diff --git a/.gitignore b/.gitignore index 3c4f2d2..2518f96 100644 --- a/.gitignore +++ b/.gitignore @@ -8,6 +8,8 @@ kcl *.k old_config +docs/book + # === SEPARATE REPOSITORIES === # These are tracked in their own repos or pulled from external sources extensions/ diff --git a/docs/book/FontAwesome/fonts/fontawesome-webfont.svg b/docs/book/FontAwesome/fonts/fontawesome-webfont.svg index 855c845..52c0773 100644 --- a/docs/book/FontAwesome/fonts/fontawesome-webfont.svg +++ b/docs/book/FontAwesome/fonts/fontawesome-webfont.svg @@ -8,7 +8,7 @@ Copyright Dave Gandy 2016. All rights reserved. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/book/clipboard.min.js b/docs/book/clipboard.min.js index 02c549e..99561a0 100644 --- a/docs/book/clipboard.min.js +++ b/docs/book/clipboard.min.js @@ -1,7 +1,7 @@ /*! * clipboard.js v2.0.4 * https://zenorocha.github.io/clipboard.js - * + * * Licensed MIT © Zeno Rocha */ -!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?exports.ClipboardJS=e():t.ClipboardJS=e()}(this,function(){return function(n){var o={};function r(t){if(o[t])return o[t].exports;var e=o[t]={i:t,l:!1,exports:{}};return n[t].call(e.exports,e,e.exports,r),e.l=!0,e.exports}return r.m=n,r.c=o,r.d=function(t,e,n){r.o(t,e)||Object.defineProperty(t,e,{enumerable:!0,get:n})},r.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},r.t=function(e,t){if(1&t&&(e=r(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(r.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)r.d(n,o,function(t){return e[t]}.bind(null,o));return n},r.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return r.d(e,"a",e),e},r.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},r.p="",r(r.s=0)}([function(t,e,n){"use strict";var r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},i=function(){function o(t,e){for(var n=0;no;o++){for(var r=e[o],s=0;i>s&&(r=this._queue[s](r,o,e),void 0!==r&&null!==r);s++);void 0!==r&&null!==r&&t.push(r)}return t},t.Pipeline.prototype.reset=function(){this._queue=[]},t.Pipeline.prototype.get=function(){return this._queue},t.Pipeline.prototype.toJSON=function(){return this._queue.map(function(e){return t.Pipeline.warnIfFunctionNotRegistered(e),e.label})},t.Index=function(){this._fields=[],this._ref="id",this.pipeline=new t.Pipeline,this.documentStore=new t.DocumentStore,this.index={},this.eventEmitter=new t.EventEmitter,this._idfCache={},this.on("add","remove","update",function(){this._idfCache={}}.bind(this))},t.Index.prototype.on=function(){var e=Array.prototype.slice.call(arguments);return this.eventEmitter.addListener.apply(this.eventEmitter,e)},t.Index.prototype.off=function(e,t){return this.eventEmitter.removeListener(e,t)},t.Index.load=function(e){e.version!==t.version&&t.utils.warn("version mismatch: current "+t.version+" importing "+e.version);var n=new this;n._fields=e.fields,n._ref=e.ref,n.documentStore=t.DocumentStore.load(e.documentStore),n.pipeline=t.Pipeline.load(e.pipeline),n.index={};for(var i in e.index)n.index[i]=t.InvertedIndex.load(e.index[i]);return n},t.Index.prototype.addField=function(e){return this._fields.push(e),this.index[e]=new t.InvertedIndex,this},t.Index.prototype.setRef=function(e){return this._ref=e,this},t.Index.prototype.saveDocument=function(e){return this.documentStore=new t.DocumentStore(e),this},t.Index.prototype.addDoc=function(e,n){if(e){var n=void 0===n?!0:n,i=e[this._ref];this.documentStore.addDoc(i,e),this._fields.forEach(function(n){var o=this.pipeline.run(t.tokenizer(e[n]));this.documentStore.addFieldLength(i,n,o.length);var r={};o.forEach(function(e){e in r?r[e]+=1:r[e]=1},this);for(var s in r){var u=r[s];u=Math.sqrt(u),this.index[n].addToken(s,{ref:i,tf:u})}},this),n&&this.eventEmitter.emit("add",e,this)}},t.Index.prototype.removeDocByRef=function(e){if(e&&this.documentStore.isDocStored()!==!1&&this.documentStore.hasDoc(e)){var t=this.documentStore.getDoc(e);this.removeDoc(t,!1)}},t.Index.prototype.removeDoc=function(e,n){if(e){var n=void 0===n?!0:n,i=e[this._ref];this.documentStore.hasDoc(i)&&(this.documentStore.removeDoc(i),this._fields.forEach(function(n){var o=this.pipeline.run(t.tokenizer(e[n]));o.forEach(function(e){this.index[n].removeToken(e,i)},this)},this),n&&this.eventEmitter.emit("remove",e,this))}},t.Index.prototype.updateDoc=function(e,t){var t=void 0===t?!0:t;this.removeDocByRef(e[this._ref],!1),this.addDoc(e,!1),t&&this.eventEmitter.emit("update",e,this)},t.Index.prototype.idf=function(e,t){var n="@"+t+"/"+e;if(Object.prototype.hasOwnProperty.call(this._idfCache,n))return this._idfCache[n];var i=this.index[t].getDocFreq(e),o=1+Math.log(this.documentStore.length/(i+1));return this._idfCache[n]=o,o},t.Index.prototype.getFields=function(){return this._fields.slice()},t.Index.prototype.search=function(e,n){if(!e)return[];e="string"==typeof e?{any:e}:JSON.parse(JSON.stringify(e));var i=null;null!=n&&(i=JSON.stringify(n));for(var o=new t.Configuration(i,this.getFields()).get(),r={},s=Object.keys(e),u=0;u0&&t.push(e);for(var i in n)"docs"!==i&&"df"!==i&&this.expandToken(e+i,t,n[i]);return t},t.InvertedIndex.prototype.toJSON=function(){return{root:this.root}},t.Configuration=function(e,n){var e=e||"";if(void 0==n||null==n)throw new Error("fields should not be null");this.config={};var i;try{i=JSON.parse(e),this.buildUserConfig(i,n)}catch(o){t.utils.warn("user configuration parse failed, will use default configuration"),this.buildDefaultConfig(n)}},t.Configuration.prototype.buildDefaultConfig=function(e){this.reset(),e.forEach(function(e){this.config[e]={boost:1,bool:"OR",expand:!1}},this)},t.Configuration.prototype.buildUserConfig=function(e,n){var i="OR",o=!1;if(this.reset(),"bool"in e&&(i=e.bool||i),"expand"in e&&(o=e.expand||o),"fields"in e)for(var r in e.fields)if(n.indexOf(r)>-1){var s=e.fields[r],u=o;void 0!=s.expand&&(u=s.expand),this.config[r]={boost:s.boost||0===s.boost?s.boost:1,bool:s.bool||i,expand:u}}else t.utils.warn("field name in user configuration not found in index instance fields");else this.addAllFields2UserConfig(i,o,n)},t.Configuration.prototype.addAllFields2UserConfig=function(e,t,n){n.forEach(function(n){this.config[n]={boost:1,bool:e,expand:t}},this)},t.Configuration.prototype.get=function(){return this.config},t.Configuration.prototype.reset=function(){this.config={}},lunr.SortedSet=function(){this.length=0,this.elements=[]},lunr.SortedSet.load=function(e){var t=new this;return t.elements=e,t.length=e.length,t},lunr.SortedSet.prototype.add=function(){var e,t;for(e=0;e1;){if(r===e)return o;e>r&&(t=o),r>e&&(n=o),i=n-t,o=t+Math.floor(i/2),r=this.elements[o]}return r===e?o:-1},lunr.SortedSet.prototype.locationFor=function(e){for(var t=0,n=this.elements.length,i=n-t,o=t+Math.floor(i/2),r=this.elements[o];i>1;)e>r&&(t=o),r>e&&(n=o),i=n-t,o=t+Math.floor(i/2),r=this.elements[o];return r>e?o:e>r?o+1:void 0},lunr.SortedSet.prototype.intersect=function(e){for(var t=new lunr.SortedSet,n=0,i=0,o=this.length,r=e.length,s=this.elements,u=e.elements;;){if(n>o-1||i>r-1)break;s[n]!==u[i]?s[n]u[i]&&i++:(t.add(s[n]),n++,i++)}return t},lunr.SortedSet.prototype.clone=function(){var e=new lunr.SortedSet;return e.elements=this.toArray(),e.length=e.elements.length,e},lunr.SortedSet.prototype.union=function(e){var t,n,i;this.length>=e.length?(t=this,n=e):(t=e,n=this),i=t.clone();for(var o=0,r=n.toArray();oo;o++){for(var r=e[o],s=0;i>s&&(r=this._queue[s](r,o,e),void 0!==r&&null!==r);s++);void 0!==r&&null!==r&&t.push(r)}return t},t.Pipeline.prototype.reset=function(){this._queue=[]},t.Pipeline.prototype.get=function(){return this._queue},t.Pipeline.prototype.toJSON=function(){return this._queue.map(function(e){return t.Pipeline.warnIfFunctionNotRegistered(e),e.label})},t.Index=function(){this._fields=[],this._ref="id",this.pipeline=new t.Pipeline,this.documentStore=new t.DocumentStore,this.index={},this.eventEmitter=new t.EventEmitter,this._idfCache={},this.on("add","remove","update",function(){this._idfCache={}}.bind(this))},t.Index.prototype.on=function(){var e=Array.prototype.slice.call(arguments);return this.eventEmitter.addListener.apply(this.eventEmitter,e)},t.Index.prototype.off=function(e,t){return this.eventEmitter.removeListener(e,t)},t.Index.load=function(e){e.version!==t.version&&t.utils.warn("version mismatch: current "+t.version+" importing "+e.version);var n=new this;n._fields=e.fields,n._ref=e.ref,n.documentStore=t.DocumentStore.load(e.documentStore),n.pipeline=t.Pipeline.load(e.pipeline),n.index={};for(var i in e.index)n.index[i]=t.InvertedIndex.load(e.index[i]);return n},t.Index.prototype.addField=function(e){return this._fields.push(e),this.index[e]=new t.InvertedIndex,this},t.Index.prototype.setRef=function(e){return this._ref=e,this},t.Index.prototype.saveDocument=function(e){return this.documentStore=new t.DocumentStore(e),this},t.Index.prototype.addDoc=function(e,n){if(e){var n=void 0===n?!0:n,i=e[this._ref];this.documentStore.addDoc(i,e),this._fields.forEach(function(n){var o=this.pipeline.run(t.tokenizer(e[n]));this.documentStore.addFieldLength(i,n,o.length);var r={};o.forEach(function(e){e in r?r[e]+=1:r[e]=1},this);for(var s in r){var u=r[s];u=Math.sqrt(u),this.index[n].addToken(s,{ref:i,tf:u})}},this),n&&this.eventEmitter.emit("add",e,this)}},t.Index.prototype.removeDocByRef=function(e){if(e&&this.documentStore.isDocStored()!==!1&&this.documentStore.hasDoc(e)){var t=this.documentStore.getDoc(e);this.removeDoc(t,!1)}},t.Index.prototype.removeDoc=function(e,n){if(e){var n=void 0===n?!0:n,i=e[this._ref];this.documentStore.hasDoc(i)&&(this.documentStore.removeDoc(i),this._fields.forEach(function(n){var o=this.pipeline.run(t.tokenizer(e[n]));o.forEach(function(e){this.index[n].removeToken(e,i)},this)},this),n&&this.eventEmitter.emit("remove",e,this))}},t.Index.prototype.updateDoc=function(e,t){var t=void 0===t?!0:t;this.removeDocByRef(e[this._ref],!1),this.addDoc(e,!1),t&&this.eventEmitter.emit("update",e,this)},t.Index.prototype.idf=function(e,t){var n="@"+t+"/"+e;if(Object.prototype.hasOwnProperty.call(this._idfCache,n))return this._idfCache[n];var i=this.index[t].getDocFreq(e),o=1+Math.log(this.documentStore.length/(i+1));return this._idfCache[n]=o,o},t.Index.prototype.getFields=function(){return this._fields.slice()},t.Index.prototype.search=function(e,n){if(!e)return[];e="string"==typeof e?