From 3c6301d581bef0a1fce5284f9a28c1cf4c4a99ad Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Sun, 23 Aug 2026 15:04:20 +0000 Subject: [PATCH] docs(titan): record three independent checks ruling out live validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Strengthens report §8: beyond the RBAC can-i output already cited, checked (1) create verbs for jobs/pods and secrets read access (all no), (2) VM for any jellyfin/session/transcode-named metric series (none exist), and (3) Jellyfin's own API directly (public info reachable, /Sessions correctly 401s without a key this session doesn't have). Confirms the live transcode-under-load validation gap is a hard, verified constraint, not an unexplored option. Co-Authored-By: Claude Sonnet 5 --- docs/titan_20_21_22_capacity_optimization.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/docs/titan_20_21_22_capacity_optimization.md b/docs/titan_20_21_22_capacity_optimization.md index 524a6a24..7330f49f 100644 --- a/docs/titan_20_21_22_capacity_optimization.md +++ b/docs/titan_20_21_22_capacity_optimization.md @@ -430,7 +430,19 @@ scraped in this cluster (`node_exporter`, `DCGM`, cAdvisor `container_cpu_cfs_*` This session cannot apply the alert/dashboard PR, cannot trigger a synthetic transcode, and cannot restart or exec into `jellyfin` (RBAC is `get/list/ -watch` only, confirmed). As of this revision, Jenkins/VictoriaMetrics/Wger +watch` only, confirmed). Checked three independent avenues before concluding +this, not just RBAC: (1) `kubectl auth can-i create jobs/pods -n jellyfin` +and `create pods -n jenkins` both `no`, `get/list secrets` cluster-wide and +in `jellyfin` both `no` — no path to launch a load-gen Job or read a +Jellyfin API key from its Vault-injected secret; (2) VictoriaMetrics has no +`jellyfin_*`/session/transcode-named series at all (`/api/v1/label/__name__/values` +checked directly) — only DCGM/cAdvisor/node_exporter give any Jellyfin-load +signal; (3) `jellyfin.jellyfin.svc.cluster.local`'s public, unauthenticated +`/System/Info/Public` responds `200` (reachable in-cluster) but `/Sessions` +correctly requires an API key (`401`) — there is no read-only way to see +active playback/transcode sessions without credentials this session does +not have and should not attempt to obtain. As of this revision, +Jenkins/VictoriaMetrics/Wger have been co-resident on titan-22 for ~1-3h (§4a) with zero Jellyfin impact, but zero GPU activity in that window either — so the one validation that actually matters (an active hardware transcode overlapping with real