ScobleClaw monorepo
Find a file
CoS a453892fd1 fix(strimzi): pin operator deployment to n97-mini (K3s pod-network bug workaround)
The Strimzi cluster operator's admin client was timing out with
'No resolvable bootstrap urls given in bootstrap.servers' and
'KafkaQuorumCheck cannot be initialised' errors. Investigation showed:

- Operator pods scheduled to n97-node-2 (the worker) have broken outbound
  network connectivity: cannot reach kube-dns (10.43.0.10:53), in-cluster
  service IPs, or cross-node pod IPs.
- Operator pods scheduled to n97-mini (the control plane) have full network
  connectivity and reconcile both Kafka clusters successfully.
- Fresh busybox pods in the same namespace can reach everything — the bug
  is specific to operator pods (and possibly pods that started when the
  operator was at full leader+controllers state).

This is the same pod-specific K3s networking bug that bit the camel-k
operator in marcus/engineering#60, but the Strimzi operator can't use
the camel-k fix (hostNetwork: true + ClusterFirstWithHostNet) because
Strimzi hard-codes its health probe port to 8080, which is already bound
on both nodes (kuma + something else on n97-mini, IPv6 wildcard on
n97-node-2).

Fix: pin the operator to n97-mini via spec.nodeName. This is a workaround
for the K3s pod-specific network bug; the right fix is in K3s itself.
When that bug is fixed upstream, the nodeName can be removed.

Changes:
- strimzi-operator-pinned.yaml: complete operator deployment manifest with
  nodeName, hostAliases for the bootstrap FQDN, no UseKRaft feature gate
  (0.45.2 doesn't support it), replicaCount: 1 with Recreate strategy.
- Recreate strategy is mandatory: any rolling update would still hit the
  same bug because the new pod would still be scheduled to n97-node-2
  during the brief window before nodeName takes effect.

Verification (2026-06-08 00:56 UTC):
- Operator pod 'strimzi-cluster-operator-9bd6cbcd6-tqgjb' on n97-mini
  is the leader, 1/1 Running, 0 restarts.
- Both Kafka CRs (kafka/kafka, scobleclaw/scoble-kafka) report READY=True.
- E2E test: produced 8 messages via scoble-kafka:9092 alias, all consumed
  back successfully.

Refs: marcus/engineering#62
2026-06-07 17:57:47 -07:00
docs JUDGE-ARCH: Formalize actor-judge authorization layer 2026-05-23 19:31:30 -07:00
kubeclaw feat(pkg/floxenv): add Flox environment lifecycle management package 2026-05-29 23:40:22 -07:00
pkg/floxenv feat(pkg/floxenv): add Flox environment lifecycle management package 2026-05-29 23:40:22 -07:00
pool-manager feat(pool-manager): add /healthz handler for k8s liveness/readiness probes (#56) 2026-06-07 07:21:34 -07:00
scoble-policy/audit-sink fix(strimzi): pin operator deployment to n97-mini (K3s pod-network bug workaround) 2026-06-07 17:57:47 -07:00
.gitignore feat(pkg/floxenv): add Flox environment lifecycle management package 2026-05-29 23:40:22 -07:00
coach-pattern-analysis.md Coach pattern analysis: root cause analysis of recurring 5/10 repetitive behavior critiques 2026-05-23 19:27:14 -07:00
go.mod feat(pkg/floxenv): add Flox environment lifecycle management package 2026-05-29 23:40:22 -07:00
README.md feat(pkg/floxenv): add Flox environment lifecycle management package 2026-05-29 23:40:22 -07:00

floxenv

Go package for managing Flox environment lifecycles via flox activate --detach.

Features

  • Activate — start a Flox environment and return an envID + PID.
  • Deactivate — graceful shutdown with SIGTERM then SIGKILL after a 10-second grace period.
  • IsAlive — lightweight, non-privileged process-existence check using zero-signal delivery.
  • Dev-mode stub — transparently falls back to a long-running shell command when flox is not installed (or when FLOXENV_DEV_MODE=1 is set), useful for CI and local development.

Installation

go get github.com/marcus/scobleclaw/pkg/floxenv

Usage

package main

import (
    "fmt"
    "log"

    "github.com/marcus/scobleclaw/pkg/floxenv"
)

func main() {
    r := floxenv.NewRegistry()

    envID, pid, err := r.Activate("/path/to/env/.flox/env/manifest.toml")
    if err != nil {
        log.Fatal(err)
    }
    fmt.Printf("activated %s (pid %d)\n", envID, pid)

    // later …
    if err := r.Deactivate(envID, pid); err != nil {
        log.Fatal(err)
    }
}

Dev mode

When the flox binary is absent, or when FLOXENV_DEV_MODE=1 is set in the environment, the package runs a lightweight stub that forks a shell sleep process instead of invoking flox activate. This keeps dependent tests green in environments where Flox is not available.

Running tests

Unit tests (uses the dev-mode stub):

go test ./pkg/floxenv

Integration tests (requires a working Flox installation):

go test -tags=integration ./pkg/floxenv

API

Function Signature Description
NewRegistry () *Registry Create a new registry, auto-detecting dev mode.
(*Registry) Activate (manifestPath string) (envID string, pid int, err error) Activate a Flox environment.
(*Registry) Deactivate (envID string, pid int) error Shutdown an active environment.
IsAlive (pid int) bool Non-privileged process existence check.
(*Registry) List () []Info Snapshot of tracked environments.

License

MIT