{any:e}:JSON.parse(JSON.stringify(e));var i=null;null!=n&&(i=JSON.stringify(n));for(var o=new t.Configuration(i,this.getFields()).get(),r={},s=Object.keys(e),u=0;u0&&t.push(e);for(var i in n)"docs"!==i&&"df"!==i&&this.expandToken(e+i,t,n[i]);return t},t.InvertedIndex.prototype.toJSON=function(){return{root:this.root}},t.Configuration=function(e,n){var e=e||"";if(void 0==n||null==n)throw new Error("fields should not be null");this.config={};var i;try{i=JSON.parse(e),this.buildUserConfig(i,n)}catch(o){t.utils.warn("user configuration parse failed, will use default configuration"),this.buildDefaultConfig(n)}},t.Configuration.prototype.buildDefaultConfig=function(e){this.reset(),e.forEach(function(e){this.config[e]={boost:1,bool:"OR",expand:!1}},this)},t.Configuration.prototype.buildUserConfig=function(e,n){var i="OR",o=!1;if(this.reset(),"bool"in e&&(i=e.bool||i),"expand"in e&&(o=e.expand||o),"fields"in e)for(var r in e.fields)if(n.indexOf(r)>-1){var s=e.fields[r],u=o;void 0!=s.expand&&(u=s.expand),this.config[r]={boost:s.boost||0===s.boost?s.boost:1,bool:s.bool||i,expand:u}}else t.utils.warn("field name in user configuration not found in index instance fields");else this.addAllFields2UserConfig(i,o,n)},t.Configuration.prototype.addAllFields2UserConfig=function(e,t,n){n.forEach(function(n){this.config[n]={boost:1,bool:e,expand:t}},this)},t.Configuration.prototype.get=function(){return this.config},t.Configuration.prototype.reset=function(){this.config={}},lunr.SortedSet=function(){this.length=0,this.elements=[]},lunr.SortedSet.load=function(e){var t=new this;return t.elements=e,t.length=e.length,t},lunr.SortedSet.prototype.add=function(){var e,t;for(e=0;e1;){if(r===e)return o;e>r&&(t=o),r>e&&(n=o),i=n-t,o=t+Math.floor(i/2),r=this.elements[o]}return r===e?o:-1},lunr.SortedSet.prototype.locationFor=function(e){for(var t=0,n=this.elements.length,i=n-t,o=t+Math.floor(i/2),r=this.elements[o];i>1;)e>r&&(t=o),r>e&&(n=o),i=n-t,o=t+Math.floor(i/2),r=this.elements[o];return r>e?o:e>r?o+1:void 0},lunr.SortedSet.prototype.intersect=function(e){for(var t=new lunr.SortedSet,n=0,i=0,o=this.length,r=e.length,s=this.elements,u=e.elements;;){if(n>o-1||i>r-1)break;s[n]!==u[i]?s[n]u[i]&&i++:(t.add(s[n]),n++,i++)}return t},lunr.SortedSet.prototype.clone=function(){var e=new lunr.SortedSet;return e.elements=this.toArray(),e.length=e.elements.length,e},lunr.SortedSet.prototype.union=function(e){var t,n,i;this.length>=e.length?(t=this,n=e):(t=e,n=this),i=t.clone();for(var o=0,r=n.toArray();o infra/k8s-cluster.ncl <<\'EOF\'\\n{ metadata = { name = \\"k8s-prod\\" provider = \\"upcloud\\" environment = \\"production\\" version = \\"1.0.0\\" } infrastructure = { servers = [ { name = \\"k8s-control-01\\" plan = \\"medium\\" # 4 CPU, 8 GB RAM role = \\"control\\" zone = \\"de-fra1\\" disk_size_gb = 50 backup_enabled = true } { name = \\"k8s-worker-01\\" plan = \\"large\\" # 8 CPU, 16 GB RAM role = \\"worker\\" zone = \\"de-fra1\\" disk_size_gb = 100 backup_enabled = true } { name = \\"k8s-worker-02\\" plan = \\"large\\" role = \\"worker\\" zone = \\"de-fra1\\" disk_size_gb = 100 backup_enabled = true } ] } services = { taskservs = [ \\"containerd\\" # Container runtime (dependency) \\"etcd\\" # Key-value store (dependency) \\"kubernetes\\" # Core orchestration \\"cilium\\" # CNI networking \\"rook-ceph\\" # Persistent storage ] } kubernetes = { version = \\"1.28.0\\" pod_cidr = \\"10.244.0.0/16\\" service_cidr = \\"10.96.0.0/12\\" container_runtime = \\"containerd\\" cri_socket = \\"/run/containerd/containerd.sock\\" } networking = { cni = \\"cilium\\" enable_network_policy = true enable_encryption = true } storage = { provider = \\"rook-ceph\\" replicas = 3 storage_class = \\"ceph-rbd\\" }\\n}\\nEOF","breadcrumbs":"First Deployment » Define Nickel Schema","id":"101","title":"Define Nickel Schema"},"1010":{"body":"Schedule during maintenance windows Test in staging first Communicate with team Have rollback plan ready","breadcrumbs":"Upgrade » 1. Plan Upgrades","id":"1010","title":"1. Plan Upgrades"},"1011":{"body":"# Complete backup before upgrade\\nprovisioning workspace backup --compress\\nprovisioning config backup\\nprovisioning state backup","breadcrumbs":"Upgrade » 2. Backup Everything","id":"1011","title":"2. Backup Everything"},"1012":{"body":"# Use side-by-side upgrade to test\\nprovisioning upgrade --staging\\nprovisioning test suite","breadcrumbs":"Upgrade » 3. Test Before Upgrading","id":"1012","title":"3. Test Before Upgrading"},"1013":{"body":"# Watch orchestrator\\nprovisioning orchestrator status --watch # Monitor platform health\\nprovisioning platform monitor # Check logs\\ntail -f ~/.provisioning/logs/provisioning.log","breadcrumbs":"Upgrade » 4. Monitor After Upgrade","id":"1013","title":"4. Monitor After Upgrade"},"1014":{"body":"# Record what changed\\nprovisioning upgrade --changelog > UPGRADE.md # Update team documentation\\n# Update runbooks\\n# Update dashboards","breadcrumbs":"Upgrade » 5. Document Changes","id":"1014","title":"5. Document Changes"},"1015":{"body":"","breadcrumbs":"Upgrade » Upgrade Policies","id":"1015","title":"Upgrade Policies"},"1016":{"body":"Enable automatic updates: # ~/.config/provisioning/user_config.yaml\\nupgrade: auto_update: true check_interval: \\"daily\\" update_channel: \\"stable\\" auto_backup: true","breadcrumbs":"Upgrade » Automatic Updates","id":"1016","title":"Automatic Updates"},"1017":{"body":"Choose update channel: # Stable releases (recommended)\\nprovisioning upgrade --channel stable # Beta releases\\nprovisioning upgrade --channel beta # Development (nightly)\\nprovisioning upgrade --channel development","breadcrumbs":"Upgrade » Update Channels","id":"1017","title":"Update Channels"},"1018":{"body":"Initial Setup - First-time configuration Platform Health - System monitoring Backup & Recovery - Data protection","breadcrumbs":"Upgrade » Related Documentation","id":"1018","title":"Related Documentation"},"1019":{"body":"Common issues, debugging procedures, and resolution strategies for the Provisioning platform.","breadcrumbs":"Troubleshooting » Troubleshooting","id":"1019","title":"Troubleshooting"},"102":{"body":"# Type-check Nickel schema\\nnickel typecheck infra/k8s-cluster.ncl # Validate against provisioning contracts\\nprovisioning validate config --infra k8s-cluster Expected output: Schema validation: PASSED - Syntax: Valid Nickel - Type safety: All contracts satisfied - Dependencies: Resolved (5 taskservs) - Provider: upcloud (credentials found)","breadcrumbs":"First Deployment » Validate Schema","id":"102","title":"Validate Schema"},"1020":{"body":"Run platform diagnostics: # Comprehensive health check\\nprovisioning diagnose # Check specific component\\nprovisioning diagnose --component orchestrator # Generate diagnostic report\\nprovisioning diagnose --report /tmp/diagnostics.txt","breadcrumbs":"Troubleshooting » Quick Diagnosis","id":"1020","title":"Quick Diagnosis"},"1021":{"body":"","breadcrumbs":"Troubleshooting » Common Issues","id":"1021","title":"Common Issues"},"1022":{"body":"Symptom : Service fails to start or crashes immediately Diagnosis : # Check service status\\nsystemctl status provisioning-orchestrator # View recent logs\\njournalctl -u provisioning-orchestrator -n 100 --no-pager # Check configuration\\nprovisioning validate config Common Causes : Port already in use # Find process using port\\nlsof -i :8080 # Kill conflicting process or change port in config Configuration error # Validate configuration\\nprovisioning validate config --strict # Check for syntax errors\\nnickel typecheck /etc/provisioning/config.ncl Missing dependencies # Check binary dependencies\\nldd /usr/local/bin/provisioning-orchestrator # Install missing libraries\\nsudo apt install Permission issues # Fix ownership\\nsudo chown -R provisioning:provisioning /var/lib/provisioning\\nsudo chown -R provisioning:provisioning /etc/provisioning # Fix permissions\\nsudo chmod 750 /var/lib/provisioning\\nsudo chmod 640 /etc/provisioning/*.toml","breadcrumbs":"Troubleshooting » Services Won\'t Start","id":"1022","title":"Services Won\'t Start"},"1023":{"body":"Symptom : Services can\'t connect to SurrealDB Diagnosis : # Check database status\\nsystemctl status surrealdb # Test database connectivity\\ncurl [http://localhost:8000/health](http://localhost:8000/health) # Check database logs\\njournalctl -u surrealdb -n 50 Resolution : # Restart database\\nsudo systemctl restart surrealdb # Verify connection string in config\\nprovisioning config get database.url # Test manual connection\\nsurreal sql --conn [http://localhost:8000](http://localhost:8000) --user root --pass root","breadcrumbs":"Troubleshooting » Database Connection Failures","id":"1023","title":"Database Connection Failures"},"1024":{"body":"Symptom : Service consuming excessive CPU or memory Diagnosis : # Monitor resource usage\\ntop -p $(pgrep provisioning-orchestrator) # Detailed metrics\\nprovisioning platform metrics --service orchestrator # Check for resource leaks Resolution : # Adjust worker threads\\nprovisioning config set execution.worker_threads 4 # Reduce parallel tasks\\nprovisioning config set execution.max_parallel_tasks 50 # Increase memory limit\\nsudo systemctl set-property provisioning-orchestrator MemoryMax=8G # Restart service\\nsudo systemctl restart provisioning-orchestrator","breadcrumbs":"Troubleshooting » High Resource Usage","id":"1024","title":"High Resource Usage"},"1025":{"body":"Symptom : Workflows fail or hang Diagnosis : # List failed workflows\\nprovisioning workflow list --status failed # View workflow details\\nprovisioning workflow show # Check workflow logs\\nprovisioning workflow logs # Inspect checkpoint state\\nprovisioning workflow checkpoints Common Issues : Provider API errors # Check provider credentials\\nprovisioning provider validate upcloud # Test provider connectivity\\nprovisioning provider test upcloud Dependency resolution failures # Validate infrastructure schema\\nprovisioning validate infra my-cluster.ncl # Check task service dependencies\\nprovisioning taskserv deps kubernetes Timeout issues # Increase timeout\\nprovisioning config set workflows.task_timeout 600 # Enable detailed logging\\nprovisioning config set logging.level debug","breadcrumbs":"Troubleshooting » Workflow Failures","id":"1025","title":"Workflow Failures"},"1026":{"body":"Symptom : Can\'t reach external services or cloud providers Diagnosis : # Test network connectivity\\nping -c 3 upcloud.com # Check DNS resolution\\nnslookup api.upcloud.com # Test HTTPS connectivity\\ncurl -v [https://api.upcloud.com](https://api.upcloud.com) # Check proxy settings\\nenv | grep -i proxy Resolution : # Configure proxy if needed\\nexport HTTPS_PROXY= [http://proxy.example.com:8080](http://proxy.example.com:8080)\\nprovisioning config set network.proxy [http://proxy.example.com:8080](http://proxy.example.com:8080) # Verify firewall rules\\nsudo ufw status # Check routing\\nip route show","breadcrumbs":"Troubleshooting » Network Connectivity Issues","id":"1026","title":"Network Connectivity Issues"},"1027":{"body":"Symptom : API requests fail with 401 Unauthorized Diagnosis : # Check JWT token\\nprovisioning auth status # Verify user credentials\\nprovisioning auth whoami # Check authentication logs\\njournalctl -u provisioning-control-center | grep \\"auth\\" Resolution : # Refresh authentication token\\nprovisioning auth login --username admin # Reset user password\\nprovisioning auth reset-password --username admin # Verify MFA configuration\\nprovisioning auth mfa status","breadcrumbs":"Troubleshooting » Authentication Failures","id":"1027","title":"Authentication Failures"},"1028":{"body":"","breadcrumbs":"Troubleshooting » Debugging Workflows","id":"1028","title":"Debugging Workflows"},"1029":{"body":"# Enable debug mode\\nexport PROVISIONING_LOG_LEVEL=debug\\nprovisioning workflow create my-cluster --debug # Or in configuration\\nprovisioning config set logging.level debug\\nsudo systemctl restart provisioning-orchestrator","breadcrumbs":"Troubleshooting » Enable Debug Logging","id":"1029","title":"Enable Debug Logging"},"103":{"body":"","breadcrumbs":"First Deployment » Part 3: Preview and Validation","id":"103","title":"Part 3: Preview and Validation"},"1030":{"body":"# View workflow state\\nprovisioning workflow state # Export workflow state to JSON\\nprovisioning workflow state --format json > workflow-state.json # Inspect checkpoints\\nprovisioning workflow checkpoints ","breadcrumbs":"Troubleshooting » Workflow State Inspection","id":"1030","title":"Workflow State Inspection"},"1031":{"body":"# Retry failed workflow from last checkpoint\\nprovisioning workflow retry # Retry from specific checkpoint\\nprovisioning workflow retry --from-checkpoint 3 # Force retry (skip validation)\\nprovisioning workflow retry --force","breadcrumbs":"Troubleshooting » Manual Workflow Retry","id":"1031","title":"Manual Workflow Retry"},"1032":{"body":"","breadcrumbs":"Troubleshooting » Performance Troubleshooting","id":"1032","title":"Performance Troubleshooting"},"1033":{"body":"Diagnosis : # Profile workflow execution\\nprovisioning workflow profile # Identify bottlenecks\\nprovisioning workflow analyze Optimization : # Increase parallelism\\nprovisioning config set execution.max_parallel_tasks 200 # Optimize database queries\\nprovisioning database analyze # Add caching\\nprovisioning config set cache.enabled true","breadcrumbs":"Troubleshooting » Slow Workflow Execution","id":"1033","title":"Slow Workflow Execution"},"1034":{"body":"Diagnosis : # Check database metrics\\ncurl [http://localhost:8000/metrics](http://localhost:8000/metrics) # Identify slow queries\\nprovisioning database slow-queries # Check connection pool\\nprovisioning database pool-status Optimization : # Increase connection pool\\nprovisioning config set database.max_connections 200 # Add indexes\\nprovisioning database create-indexes # Optimize vacuum settings\\nprovisioning database vacuum","breadcrumbs":"Troubleshooting » Database Performance Issues","id":"1034","title":"Database Performance Issues"},"1035":{"body":"","breadcrumbs":"Troubleshooting » Log Analysis","id":"1035","title":"Log Analysis"},"1036":{"body":"# View all platform logs\\njournalctl -u provisioning-* -f # Filter by severity\\njournalctl -u provisioning-* -p err # Export logs for analysis\\njournalctl -u provisioning-* --since \\"1 hour ago\\" > /tmp/logs.txt","breadcrumbs":"Troubleshooting » Centralized Log Viewing","id":"1036","title":"Centralized Log Viewing"},"1037":{"body":"Using Loki with LogQL: # Find errors in orchestrator\\n{job=\\"provisioning-orchestrator\\"} | = \\"ERROR\\" # Workflow failures\\n{job=\\"provisioning-orchestrator\\"} | json | status=\\"failed\\" # API request latency over 1s\\n{job=\\"provisioning-control-center\\"} | json | duration > 1","breadcrumbs":"Troubleshooting » Structured Log Queries","id":"1037","title":"Structured Log Queries"},"1038":{"body":"# Correlate logs by request ID\\njournalctl -u provisioning-* | grep \\"request_id=abc123\\" # Trace workflow execution\\nprovisioning workflow trace ","breadcrumbs":"Troubleshooting » Log Correlation","id":"1038","title":"Log Correlation"},"1039":{"body":"","breadcrumbs":"Troubleshooting » Advanced Debugging","id":"1039","title":"Advanced Debugging"},"104":{"body":"# Dry-run to see what will be created\\nprovisioning server create --check --infra k8s-cluster Output shows: Infrastructure Plan: k8s-prod\\nProvider: upcloud\\nRegion: de-fra1 Servers to create: 3 - k8s-control-01 (medium, 4 CPU, 8 GB RAM, 50 GB disk) - k8s-worker-01 (large, 8 CPU, 16 GB RAM, 100 GB disk) - k8s-worker-02 (large, 8 CPU, 16 GB RAM, 100 GB disk) Task services: 5 (with dependencies resolved) 1. containerd (dependency for kubernetes) 2. etcd (dependency for kubernetes) 3. kubernetes 4. cilium (requires kubernetes) 5. rook-ceph (requires kubernetes) Estimated monthly cost: $xxx.xx\\nEstimated deployment time: 15-20 minutes WARNING: Production deployment - ensure backup enabled","breadcrumbs":"First Deployment » Preview Infrastructure","id":"104","title":"Preview Infrastructure"},"1040":{"body":"# Enable backtrace for Rust services\\nexport RUST_BACKTRACE=1\\nsudo systemctl restart provisioning-orchestrator # Full backtrace\\nexport RUST_BACKTRACE=full","breadcrumbs":"Troubleshooting » Enable Rust Backtrace","id":"1040","title":"Enable Rust Backtrace"},"1041":{"body":"# Enable core dumps\\nsudo sysctl -w kernel.core_pattern=/var/crash/core.%e.%p\\nulimit -c unlimited # Analyze core dump\\nsudo coredumpctl list\\nsudo coredumpctl debug # In gdb:\\n(gdb) bt\\n(gdb) info threads\\n(gdb) thread apply all bt","breadcrumbs":"Troubleshooting » Core Dump Analysis","id":"1041","title":"Core Dump Analysis"},"1042":{"body":"# Capture API traffic\\nsudo tcpdump -i any -w /tmp/api-traffic.pcap port 8080 # Analyze with tshark\\ntshark -r /tmp/api-traffic.pcap -Y \\"http\\"","breadcrumbs":"Troubleshooting » Network Traffic Analysis","id":"1042","title":"Network Traffic Analysis"},"1043":{"body":"","breadcrumbs":"Troubleshooting » Getting Help","id":"1043","title":"Getting Help"},"1044":{"body":"# Generate comprehensive diagnostic report\\nprovisioning diagnose --full --output /tmp/diagnostics.tar.gz # Report includes:\\n# - Service status\\n# - Configuration files\\n# - Recent logs (last 1000 lines per service)\\n# - Resource usage metrics\\n# - Database status\\n# - Network connectivity tests\\n# - Workflow states","breadcrumbs":"Troubleshooting » Collect Diagnostic Information","id":"1044","title":"Collect Diagnostic Information"},"1045":{"body":"Check documentation: provisioning help Search logs: journalctl -u provisioning-* Review monitoring dashboards: http://localhost:3000 Run diagnostics: provisioning diagnose Contact support with diagnostic report","breadcrumbs":"Troubleshooting » Support Channels","id":"1045","title":"Support Channels"},"1046":{"body":"Enable comprehensive monitoring and alerting Implement regular health checks Maintain up-to-date documentation Test disaster recovery procedures monthly Keep platform and dependencies updated Review logs regularly for warning signs Monitor resource utilization trends Validate configuration changes before applying","breadcrumbs":"Troubleshooting » Preventive Measures","id":"1046","title":"Preventive Measures"},"1047":{"body":"Service Management - Service lifecycle Monitoring - Observability setup Platform Health - Health checks Backup & Recovery - Recovery procedures","breadcrumbs":"Troubleshooting » Related Documentation","id":"1047","title":"Related Documentation"},"1048":{"body":"Health monitoring, status checks, and system integrity validation for the Provisioning platform.","breadcrumbs":"Platform Health » Platform Health","id":"1048","title":"Platform Health"},"1049":{"body":"The platform provides multiple levels of health monitoring: Level Scope Frequency Response Time Service Health Individual service status Every 10s < 100ms System Health Overall platform status Every 30s < 500ms Infrastructure Health Managed resources Every 60s < 2s Dependency Health External services Every 60s < 1s","breadcrumbs":"Platform Health » Health Check Overview","id":"1049","title":"Health Check Overview"},"105":{"body":"# Visualize dependency resolution\\nprovisioning taskserv dependencies kubernetes --graph Shows: kubernetes\\n├── containerd (required)\\n├── etcd (required)\\n└── cni (cilium) (soft dependency) cilium\\n└── kubernetes (required) rook-ceph\\n└── kubernetes (required)","breadcrumbs":"First Deployment » Dependency Graph","id":"105","title":"Dependency Graph"},"1050":{"body":"# Check overall platform health\\nprovisioning health # Output:\\n# ✓ Orchestrator: healthy (uptime: 5d 3h)\\n# ✓ Control Center: healthy\\n# ✓ Vault Service: healthy\\n# ✓ Database: healthy (connections: 45/100)\\n# ✓ Network: healthy\\n# ✗ MCP Server: degraded (high latency) # Exit code: 0 = healthy, 1 = degraded, 2 = unhealthy","breadcrumbs":"Platform Health » Quick Health Check","id":"1050","title":"Quick Health Check"},"1051":{"body":"All services expose /health endpoints returning standardized responses.","breadcrumbs":"Platform Health » Service Health Endpoints","id":"1051","title":"Service Health Endpoints"},"1052":{"body":"curl [http://localhost:8080/health](http://localhost:8080/health) { \\"status\\": \\"healthy\\", \\"version\\": \\"5.0.0\\", \\"uptime_seconds\\": 432000, \\"checks\\": { \\"database\\": \\"healthy\\", \\"file_system\\": \\"healthy\\", \\"memory\\": \\"healthy\\" }, \\"metrics\\": { \\"active_workflows\\": 