titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

WIP: monitoring(titan): capacity guardrails for titan-20/21/22 audit (final) #53

Draft
hermes-automation wants to merge 5 commits from feature/t_26da4c88-titan-capacity-guardrails-v4 into main
pull from: feature/t_26da4c88-titan-capacity-guardrails-v4
merge into: titan:main
Conversation 0 Commits 5 Files Changed 5 +13 -1
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 3c6301d581 - Show all commits

14
docs/titan_20_21_22_capacity_optimization.md
View File

@ -430,7 +430,19 @@ scraped in this cluster (`node_exporter`, `DCGM`, cAdvisor `container_cpu_cfs_*`
This session cannot apply the alert/dashboard PR, cannot trigger a synthetic
transcode, and cannot restart or exec into `jellyfin` (RBAC is `get/list/
watch` only, confirmed). As of this revision, Jenkins/VictoriaMetrics/Wger
watch` only, confirmed). Checked three independent avenues before concluding
this, not just RBAC: (1) `kubectl auth can-i create jobs/pods -n jellyfin`
and `create pods -n jenkins` both `no`, `get/list secrets` cluster-wide and
in `jellyfin` both `no` — no path to launch a load-gen Job or read a
Jellyfin API key from its Vault-injected secret; (2) VictoriaMetrics has no
`jellyfin_*`/session/transcode-named series at all (`/api/v1/label/__name__/values`
checked directly) — only DCGM/cAdvisor/node_exporter give any Jellyfin-load
signal; (3) `jellyfin.jellyfin.svc.cluster.local`'s public, unauthenticated
`/System/Info/Public` responds `200` (reachable in-cluster) but `/Sessions`
correctly requires an API key (`401`) — there is no read-only way to see
active playback/transcode sessions without credentials this session does
not have and should not attempt to obtain. As of this revision,
Jenkins/VictoriaMetrics/Wger
have been co-resident on titan-22 for ~1-3h (§4a) with zero Jellyfin impact,
but zero GPU activity in that window either — so the one validation that
actually matters (an active hardware transcode overlapping with real