack's rules nor any dashboard references them — so no dashboard or
alert has to follow.
Previous step verified: three deployments on v1.18.6, fifteen certificates
Ready.
One minor at a time with the latest patch, as the documentation requires. The
previous step is verified: all three deployments on v1.17.4 and fifteen
certificates Ready.
One minor at a time with the latest patch, as the documentation requires. The
previous step is verified: all three deployments on v1.16.5 and fifteen
certificates Ready.
One minor at a time with the latest patch, as the documentation requires. The
previous step is verified: all three deployments on v1.15.5 and fifteen
certificates Ready.
Seven minors behind, and the documentation allows only one minor at a time with
the latest patch of each; skipping is offered solely as uninstall and reinstall.
Measured on the images rather than assumed: v1.14.0 carries 8 critical and 128
high findings across controller, webhook and cainjector; v1.21.1 carries 0 and
24. Both potentially breaking changes on the way were checked against our state
and do not apply — no dashboard or alert uses the ACME metrics whose label
changes, and nothing is bound to the cert-manager-edit ClusterRole whose
permissions narrow.
Fifteen certificates are Ready before this starts; that is the check after every
step.
rohana.axion1337.de resolves publicly to a Hetzner address, while the host
is reachable over the private network at 10.0.0.3 - and serves a valid
Let's Encrypt certificate for that very name there, measured with full
verification. Without an internal pointer every access from the cluster
leaves it for no reason and needs an outbound exception.
A dedicated zone rather than a second hosts block: the Corefile already
runs hosts /etc/coredns/NodeHosts in the main block, so a second one there
would collide. The .server import at the end of the Corefile takes a zone
of its own, and the reload plugin picks the change up without a restart.
The price is in the file, not in a commit message nobody rereads: two paths
become one. If 10.0.0.3 is down, rohana is unreachable from the cluster
although the public route would work, and the failure looks like "Gitea is
gone" rather than "the private path is gone". The comment says where to
look first.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F2Q4Ri8NGwyTZzScvKnWFM
Almost every tracked file in the repo had drifted to mode 777 on disk
(only files created fresh this session were unaffected), and a chunk of
that drift had already been committed as spurious +x bits on plain
YAML/Markdown files (authentik.yaml, kustomization.yaml, coturn.yaml,
element-server-suite.yaml, TASKS.md, install.md, etc.) - none of these
need to be executable. Restored to 644 for regular files, 755 only for
actual scripts (postCreateCommand.sh, docker-init.sh, install-hooks.sh,
pre-commit hook, element-setup-linux.sh).
Also found element-setup-macos.command was missing +x despite having a
shebang and being meant for double-click execution on macOS - fixed.
Added .gitignore for .DS_Store and .claude/ and stopped tracking the five
.DS_Store files that had been committed by accident.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Thore Cimbal
Scrublord MacBad