12, \\"queued_tasks\\": 45, \\"completed_tasks\\": 9876, \\"worker_threads\\": 8 }, \\"timestamp\\": \\"2026-01-16T10:30:00Z\\"\\n} Health status values: healthy - Service operating normally degraded - Service functional with reduced capacity unhealthy - Service not functioning","breadcrumbs":"Platform Health » Orchestrator Health","id":"1052","title":"Orchestrator Health"},"1053":{"body":"curl [http://localhost:8081/health](http://localhost:8081/health) { \\"status\\": \\"healthy\\", \\"version\\": \\"5.0.0\\", \\"checks\\": { \\"database\\": \\"healthy\\", \\"orchestrator\\": \\"healthy\\", \\"vault\\": \\"healthy\\", \\"auth\\": \\"healthy\\" }, \\"metrics\\": { \\"active_sessions\\": 23, \\"api_requests_per_second\\": 156, \\"p95_latency_ms\\": 45 }\\n}","breadcrumbs":"Platform Health » Control Center Health","id":"1053","title":"Control Center Health"},"1054":{"body":"curl [http://localhost:8085/health](http://localhost:8085/health) { \\"status\\": \\"healthy\\", \\"checks\\": { \\"kms_backend\\": \\"healthy\\", \\"encryption\\": \\"healthy\\", \\"key_rotation\\": \\"healthy\\" }, \\"metrics\\": { \\"active_secrets\\": 234, \\"encryption_ops_per_second\\": 50, \\"kms_latency_ms\\": 3 }\\n}","breadcrumbs":"Platform Health » Vault Service Health","id":"1054","title":"Vault Service Health"},"1055":{"body":"","breadcrumbs":"Platform Health » System Health Checks","id":"1055","title":"System Health Checks"},"1056":{"body":"# Run all health checks\\nprovisioning health check --all # Check specific components\\nprovisioning health check --components orchestrator,database,network # Output detailed report\\nprovisioning health check --detailed --output /tmp/health-report.json","breadcrumbs":"Platform Health » Comprehensive Health Check","id":"1056","title":"Comprehensive Health Check"},"1057":{"body":"Platform health checking verifies: Service Availability - All services responding Database Connectivity - SurrealDB reachable and responsive Filesystem Health - Disk space and I/O performance Network Connectivity - Internal and external connectivity Resource Utilization - CPU, memory, disk within limits Dependency Status - External services available Security Status - Authentication and encryption functional","breadcrumbs":"Platform Health » Health Check Components","id":"1057","title":"Health Check Components"},"1058":{"body":"# Check database health\\nprovisioning health database # Output:\\n# ✓ Connection: healthy (latency: 2ms)\\n# ✓ Disk usage: 45% (22GB / 50GB)\\n# ✓ Active connections: 45 / 100\\n# ✓ Query performance: healthy (avg: 15ms)\\n# ✗ Replication: warning (lag: 5s) Detailed database metrics: # Connection pool status\\nprovisioning database pool-status # Slow query analysis\\nprovisioning database slow-queries --threshold 1000ms # Storage usage\\nprovisioning database storage-stats","breadcrumbs":"Platform Health » Database Health","id":"1058","title":"Database Health"},"1059":{"body":"# Check disk space and I/O\\nprovisioning health filesystem # Output:\\n# ✓ Root filesystem: 65% used (325GB / 500GB)\\n# ✓ Data filesystem: 45% used (225GB / 500GB)\\n# ✓ I/O latency: healthy (avg: 5ms)\\n# ✗ Inodes: warning (85% used) Check specific paths: # Check data directory\\ndf -h /var/lib/provisioning # Check I/O performance\\niostat -x 1 5","breadcrumbs":"Platform Health » Filesystem Health","id":"1059","title":"Filesystem Health"},"106":{"body":"","breadcrumbs":"First Deployment » Part 4: Server Provisioning","id":"106","title":"Part 4: Server Provisioning"},"1060":{"body":"# Check network connectivity\\nprovisioning health network # Test external connectivity\\nprovisioning health network --external # Test provider connectivity\\nprovisioning health network --provider upcloud Network health checks: Internal service-to-service connectivity DNS resolution External API reachability (cloud providers) Network latency and packet loss Firewall rules validation","breadcrumbs":"Platform Health » Network Health","id":"1060","title":"Network Health"},"1061":{"body":"","breadcrumbs":"Platform Health » Resource Monitoring","id":"1061","title":"Resource Monitoring"},"1062":{"body":"# Check CPU utilization\\nprovisioning health cpu # Per-service CPU usage\\nprovisioning platform metrics --metric cpu_usage # Alert if CPU > 90% for 5 minutes Monitor CPU load: # System load average\\nuptime # Per-process CPU\\ntop -b -n 1 | grep provisioning","breadcrumbs":"Platform Health » CPU Health","id":"1062","title":"CPU Health"},"1063":{"body":"# Check memory utilization\\nprovisioning health memory # Memory breakdown by service\\nprovisioning platform metrics --metric memory_usage # Detect memory leaks\\nprovisioning health memory --leak-detection Memory metrics: # Available memory\\nfree -h # Per-service memory\\nps aux | grep provisioning | awk \'{sum+=$6} END {print sum/1024 \\" MB\\"}\'","breadcrumbs":"Platform Health » Memory Health","id":"1063","title":"Memory Health"},"1064":{"body":"# Check disk health\\nprovisioning health disk # SMART status (if available)\\nsudo smartctl -H /dev/sda","breadcrumbs":"Platform Health » Disk Health","id":"1064","title":"Disk Health"},"1065":{"body":"","breadcrumbs":"Platform Health » Automated Health Monitoring","id":"1065","title":"Automated Health Monitoring"},"1066":{"body":"Enable continuous health monitoring: # Start health monitor\\nprovisioning health monitor --interval 30 # Monitor with alerts\\nprovisioning health monitor --interval 30 --alert-email [ops@example.com](mailto:ops@example.com) # Monitor specific components\\nprovisioning health monitor --components orchestrator,database --interval 10","breadcrumbs":"Platform Health » Health Check Service","id":"1066","title":"Health Check Service"},"1067":{"body":"Systemd watchdog for automatic restart on failure: # /etc/systemd/system/provisioning-orchestrator.service\\n[Service]\\nType=notify\\nWatchdogSec=30\\nRestart=on-failure\\nRestartSec=10\\nStartLimitIntervalSec=300\\nStartLimitBurst=5 Service sends periodic health status: // Rust service code\\nsd_notify::notify(true, &[NotifyState::Watchdog])?;","breadcrumbs":"Platform Health » Systemd Health Monitoring","id":"1067","title":"Systemd Health Monitoring"},"1068":{"body":"","breadcrumbs":"Platform Health » Health Dashboards","id":"1068","title":"Health Dashboards"},"1069":{"body":"Import platform health dashboard: provisioning monitoring install-dashboard --name platform-health Dashboard panels: Service status indicators Resource utilization gauges Error rate graphs Latency histograms Workflow success rate Database connection pool Access: http://localhost:3000/d/platform-health","breadcrumbs":"Platform Health » Grafana Health Dashboard","id":"1069","title":"Grafana Health Dashboard"},"107":{"body":"# Create all servers in parallel\\nprovisioning server create --infra k8s-cluster --yes Progress tracking: Creating 3 servers... k8s-control-01: [████████████████████████] 100% k8s-worker-01: [████████████████████████] 100% k8s-worker-02: [████████████████████████] 100% Servers created: 3/3\\nSSH configured: 3/3\\nNetwork ready: 3/3 Servers available: k8s-control-01: 94.237.x.x (running) k8s-worker-01: 94.237.x.x (running) k8s-worker-02: 94.237.x.x (running)","breadcrumbs":"First Deployment » Create Servers","id":"107","title":"Create Servers"},"1070":{"body":"Real-time health monitoring in terminal: # Interactive health dashboard\\nprovisioning health dashboard # Auto-refresh every 5 seconds\\nprovisioning health dashboard --refresh 5","breadcrumbs":"Platform Health » CLI Health Dashboard","id":"1070","title":"CLI Health Dashboard"},"1071":{"body":"","breadcrumbs":"Platform Health » Health Alerts","id":"1071","title":"Health Alerts"},"1072":{"body":"# Platform health alerts\\ngroups: - name: platform_health rules: - alert: ServiceUnhealthy expr: up{job=~\\"provisioning-.*\\"} == 0 for: 1m labels: severity: critical annotations: summary: \\"Service is unhealthy\\" - alert: HighMemoryUsage expr: process_resident_memory_bytes > 4e9 for: 5m labels: severity: warning - alert: DatabaseConnectionPoolExhausted expr: database_connection_pool_active / database_connection_pool_max > 0.9 for: 2m labels: severity: critical","breadcrumbs":"Platform Health » Prometheus Alert Rules","id":"1072","title":"Prometheus Alert Rules"},"1073":{"body":"Configure health check notifications: # /etc/provisioning/health.toml\\n[notifications]\\nenabled = true [notifications.email]\\nenabled = true\\nsmtp_server = \\"smtp.example.com\\"\\nfrom = \\"[health@provisioning.example.com](mailto:health@provisioning.example.com)\\"\\nto = [\\"[ops@example.com](mailto:ops@example.com)\\"] [notifications.slack]\\nenabled = true\\nwebhook_url = \\" [https://hooks.slack.com/services/...\\"](https://hooks.slack.com/services/...\\")\\nchannel = \\"#provisioning-health\\" [notifications.pagerduty]\\nenabled = true\\nservice_key = \\"...