titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

docs(titan): record three independent checks ruling out live validation

Browse Source 
Strengthens report §8: beyond the RBAC can-i output already cited, checked
(1) create verbs for jobs/pods and secrets read access (all no), (2) VM
for any jellyfin/session/transcode-named metric series (none exist), and
(3) Jellyfin's own API directly (public info reachable, /Sessions
correctly 401s without a key this session doesn't have). Confirms the
live transcode-under-load validation gap is a hard, verified constraint,
not an unexplored option.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Hermes Agent 2026-08-23 15:04:20 +00:00
parent 16c399995b
commit 3c6301d581
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/titan_20_21_22_capacity_optimization.md
View File

@ -430,7 +430,19 @@ scraped in this cluster (`node_exporter`, `DCGM`, cAdvisor `container_cpu_cfs_*`
This session cannot apply the alert/dashboard PR, cannot trigger a synthetic
transcode, and cannot restart or exec into `jellyfin` (RBAC is `get/list/
watch` only, confirmed). As of this revision, Jenkins/VictoriaMetrics/Wger
watch` only, confirmed). Checked three independent avenues before concluding
this, not just RBAC: (1) `kubectl auth can-i create jobs/pods -n jellyfin`
and `create pods -n jenkins` both `no`, `get/list secrets` cluster-wide and
in `jellyfin` both `no` — no path to launch a load-gen Job or read a
Jellyfin API key from its Vault-injected secret; (2) VictoriaMetrics has no
`jellyfin_*`/session/transcode-named series at all (`/api/v1/label/__name__/values`
checked directly) — only DCGM/cAdvisor/node_exporter give any Jellyfin-load
signal; (3) `jellyfin.jellyfin.svc.cluster.local`'s public, unauthenticated
`/System/Info/Public` responds `200` (reachable in-cluster) but `/Sessions`
correctly requires an API key (`401`) — there is no read-only way to see
active playback/transcode sessions without credentials this session does
not have and should not attempt to obtain. As of this revision,
Jenkins/VictoriaMetrics/Wger
have been co-resident on titan-22 for ~1-3h (§4a) with zero Jellyfin impact,
but zero GPU activity in that window either — so the one validation that
actually matters (an active hardware transcode overlapping with real