docs(milestone): complete v0.2 — infrastructure-as-code + kubernetes
---ci--- project: atelier phase: 5 milestone: v0.2 status: complete requirements: covered: [ATELIER-36, ATELIER-37, ATELIER-38, ATELIER-39, ATELIER-40, ATELIER-41, ATELIER-42, ATELIER-43, ATELIER-44, ATELIER-45, ATELIER-46, ATELIER-47, ATELIER-48, ATELIER-49, ATELIER-50, ATELIER-51, ATELIER-52, ATELIER-53, ATELIER-54, ATELIER-55, ATELIER-56, ATELIER-57, ATELIER-58, ATELIER-59] partial: [] ---/ci---
This commit is contained in:
Jon Chery
@@ -125,6 +125,28 @@ If the task touches a domain, run that domain's checklist:
|
||||
- [ ] Config is in code, not on the server
|
||||
- [ ] Environments are parity (dev = prod modulo data)
|
||||
|
||||
### If Infrastructure as Code (see `domains/infrastructure-as-code/`)
|
||||
- [ ] Configuration is declarative, not scripted (P1)
|
||||
- [ ] Provider versions are pinned, never `latest` (P5)
|
||||
- [ ] State is remote with locking; never committed (P3, P8)
|
||||
- [ ] `plan` is reviewed before every `apply` (P4)
|
||||
- [ ] No secrets in HCL; secrets via providers/stores (P10)
|
||||
- [ ] Modules are versioned; copy-paste replaced by module calls (P6)
|
||||
- [ ] Drift is treated as an incident, not a shortcut (P9)
|
||||
- [ ] Provider credentials scoped per environment, least privilege (P7)
|
||||
|
||||
### If Kubernetes (see `domains/kubernetes/`)
|
||||
- [ ] No bare pods; controllers used (P2)
|
||||
- [ ] Resource requests set on every prod container (P4)
|
||||
- [ ] Liveness/readiness/startup probes defined (P5)
|
||||
- [ ] RBAC bound to ServiceAccounts by intent; no `cluster-admin` (P7)
|
||||
- [ ] No `:latest` image tag in prod (P5 Version Everything)
|
||||
- [ ] StatefulSet PVCs use `volumeClaimTemplates`; `emptyDir` only for scratch (P8)
|
||||
- [ ] ConfigMaps and Secrets separate; secrets not in image (P9)
|
||||
- [ ] Default-deny NetworkPolicy baseline (P6)
|
||||
- [ ] Rollout history retained; rollback tested (P10)
|
||||
- [ ] Namespaces used to bound blast radius; not `default` in prod (P6)
|
||||
|
||||
## Final Gate
|
||||
|
||||
- [ ] Have I read the relevant domain's first-principles?
|
||||
|
||||
+35
-1
@@ -121,6 +121,32 @@ When you see a pattern listed here, it is a defect. Cite the principle it violat
|
||||
| Rebuild per environment | P7 Immutability | Different artifacts |
|
||||
| Snowflake server | P1, P6 | Not reproducible |
|
||||
|
||||
### Infrastructure as Code
|
||||
| Anti-Pattern | Breaches | Why |
|
||||
|--------------|----------|-----|
|
||||
| Unpinned provider (`source` without `version`) | P5 Version Everything | Unversioned drift |
|
||||
| `terraform apply` without a read `plan` | P4 Plan Before Apply | Unreviewed mutation |
|
||||
| Local state in a shared environment | P8 Remote State with Locking | No lock = corruption |
|
||||
| Hardcoded secret in HCL | P10 Secrets Never in Code | Committed secret |
|
||||
| Copy-pasted block instead of a module | P6 Modules Compose | Bug duplicated |
|
||||
| Manual change to a managed resource | P9 Drift is Recoverable | Unreconciled drift |
|
||||
| Admin credentials in CI | P7 Least Privilege Providers | Overbroad grant |
|
||||
| Committed `terraform.tfstate` | P3 State is Truth, P10 | Secret-bearing artifact in repo |
|
||||
|
||||
### Kubernetes
|
||||
| Anti-Pattern | Breaches | Why |
|
||||
|--------------|----------|-----|
|
||||
| Bare pod (no controller) | P2 Pods are Mortal | No recovery/scale |
|
||||
| No resource requests in prod | P4 Requests and Limits | BestEffort, first evicted |