\\"","breadcrumbs":"Platform Health » Health Check Notifications","id":"1073","title":"Health Check Notifications"},"1074":{"body":"","breadcrumbs":"Platform Health » Dependency Health","id":"1074","title":"Dependency Health"},"1075":{"body":"Check health of dependencies: # Check cloud provider API\\nprovisioning health dependency upcloud # Check vault service\\nprovisioning health dependency vault # Check all dependencies\\nprovisioning health dependency --all Dependency health includes: API reachability Authentication validity API quota/rate limits Service degradation status","breadcrumbs":"Platform Health » External Service Health","id":"1075","title":"External Service Health"},"1076":{"body":"Monitor integrated services: # Kubernetes cluster health (if managing K8s)\\nprovisioning health kubernetes # Database replication health\\nprovisioning health database --replication # Secret store health\\nprovisioning health secrets","breadcrumbs":"Platform Health » Third-party Service Monitoring","id":"1076","title":"Third-party Service Monitoring"},"1077":{"body":"Key metrics tracked for health monitoring:","breadcrumbs":"Platform Health » Health Metrics","id":"1077","title":"Health Metrics"},"1078":{"body":"provisioning_service_up{service=\\"orchestrator\\"} 1\\nprovisioning_service_health_status{service=\\"orchestrator\\"} 1\\nprovisioning_service_uptime_seconds{service=\\"orchestrator\\"} 432000","breadcrumbs":"Platform Health » Service Metrics","id":"1078","title":"Service Metrics"},"1079":{"body":"provisioning_cpu_usage_percent 45\\nprovisioning_memory_usage_bytes 2.5e9\\nprovisioning_disk_usage_percent{mount=\\"/var/lib/provisioning\\"} 45\\nprovisioning_network_errors_total 0","breadcrumbs":"Platform Health » Resource Metrics","id":"1079","title":"Resource Metrics"},"108":{"body":"# Test SSH connectivity\\nprovisioning server ssh k8s-control-01 -- uname -a # Check all servers\\nprovisioning server list","breadcrumbs":"First Deployment » Verify Server Access","id":"108","title":"Verify Server Access"},"1080":{"body":"provisioning_api_latency_p50_ms 25\\nprovisioning_api_latency_p95_ms 85\\nprovisioning_api_latency_p99_ms 150\\nprovisioning_workflow_duration_seconds 45","breadcrumbs":"Platform Health » Performance Metrics","id":"1080","title":"Performance Metrics"},"1081":{"body":"Monitor all critical services continuously Set appropriate alert thresholds Test alert notifications regularly Maintain health check runbooks Review health metrics weekly Establish health baselines Automate remediation where possible Document health status definitions Integrate health checks with CI/CD Monitor upstream dependencies","breadcrumbs":"Platform Health » Health Best Practices","id":"1081","title":"Health Best Practices"},"1082":{"body":"When health check fails: # 1. Identify unhealthy component\\nprovisioning health check --detailed # 2. View component logs\\njournalctl -u provisioning- -n 100 # 3. Check resource availability\\nprovisioning health resources # 4. Restart unhealthy service\\nsudo systemctl restart provisioning- # 5. Verify recovery\\nprovisioning health check # 6. Review recent changes\\ngit log --since=\\"1 day ago\\" -- /etc/provisioning/","breadcrumbs":"Platform Health » Troubleshooting Unhealthy State","id":"1082","title":"Troubleshooting Unhealthy State"},"1083":{"body":"Service Management - Service lifecycle Monitoring - Comprehensive monitoring Troubleshooting - Issue resolution Deployment Modes - Installation modes","breadcrumbs":"Platform Health » Related Documentation","id":"1083","title":"Related Documentation"},"1084":{"body":"Enterprise-grade security infrastructure with 12 integrated components providing authentication, authorization, encryption, and compliance.","breadcrumbs":"Security Overview » Security System","id":"1084","title":"Security System"},"1085":{"body":"The Provisioning platform security system delivers comprehensive protection across all layers of the infrastructure automation platform. Built for enterprise deployments, it provides defense-in-depth through multiple security controls working together.","breadcrumbs":"Security Overview » Overview","id":"1085","title":"Overview"},"1086":{"body":"The security system is organized into 12 core components: Component Purpose Key Features Authentication User identity verification JWT tokens, session management, multi-provider auth Authorization Access control enforcement Cedar policy engine, RBAC, fine-grained permissions MFA Multi-factor authentication TOTP, WebAuthn/FIDO2, backup codes Audit Logging Comprehensive audit trails 7-year retention, 5 export formats, compliance reporting KMS Key management 5 KMS backends, envelope encryption, key rotation Secrets Management Secure secret storage SecretumVault integration, SOPS/Age, dynamic secrets Encryption Data protection At-rest and in-transit encryption, AES-256-GCM Secure Communication Network security TLS/mTLS, certificate management, secure channels Certificate Management PKI operations CA management, certificate issuance, rotation Compliance Regulatory adherence SOC2, GDPR, HIPAA, policy enforcement Security Testing Validation framework 350+ tests, vulnerability scanning, penetration testing Break-Glass Emergency access Multi-party approval, audit trails, time-limited access","breadcrumbs":"Security Overview » Security Architecture","id":"1086","title":"Security Architecture"},"1087":{"body":"","breadcrumbs":"Security Overview » Security Layers","id":"1087","title":"Security Layers"},"1088":{"body":"Authentication : Verify user identity with JWT tokens and Argon2id password hashing Authorization : Enforce access control with Cedar policies and RBAC MFA : Add second factor with TOTP or FIDO2 hardware keys","breadcrumbs":"Security Overview » Layer 1: Identity and Access","id":"1088","title":"Layer 1: Identity and Access"},"1089":{"body":"Encryption : Protect data at rest with AES-256-GCM and in transit with TLS 1.3 Secrets Management : Store secrets securely in SecretumVault with automatic rotation KMS : Manage encryption keys with envelope encryption across 5 backend options","breadcrumbs":"Security Overview » Layer 2: Data Protection","id":"1089","title":"Layer 2: Data Protection"},"109":{"body":"","breadcrumbs":"First Deployment » Part 5: Service Installation","id":"109","title":"Part 5: Service Installation"},"1090":{"body":"Secure Communication : Enforce TLS/mTLS for all service-to-service communication Certificate Management : Automate certificate lifecycle with cert-manager integration Network Policies : Control traffic flow with Kubernetes NetworkPolicies","breadcrumbs":"Security Overview » Layer 3: Network Security","id":"1090","title":"Layer 3: Network Security"},"1091":{"body":"Audit Logging : Record all security events with 7-year retention Compliance : Validate against SOC2, GDPR, and HIPAA frameworks Security Testing : Continuous validation with automated security test suite","breadcrumbs":"Security Overview » Layer 4: Compliance and Monitoring","id":"1091","title":"Layer 4: Compliance and Monitoring"},"1092":{"body":"Authentication Overhead : Less than 20ms per request with JWT verification Authorization Decision : Less than 10ms with Cedar policy evaluation Encryption Operations : Less than 5ms with KMS-backed envelope encryption Audit Logging : Asynchronous with zero blocking on critical path MFA Verification : Less than 100ms for TOTP, less than 500ms for WebAuthn","breadcrumbs":"Security Overview » Performance Characteristics","id":"1092","title":"Performance Characteristics"},"1093":{"body":"The security system adheres to industry standards and best practices: OWASP Top 10 : Protection against common web vulnerabilities NIST Cybersecurity Framework : Aligned with identify, protect, detect, respond, recover Zero Trust Architecture : Never trust, always verify principle Defense in Depth : Multiple layers of security controls Least Privilege : Minimal access rights for users and services Secure by Default : Security controls enabled out of the box","breadcrumbs":"Security Overview » Security Standards","id":"1093","title":"Security Standards"},"1094":{"body":"All security components work together as a cohesive system: ┌─────────────────────────────────────────────────────────────┐\\n│ User Request │\\n└──────────────────────┬──────────────────────────────────────┘ │ ▼\\n┌─────────────────────────────────────────────────────────────┐\\n│ Authentication (JWT + Session) │\\n│ ↓ │\\n│ Authorization (Cedar Policies) │\\n│ ↓ │\\n│ MFA Verification (if required) │\\n└──────────────────────┬──────────────────────────────────────┘ │ ▼\\n┌─────────────────────────────────────────────────────────────┐\\n│ Audit Logging (Record all actions) │\\n└──────────────────────┬──────────────────────────────────────┘ │ ▼\\n┌─────────────────────────────────────────────────────────────┐\\n│ Secure Communication (TLS/mTLS) │\\n│ ↓ │\\n│ Data Access (Encrypted with KMS) │\\n│ ↓ │\\n│ Secrets Retrieved (SecretumVault) │\\n└──────────────────────┬──────────────────────────────────────┘ │ ▼\\n┌─────────────────────────────────────────────────────────────┐\\n│ Compliance Validation (SOC2/GDPR checks) │\\n└──────────────────────┬──────────────────────────────────────┘ │ ▼\\n┌─────────────────────────────────────────────────────────────┐\\n│ Response │\\n└─────────────────────────────────────────────────────────────┘","breadcrumbs":"Security Overview » Component Integration","id":"1094","title":"Component Integration"},"1095":{"body":"Security settings are managed through hierarchical configuration: # Security defaults in config/security.toml\\n[security]\\nauth_enabled = true\\nmfa_required = true\\naudit_enabled = true\\nencryption_at_rest = true\\ntls_min_version = \\"1.3\\" [security.jwt]\\nalgorithm = \\"RS256\\"\\naccess_token_ttl = 900 # 15 minutes\\nrefresh_token_ttl = 604800 # 7 days [security.mfa]\\ntotp_enabled = true\\nwebauthn_enabled = true\\nbackup_codes_count = 10 [security.kms]\\nbackend = \\"secretumvault\\"\\nenvelope_encryption = true\\nkey_rotation_days = 90 [security.audit]\\nretention_days = 2555 # 7 years\\nexport_formats = [\\"json\\", \\"csv\\", \\"parquet\\", \\"sqlite\\", \\"syslog\\"] [security.compliance]\\nframeworks = [\\"soc2\\", \\"gdpr\\", \\"hipaa\\"]\\npolicy_enforcement = \\"strict\\"","breadcrumbs":"Security Overview » Security Configuration","id":"1095","title":"Security Configuration"},"1096":{"body":"Enable security system for your deployment: # Enable all security features\\nprovisioning config set security.enabled true # Configure authentication\\nprovisioning config set security.auth.jwt_algorithm RS256\\nprovisioning config set security.auth.mfa_required true # Set up SecretumVault integration\\nprovisioning config set security.secrets.backend secretumvault\\nprovisioning config set security.secrets.url [http://localhost:8200](http://localhost:8200) # Enable audit logging\\nprovisioning config set security.audit.enabled true\\nprovisioning config set security.audit.retention_days 2555 # Configure compliance framework\\nprovisioning config set security.compliance.frameworks soc2,gdpr # Verify security configuration\\nprovisioning security validate","breadcrumbs":"Security Overview » Quick Start","id":"1096","title":"Quick Start"},"1097":{"body":"This security documentation is organized into 12 detailed guides: Authentication - JWT token-based authentication and session management Authorization - Cedar policy engine and RBAC access control Multi-Factor Authentication - TOTP and WebAuthn/FIDO2 implementation Audit Logging - Comprehensive audit trails and compliance reporting Key Management Service - Encryption key management and rotation Secrets Management - SecretumVault and SOPS/Age integration Encryption - At-rest and in-transit data protection Secure Communication - TLS/mTLS and network security Certificate Management - PKI and certificate lifecycle Compliance - SOC2, GDPR, HIPAA frameworks Security Testing - Test suite and vulnerability scanning Break-Glass Procedures - Emergency access and recovery","breadcrumbs":"Security Overview » Documentation Structure","id":"1097","title":"Documentation Structure"},"1098":{"body":"The security system tracks key metrics for monitoring and reporting: Authentication Success Rate : Percentage of successful login attempts MFA Adoption Rate : Percentage of users with MFA enabled Policy Violations : Count of authorization denials Audit Event Rate : Events logged per second Secret Rotation Compliance : Percentage of secrets rotated within policy Certificate Expiration : Days until certificate expiration Compliance Score : Overall compliance posture percentage Security Test Pass Rate : Percentage of security tests passing","breadcrumbs":"Security Overview » Security Metrics","id":"1098","title":"Security Metrics"},"1099":{"body":"Follow these security best practices: Enable MFA for all users : Require second factor for all accounts Rotate secrets regularly : Automate secret rotation every 90 days Monitor audit logs : Review security events daily Test security controls : Run security test suite before deployments Keep certificates current : Automate certificate renewal 30 days before expiration Review policies regularly : Audit Cedar policies quarterly Limit break-glass access : Require multi-party approval for emergency access Encrypt all data : Enable encryption at rest and in transit Follow least privilege : Grant minimal required permissions Validate compliance : Run compliance checks before production deployments","breadcrumbs":"Security Overview » Best Practices","id":"1099","title":"Best Practices"},"11":{"body":"","breadcrumbs":"Getting Started » Quick Start Guides","id":"11","title":"Quick Start Guides"},"110":{"body":"# Install all task services (automatic dependency resolution)\\nprovisioning taskserv create kubernetes --infra k8s-cluster Installation flow (automatic): Resolving dependencies... containerd → etcd → kubernetes → cilium, rook-ceph Installing task services: 5 [1/5] Installing containerd... k8s-control-01: [████████████████████████] 100% k8s-worker-01: [████████████████████████] 100% k8s-worker-02: [████████████████████████] 100% [2/5] Installing etcd... k8s-control-01: [████████████████████████] 100% [3/5] Installing kubernetes... Control plane init: [████████████████████████] 100% Worker join: [████████████████████████] 100% Cluster ready: [████████████████████████] 100% [4/5] Installing cilium... CNI deployment: [████████████████████████] 100% Network policies: [████████████████████████] 100% [5/5] Installing rook-ceph... Operator: [████████████████████████] 100% Cluster: [████████████████████████] 100% Storage class: [████████████████████████] 100% All task services installed successfully","breadcrumbs":"First Deployment » Install Task Services","id":"110","title":"Install Task Services"},"1100":{"body":"For security issues and questions: Security Documentation : Complete guides in this security section CLI Help : provisioning security help Security Validation : provisioning security validate Audit Query : provisioning security audit query Compliance Check : provisioning security compliance check","breadcrumbs":"Security Overview » Getting Help","id":"1100","title":"Getting Help"},"1101":{"body":"The security system is continuously updated to address emerging threats and vulnerabilities. Subscribe to security advisories and apply updates promptly. Next Steps : Read Authentication Guide to set up user authentication Configure Authorization with Cedar policies Enable MFA for all user accounts Set up Audit Logging for compliance","breadcrumbs":"Security Overview » Security Updates","id":"1101","title":"Security Updates"},"1102":{"body":"JWT token-based authentication with session management, login flows, and multi-provider support.","breadcrumbs":"Authentication » Authentication","id":"1102","title":"Authentication"},"1103":{"body":"The authentication system verifies user identity through JWT (JSON Web Token) tokens with RS256 signatures and Argon2id password hashing. It provides secure session management, token refresh capabilities, and support for multiple authentication providers.","breadcrumbs":"Authentication » Overview","id":"1103","title":"Overview"},"1104":{"body":"","breadcrumbs":"Authentication » Architecture","id":"1104","title":"Architecture"},"1105":{"body":"┌──────────┐ ┌──────────────┐ ┌────────────┐\\n│ Client │ │ Auth Service│ │ Database │\\n└────┬─────┘ └──────┬───────┘ └─────┬──────┘ │ │ │ │ POST /auth/login │ │ │ {username, password} │ │ │────────────────────────────>│ │ │ │ │ │ │ Find user by username │ │ │─────────────────────────────>│ │ │<─────────────────────────────│ │ │ User record │ │ │ │ │ │ Verify password (Argon2id) │ │ │ │ │ │ Create session │ │ │─────────────────────────────>│ │ │<─────────────────────────────│ │ │ │ │ │ Generate JWT token pair │ │ │ │ │ {access_token, refresh} │ │ │<────────────────────────────│ │ │ │ │","breadcrumbs":"Authentication » Authentication Flow","id":"1105","title":"Authentication Flow"},"1106":{"body":"Component Purpose Technology AuthService Core authentication logic Rust service in control-center JwtService Token generation and verification RS256 algorithm with jsonwebtoken crate SessionManager Session lifecycle management Database-backed session storage PasswordHasher Password hashing and verification Argon2id with configurable parameters UserService User account management CRUD operations with role assignment","breadcrumbs":"Authentication » Components","id":"1106","title":"Components"},"1107":{"body":"","breadcrumbs":"Authentication » JWT Token Structure","id":"1107","title":"JWT Token Structure"},"1108":{"body":"Short-lived token for API authentication (default: 15 minutes). { \\"header\\": { \\"alg\\": \\"RS256\\", \\"typ\\": \\"JWT\\" }, \\"payload\\": { \\"sub\\": \\"550e8400-e29b-41d4-a716-446655440000\\", \\"email\\": \\"[user@example.com](mailto:user@example.com)\\", \\"username\\": \\"alice\\", \\"roles\\": [\\"user\\", \\"developer\\"], \\"session_id\\": \\"sess_abc123\\", \\"mfa_verified\\": true, \\"permissions_hash\\": \\"sha256:abc123...\\", \\"iat\\": 1704067200, \\"exp\\": 1704068100, \\"iss\\": \\"provisioning-platform\\", \\"aud\\": \\"api.provisioning.example.com\\" }\\n}","breadcrumbs":"Authentication » Access Token","id":"1108","title":"Access Token"},"1109":{"body":"Long-lived token for obtaining new access tokens (default: 7 days). { \\"header\\": { \\"alg\\": \\"RS256\\", \\"typ\\": \\"JWT\\" }, \\"payload\\": { \\"sub\\": \\"550e8400-e29b-41d4-a716-446655440000\\", \\"session_id\\": \\"sess_abc123\\", \\"token_type\\": \\"refresh\\", \\"iat\\": 1704067200, \\"exp\\": 1704672000, \\"iss\\": \\"provisioning-platform\\" }\\n}","breadcrumbs":"Authentication » Refresh Token","id":"1109","title":"Refresh Token"},"111":{"body":"# SSH to control plane\\nprovisioning server ssh k8s-control-01 # Check cluster status\\nkubectl get nodes\\nkubectl get pods --all-namespaces\\nkubectl get storageclass Expected output: NAME STATUS ROLES AGE VERSION\\nk8s-control-01 Ready control-plane 5m v1.28.0\\nk8s-worker-01 Ready 4m v1.28.0\\nk8s-worker-02 Ready 4m v1.28.0 NAMESPACE NAME READY STATUS\\nkube-system cilium-xxxxx 1/1 Running\\nkube-system cilium-operator-xxxxx 1/1 Running\\nkube-system etcd-k8s-control-01 1/1 Running\\nrook-ceph rook-ceph-operator-xxxxx 1/1 Running NAME PROVISIONER\\nceph-rbd rook-ceph.rbd.csi.ceph.com","breadcrumbs":"First Deployment » Verify Kubernetes Cluster","id":"111","title":"Verify Kubernetes Cluster"},"1110":{"body":"","breadcrumbs":"Authentication » Password Security","id":"1110","title":"Password Security"},"1111":{"body":"Password hashing uses Argon2id with security-hardened parameters: // Default Argon2id parameters\\nargon2::Params { m_cost: 65536, // 64 MB memory t_cost: 3, // 3 iterations p_cost: 4, // 4 parallelism output_len: 32 // 32 byte hash\\n}","breadcrumbs":"Authentication » Argon2id Configuration","id":"1111","title":"Argon2id Configuration"},"1112":{"body":"Default password policy enforces: Minimum 12 characters At least one uppercase letter At least one lowercase letter At least one digit At least one special character Not in common password list Not similar to username or email","breadcrumbs":"Authentication » Password Requirements","id":"1112","title":"Password Requirements"},"1113":{"body":"","breadcrumbs":"Authentication » Session Management","id":"1113","title":"Session Management"},"1114":{"body":"Creation : New session created on successful login Active : Session tracked with last activity timestamp Refresh : Session extended on token refresh Expiration : Session expires after inactivity timeout Revocation : Manual logout or security event terminates session","breadcrumbs":"Authentication » Session Lifecycle","id":"1114","title":"Session Lifecycle"},"1115":{"body":"Sessions stored in database with: pub struct Session { pub session_id: Uuid, pub user_id: Uuid, pub created_at: DateTime, pub expires_at: DateTime, pub last_activity: DateTime, pub ip_address: Option, pub user_agent: Option, pub is_active: bool,\\n}","breadcrumbs":"Authentication » Session Storage","id":"1115","title":"Session Storage"},"1116":{"body":"Track multiple concurrent sessions per user: # List active sessions for user\\nprovisioning security sessions list --user alice # Revoke specific session\\nprovisioning security sessions revoke --session-id sess_abc123 # Revoke all sessions except current\\nprovisioning security sessions revoke-all --except-current","breadcrumbs":"Authentication » Session Tracking","id":"1116","title":"Session Tracking"},"1117":{"body":"","breadcrumbs":"Authentication » Login Flows","id":"1117","title":"Login Flows"},"1118":{"body":"Basic username/password authentication: # CLI login\\nprovisioning auth login --username alice --password # API login\\ncurl -X POST [https://api.provisioning.example.com/auth/login](https://api.provisioning.example.com/auth/login) \\\\ -H \\"Content-Type: application/json\\" \\\\ -d \'{ \\"username_or_email\\": \\"alice\\", \\"password\\": \\"SecurePassword123!