|
||||
| Liveness probe checks a dependency | P5 Probes Drive Health | Cascade restart |
|
||||
| `cluster-admin` bound to a workload | P7 RBAC by Intent | Overbroad grant |
|
||||
| `:latest` image tag in prod | P5 Version Everything | Unversioned drift |
|
||||
| `emptyDir` for data that must persist | P8 Storage is Explicit | Data lost on pod death |
|
||||
| Secrets baked into the image | P9 Config and Secrets Separate | No rotation without rebuild |
|
||||
| `default` namespace in prod | P6 Namespaces Bound Blast Radius | No blast boundary |
|
||||
| Shared PVC across StatefulSet replicas | P8 Storage is Explicit | Concurrent write corruption |
|
||||
| `Delete` reclaim policy on prod storage | P8, P5 Reversibility | PVC delete = data delete |
|
||||
|
||||
## Cross-Cutting Anti-Patterns
|
||||
|
||||
| Anti-Pattern | Breaches | Why |
|
||||
@@ -129,4 +155,12 @@ When you see a pattern listed here, it is a defect. Cite the principle it violat
|
||||
| "It's just a prototype" | C5 (irreversible by default) | Prototypes go to prod |
|
||||
| Copy-paste code | C6 (no composition) | Bug duplicated |
|
||||
| God object | C3, C6 | One thing, many things |
|
||||
| Leaky abstraction | C6, C2 | Hidden coupling |
|
||||
| Leaky abstraction | C6, C2 | Hidden coupling |
|
||||
|
||||
## v0.2 Chaos Anti-Patterns (from IDEATE-13, IDEATE-14)
|
||||
|
||||
| Anti-Pattern | Breaches | Why |
|
||||
|--------------|----------|-----|
|
||||
| Orphaned P-rule (a domain principle with no matrix row) | matrix completeness, C6 | Breaks the conflict-resolution arbiter; the rule has no core trace |
|
||||
| Deployable example artifact (standalone `.tf`/`.yaml` under `examples/`) | PROJECT.md "no runtime code", D-025 | Violates the docs-only contract; examples must be `.md` with fenced code |
|
||||
| Unlisted v0.2 doc (new doc not added to MANIFEST) | manifest rule | Not part of the framework by definition |
|
||||
@@ -59,7 +59,25 @@ A peer review is a second set of eyes on correctness, clarity, and completeness.
|
||||
|
||||
## Domain-Specific (if applicable)
|
||||
|
||||
Run the relevant domain section from `agent-checklist.md` (UI/UX, API, Security, Data, Testing, Performance, Observability, Errors, Concurrency, DevOps). The author ran it; the reviewer verifies.
|
||||
Run the relevant domain section from `agent-checklist.md` (UI/UX, API, Security, Data, Testing, Performance, Observability, Errors, Concurrency, DevOps, Infrastructure as Code, Kubernetes). The author ran it; the reviewer verifies.
|
||||
|
||||
### If Infrastructure as Code
|
||||
- [ ] Are providers pinned and modules version-pinned? (no `latest`)
|
||||
- [ ] Is state remote with locking, not committed?
|
||||
- [ ] Is the `plan` diff reviewed, not just the config?
|
||||
- [ ] Are secrets via providers/stores, not in HCL?
|
||||
- [ ] Are credentials scoped per environment?
|
||||
- [ ] Is drift being treated as an incident?
|
||||
|
||||
### If Kubernetes
|
||||
- [ ] Are controllers used, not bare pods?
|
||||
- [ ] Are resource requests set on every prod container?
|
||||
- [ ] Are probes defined and checking the workload, not its dependencies?
|
||||
- [ ] Is RBAC least-privilege, bound to ServiceAccounts by intent?
|
||||
- [ ] Are image tags pinned, not `:latest`?
|
||||
- [ ] Is persistent storage explicit (PVC + reclaim policy decided)?
|
||||
- [ ] Are ConfigMaps and Secrets separate?
|
||||
- [ ] Is the rollback path tested, not assumed?
|
||||
|
||||
## Review Etiquette
|
||||
|
||||
|
||||
Reference in New Issue
Block a user