\\", \\"client_info\\": { \\"ip_address\\": \\"192.168.1.100\\", \\"user_agent\\": \\"provisioning-cli/1.0\\" } }\' Response: { \\"access_token\\": \\"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\\", \\"refresh_token\\": \\"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\\", \\"token_type\\": \\"Bearer\\", \\"expires_in\\": 900, \\"user\\": { \\"user_id\\": \\"550e8400-e29b-41d4-a716-446655440000\\", \\"username\\": \\"alice\\", \\"email\\": \\"[alice@example.com](mailto:alice@example.com)\\", \\"roles\\": [\\"user\\", \\"developer\\"] }\\n}","breadcrumbs":"Authentication » Standard Login","id":"1118","title":"Standard Login"},"1119":{"body":"Two-phase authentication with MFA: # Phase 1: Initial authentication\\nprovisioning auth login --username alice --password # Response indicates MFA required\\n# {\\n# \\"mfa_required\\": true,\\n# \\"mfa_token\\": \\"temp_token_abc123\\",\\n# \\"available_methods\\": [\\"totp\\", \\"webauthn\\"]\\n# } # Phase 2: MFA verification\\nprovisioning auth mfa-verify --mfa-token temp_token_abc123 --code 123456","breadcrumbs":"Authentication » MFA Login","id":"1119","title":"MFA Login"},"112":{"body":"","breadcrumbs":"First Deployment » Part 6: Deployment Verification","id":"112","title":"Part 6: Deployment Verification"},"1120":{"body":"Single Sign-On with external providers: # Initiate SSO flow\\nprovisioning auth sso --provider okta # Or with SAML\\nprovisioning auth sso --provider azure-ad --protocol saml","breadcrumbs":"Authentication » SSO Login","id":"1120","title":"SSO Login"},"1121":{"body":"","breadcrumbs":"Authentication » Token Refresh","id":"1121","title":"Token Refresh"},"1122":{"body":"Client libraries automatically refresh tokens before expiration: // Automatic token refresh in Rust client\\nlet client = ProvisioningClient::new() .with_auto_refresh(true) .build()?; // Tokens refreshed transparently\\nclient.server().list().await?;","breadcrumbs":"Authentication » Automatic Refresh","id":"1122","title":"Automatic Refresh"},"1123":{"body":"Explicit token refresh when needed: # CLI token refresh\\nprovisioning auth refresh # API token refresh\\ncurl -X POST [https://api.provisioning.example.com/auth/refresh](https://api.provisioning.example.com/auth/refresh) \\\\ -H \\"Content-Type: application/json\\" \\\\ -d \'{ \\"refresh_token\\": \\"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\\" }\' Response: { \\"access_token\\": \\"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\\", \\"token_type\\": \\"Bearer\\", \\"expires_in\\": 900\\n}","breadcrumbs":"Authentication » Manual Refresh","id":"1123","title":"Manual Refresh"},"1124":{"body":"","breadcrumbs":"Authentication » Multi-Provider Authentication","id":"1124","title":"Multi-Provider Authentication"},"1125":{"body":"Provider Type Configuration Local Username/password Built-in user database LDAP Directory service Active Directory, OpenLDAP SAML SSO Okta, Azure AD, OneLogin OIDC OAuth2/OpenID Google, GitHub, Auth0 mTLS Certificate Client certificate authentication","breadcrumbs":"Authentication » Supported Providers","id":"1125","title":"Supported Providers"},"1126":{"body":"[auth.providers.ldap]\\nenabled = true\\nserver = \\"ldap://ldap.example.com\\"\\nbase_dn = \\"dc=example,dc=com\\"\\nbind_dn = \\"cn=admin,dc=example,dc=com\\"\\nuser_filter = \\"(uid={username})\\" [auth.providers.saml]\\nenabled = true\\nentity_id = \\" [https://provisioning.example.com\\"](https://provisioning.example.com\\")\\nsso_url = \\" [https://okta.example.com/sso/saml\\"](https://okta.example.com/sso/saml\\")\\ncertificate_path = \\"/etc/provisioning/saml-cert.pem\\" [auth.providers.oidc]\\nenabled = true\\nissuer = \\" [https://accounts.google.com\\"](https://accounts.google.com\\")\\nclient_id = \\"client_id_here\\"\\nclient_secret = \\"client_secret_here\\"\\nredirect_uri = \\" [https://provisioning.example.com/auth/callback\\"](https://provisioning.example.com/auth/callback\\")","breadcrumbs":"Authentication » Provider Configuration","id":"1126","title":"Provider Configuration"},"1127":{"body":"","breadcrumbs":"Authentication » Token Validation","id":"1127","title":"Token Validation"},"1128":{"body":"All API requests validate JWT tokens: // Middleware validates JWT on every request\\npub async fn jwt_auth_middleware( headers: HeaderMap, State(jwt_service): State>, mut request: Request, next: Next,\\n) -> Result { // Extract token from Authorization header let token = extract_bearer_token(&headers)?; // Verify signature and claims let claims = jwt_service.verify_access_token(&token)?; // Check expiration if claims.exp < Utc::now().timestamp() { return Err(AuthError::TokenExpired); } // Inject user context into request request.extensions_mut().insert(claims); Ok(next.run(request).await)\\n}","breadcrumbs":"Authentication » JWT Verification","id":"1128","title":"JWT Verification"},"1129":{"body":"Revoke tokens on security events: # Revoke all tokens for user\\nprovisioning security tokens revoke-user --user alice # Revoke specific token\\nprovisioning security tokens revoke --token-id token_abc123 # Check token status\\nprovisioning security tokens status --token eyJhbGci...","breadcrumbs":"Authentication » Token Revocation","id":"1129","title":"Token Revocation"},"113":{"body":"# Platform-level health check\\nprovisioning cluster status k8s-cluster # Individual service health\\nprovisioning taskserv status kubernetes\\nprovisioning taskserv status cilium\\nprovisioning taskserv status rook-ceph","breadcrumbs":"First Deployment » Health Checks","id":"113","title":"Health Checks"},"1130":{"body":"","breadcrumbs":"Authentication » Security Hardening","id":"1130","title":"Security Hardening"},"1131":{"body":"Secure authentication settings: [security.auth]\\n# JWT settings\\njwt_algorithm = \\"RS256\\"\\njwt_issuer = \\"provisioning-platform\\"\\naccess_token_ttl = 900 # 15 minutes\\nrefresh_token_ttl = 604800 # 7 days\\ntoken_leeway = 30 # 30 seconds clock skew # Password policy\\npassword_min_length = 12\\npassword_require_uppercase = true\\npassword_require_lowercase = true\\npassword_require_digit = true\\npassword_require_special = true\\npassword_check_common = true # Session settings\\nsession_timeout = 1800 # 30 minutes inactivity\\nmax_sessions_per_user = 5\\nremember_me_duration = 2592000 # 30 days # Security controls\\nenforce_mfa = true\\nallow_password_reset = true\\nlockout_after_attempts = 5\\nlockout_duration = 900 # 15 minutes","breadcrumbs":"Authentication » Configuration","id":"1131","title":"Configuration"},"1132":{"body":"Use strong passwords : Enforce password policy with minimum 12 characters Enable MFA : Require second factor for all users Rotate keys regularly : Update JWT signing keys every 90 days Monitor failed attempts : Alert on suspicious login patterns Limit session duration : Use short access token TTL with refresh tokens Secure token storage : Store tokens securely, never in local storage Validate on every request : Always verify JWT signature and expiration Use HTTPS only : Never transmit tokens over unencrypted connections","breadcrumbs":"Authentication » Best Practices","id":"1132","title":"Best Practices"},"1133":{"body":"","breadcrumbs":"Authentication » CLI Integration","id":"1133","title":"CLI Integration"},"1134":{"body":"# Login with credentials\\nprovisioning auth login --username alice # Login with MFA\\nprovisioning auth login --username alice --mfa # Check authentication status\\nprovisioning auth status # Logout (revoke session)\\nprovisioning auth logout # List active sessions\\nprovisioning security sessions list # Refresh token\\nprovisioning auth refresh","breadcrumbs":"Authentication » Login and Session Management","id":"1134","title":"Login and Session Management"},"1135":{"body":"# Show current token\\nprovisioning auth token show # Validate token\\nprovisioning auth token validate # Decode token (without verification)\\nprovisioning auth token decode # Revoke token\\nprovisioning auth token revoke","breadcrumbs":"Authentication » Token Management","id":"1135","title":"Token Management"},"1136":{"body":"","breadcrumbs":"Authentication » API Reference","id":"1136","title":"API Reference"},"1137":{"body":"Endpoint Method Purpose /auth/login POST Authenticate with credentials /auth/refresh POST Refresh access token /auth/logout POST Revoke session and tokens /auth/verify POST Verify MFA code /auth/sessions GET List active sessions /auth/sessions/:id DELETE Revoke specific session /auth/password-reset POST Initiate password reset /auth/password-change POST Change password","breadcrumbs":"Authentication » Endpoints","id":"1137","title":"Endpoints"},"1138":{"body":"","breadcrumbs":"Authentication » Troubleshooting","id":"1138","title":"Troubleshooting"},"1139":{"body":"Token expired errors : # Refresh token\\nprovisioning auth refresh # Or re-login\\nprovisioning auth login Invalid signature : # Check JWT configuration\\nprovisioning config get security.auth.jwt_algorithm # Verify public key is correct\\nprovisioning security keys verify MFA verification failures : # Check time sync (TOTP requires accurate time)\\nntpdate -q pool.ntp.org # Re-sync MFA device\\nprovisioning auth mfa-setup --resync Session not found : # Clear local session and re-login\\nprovisioning auth logout\\nprovisioning auth login","breadcrumbs":"Authentication » Common Issues","id":"1139","title":"Common Issues"},"114":{"body":"# Deploy test application on K8s cluster\\ncat < -- curl [http://test-nginx](http://test-nginx)","breadcrumbs":"First Deployment » Network Policy Test","id":"115","title":"Network Policy Test"},"1150":{"body":"","breadcrumbs":"SecretumVault Guide » Architecture","id":"1150","title":"Architecture"},"1151":{"body":"Provisioning ├─ CLI (Nushell) │ └─ nu_plugin_secretumvault │ ├─ vault-service (Rust) │ ├─ secretumvault backend │ ├─ rustyvault compatibility │ └─ SOPS + Age integration │ └─ Control Center └─ Secret management UI","breadcrumbs":"SecretumVault Guide » Integration Points","id":"1151","title":"Integration Points"},"1152":{"body":"User Secret ↓\\nKDF (Key Derivation Function) ├─ Argon2id (password-based) └─ HKDF (key-based) ↓\\nPQC Encryption Layer ├─ CRYSTALS-Kyber (key encapsulation) ├─ Falcon (signature) ├─ SPHINCS+ (backup signature) └─ Hybrid: PQC + Classical (AES-256) ↓\\nAuthenticated Encryption ├─ ChaCha20-Poly1305 └─ AES-256-GCM ↓\\nSecure Storage ├─ Local vault ├─ SurrealDB └─ Hardware module (optional)","breadcrumbs":"SecretumVault Guide » Cryptographic Stack","id":"1152","title":"Cryptographic Stack"},"1153":{"body":"","breadcrumbs":"SecretumVault Guide » Installation","id":"1153","title":"Installation"},"1154":{"body":"# Install via provisioning\\nprovisioning install secretumvault # Or manual installation\\ncd /Users/Akasha/Development/secretumvault\\ncargo install --path . # Verify installation\\nsecretumvault --version","breadcrumbs":"SecretumVault Guide » Install SecretumVault","id":"1154","title":"Install SecretumVault"},"1155":{"body":"# Install plugin\\nprovisioning install nu-plugin-secretumvault # Reload Nushell\\nnu -c \\"plugin add nu_plugin_secretumvault\\" # Verify\\nnu -c \\"secretumvault-plugin version\\"","breadcrumbs":"SecretumVault Guide » Install Nushell Plugin","id":"1155","title":"Install Nushell Plugin"},"1156":{"body":"","breadcrumbs":"SecretumVault Guide » Configuration","id":"1156","title":"Configuration"},"1157":{"body":"# Set vault location\\nexport SECRETUMVAULT_HOME=~/.secretumvault # Set encryption algorithm\\nexport SECRETUMVAULT_CIPHER=kyber-aes # kyber-aes, falcon-aes, hybrid # Set key derivation\\nexport SECRETUMVAULT_KDF=argon2id # argon2id, pbkdf2 # Enable hardware acceleration (optional)\\nexport SECRETUMVAULT_HW_ACCEL=enabled","breadcrumbs":"SecretumVault Guide » Environment Setup","id":"1157","title":"Environment Setup"},"1158":{"body":"# ~/.secretumvault/config.yaml\\nvault: storage_backend: surrealdb # local, surrealdb, redis encryption_cipher: kyber-aes # kyber-aes, falcon-aes, hybrid key_derivation: argon2id # argon2id, pbkdf2 # Argon2id parameters (password strength) kdf: memory: 65536 # KB iterations: 3 parallelism: 4 # Encryption parameters encryption: key_length: 256 # bits nonce_length: 12 # bytes auth_tag_length: 16 # bytes # Database backend (if using SurrealDB)\\ndatabase: url: \\"surrealdb://localhost:8000\\" namespace: \\"provisioning\\" database: \\"secrets\\" # Hardware acceleration (optional)\\nhardware: use_fpga: false fpga_device: \\"/dev/fpga0\\" # Backup configuration\\nbackup: enabled: true interval: 24 # hours retention: 30 # days encrypt_backup: true backup_path: ~/.secretumvault/backups # Access logging\\naudit: enabled: true log_file: ~/.secretumvault/audit.log log_level: info rotate_logs: true retention_days: 365 # Master key management\\nmaster_key: protection: none # none, tpm, hsm, hardware-module rotation_enabled: true rotation_interval: 90 # days","breadcrumbs":"SecretumVault Guide » Configuration File","id":"1158","title":"Configuration File"},"1159":{"body":"","breadcrumbs":"SecretumVault Guide » Usage","id":"1159","title":"Usage"},"116":{"body":"","breadcrumbs":"First Deployment » Part 7: State Management","id":"116","title":"Part 7: State Management"},"1160":{"body":"# Create master key\\nsecretumvault init # Add secret\\nsecretumvault secret add \\\\ --name database-password \\\\ --value \\"supersecret\\" \\\\ --metadata \\"type=database,app=api\\" # Retrieve secret\\nsecretumvault secret get database-password # List secrets\\nsecretumvault secret list # Delete secret\\nsecretumvault secret delete database-password # Rotate key\\nsecretumvault key rotate # Backup vault\\nsecretumvault backup create --output vault-backup.enc # Restore vault\\nsecretumvault backup restore vault-backup.enc","breadcrumbs":"SecretumVault Guide » Command Line Interface","id":"1160","title":"Command Line Interface"},"1161":{"body":"# Load SecretumVault plugin\\nplugin add nu_plugin_secretumvault # Add secret from Nushell\\nlet password = \\"mypassword\\"\\nsecretumvault-plugin store \\"app-secret\\" $password # Retrieve secret\\nlet db_pass = (secretumvault-plugin retrieve \\"database-password\\") # List all secrets\\nsecretumvault-plugin list # Delete secret\\nsecretumvault-plugin delete \\"old-secret\\" # Rotate key\\nsecretumvault-plugin rotate-key","breadcrumbs":"SecretumVault Guide » Nushell Integration","id":"1161","title":"Nushell Integration"},"1162":{"body":"# Configure vault-service to use SecretumVault\\nprovisioning config set security.vault.backend secretumvault # Enable in form prefill\\nprovisioning setup profile --use-secretumvault # Manage secrets via CLI\\nprovisioning vault add \\\\ --name aws-access-key \\\\ --value \\"AKIAIOSFODNN7EXAMPLE\\" \\\\ --metadata \\"provider=aws,env=production\\" # Use secret in infrastructure\\nprovisioning ai \\"Create AWS resources using secret aws-access-key\\"","breadcrumbs":"SecretumVault Guide » Provisioning Integration","id":"1162","title":"Provisioning Integration"},"1163":{"body":"","breadcrumbs":"SecretumVault Guide » Post-Quantum Cryptography","id":"1163","title":"Post-Quantum Cryptography"},"1164":{"body":"Algorithm Type NIST Status Performance CRYSTALS-Kyber KEM Finalist Fast Falcon Signature Finalist Medium SPHINCS+ Hash-based Signature Finalist Slower AES-256 Hybrid (Classical) Standard Very fast ChaCha20 Stream Cipher Alternative Fast","breadcrumbs":"SecretumVault Guide » Algorithms Supported","id":"1164","title":"Algorithms Supported"},"1165":{"body":"SecretumVault uses hybrid encryption by default: Secret Input ↓\\nKey Material: Classical (AES-256) + PQC (Kyber) ├─ Generate AES key ├─ Generate Kyber keypair └─ Encapsulate using Kyber ↓\\nEncrypt with both algorithms ├─ AES-256-GCM encryption └─ Kyber encapsulation (public key cryptography) ↓\\nBoth keys required to decrypt ├─ If quantum computer breaks Kyber → AES still secure └─ If breakthrough in AES → Kyber still secure ↓\\nEncrypted Secret Stored Advantages : Protection against quantum computers (PQC) Protection against classical attacks (AES-256) Compatible with both current and future threats No single point of failure","breadcrumbs":"SecretumVault Guide » Hybrid Mode (Recommended)","id":"1165","title":"Hybrid Mode (Recommended)"},"1166":{"body":"# Manual key rotation\\nsecretumvault key rotate --algorithm kyber-aes # Scheduled rotation (every 90 days)\\nsecretumvault key rotate --schedule 90d # Emergency rotation\\nsecretumvault key rotate --emergency --force","breadcrumbs":"SecretumVault Guide » Key Rotation Strategy","id":"1166","title":"Key Rotation Strategy"},"1167":{"body":"","breadcrumbs":"SecretumVault Guide » Security Features","id":"1167","title":"Security Features"},"1168":{"body":"# Master key authentication\\nsecretumvault auth login # MFA for sensitive operations\\nsecretumvault auth mfa enable --method totp # Biometric unlock (supported platforms)\\nsecretumvault auth enable-biometric","breadcrumbs":"SecretumVault Guide » Authentication","id":"1168","title":"Authentication"},"1169":{"body":"# Set vault permissions\\nsecretumvault acl set database-password \\\\ --read \\"api-service,backup-service\\" \\\\ --write \\"admin\\" \\\\ --delete \\"admin\\" # View access logs\\nsecretumvault audit log --secret database-password","breadcrumbs":"SecretumVault Guide » Access Control","id":"1169","title":"Access Control"},"117":{"body":"# Show current workspace state\\nprovisioning workspace info # List all resources\\nprovisioning server list\\nprovisioning taskserv list # Export state for backup\\nprovisioning workspace export > k8s-cluster-state.json","breadcrumbs":"First Deployment » View State","id":"117","title":"View State"},"1170":{"body":"Every operation is logged: # View audit log\\nsecretumvault audit log --since 24h # Export audit log\\nsecretumvault audit export --format json > audit.json # Monitor real-time\\nsecretumvault audit monitor Sample Log Entry : { \\"timestamp\\": \\"2026-01-16T01:47:00Z\\", \\"operation\\": \\"secret_retrieve\\", \\"secret\\": \\"database-password\\", \\"user\\": \\"api-service\\", \\"status\\": \\"success\\", \\"ip_address\\": \\"127.0.0.1\\", \\"device_id\\": \\"device-123\\"\\n}","breadcrumbs":"SecretumVault Guide » Audit Logging","id":"1170","title":"Audit Logging"},"1171":{"body":"","breadcrumbs":"SecretumVault Guide » Disaster Recovery","id":"1171","title":"Disaster Recovery"},"1172":{"body":"# Create encrypted backup\\nsecretumvault backup create \\\\ --output /secure/vault-backup.enc \\\\ --compression gzip # Verify backup integrity\\nsecretumvault backup verify /secure/vault-backup.enc # Restore from backup\\nsecretumvault backup restore \\\\ --input /secure/vault-backup.enc \\\\ --verify-checksum","breadcrumbs":"SecretumVault Guide » Backup Procedures","id":"1172","title":"Backup Procedures"},"1173":{"body":"# Generate recovery key (for emergencies)\\nsecretumvault recovery-key generate \\\\ --threshold 3 \\\\ --shares 5 # Share recovery shards\\n# Share with 5 trusted people, need 3 to recover # Recover using shards\\nsecretumvault recovery-key restore \\\\ --shard1 /secure/shard1.key \\\\ --shard2 /secure/shard2.key \\\\ --shard3 /secure/shard3.key","breadcrumbs":"SecretumVault Guide » Recovery Key","id":"1173","title":"Recovery Key"},"1174":{"body":"","breadcrumbs":"SecretumVault Guide » Performance","id":"1174","title":"Performance"},"1175":{"body":"Operation Time Algorithm Store secret 50-100ms Kyber-AES Retrieve secret 30-50ms Kyber-AES Key rotation 200-500ms Kyber-AES Backup 1000 secrets 2-3 seconds Kyber-AES Restore from backup 3-5 seconds Kyber-AES","breadcrumbs":"SecretumVault Guide » Benchmark Results","id":"1175","title":"Benchmark Results"},"1176":{"body":"With FPGA acceleration: Operation Native FPGA Speedup Store secret 75ms 15ms 5x Key rotation 350ms 50ms 7x Backup 1000 2.5s 0.4s 6x","breadcrumbs":"SecretumVault Guide » Hardware Acceleration","id":"1176","title":"Hardware Acceleration"},"1177":{"body":"","breadcrumbs":"SecretumVault Guide » Troubleshooting","id":"1177","title":"Troubleshooting"},"1178":{"body":"# Check permissions\\nls -la ~/.secretumvault # Clear corrupted state\\nrm ~/.secretumvault/state.lock # Reinitialize\\nsecretumvault init --force","breadcrumbs":"SecretumVault Guide » Cannot Initialize Vault","id":"1178","title":"Cannot Initialize Vault"},"1179":{"body":"# Check algorithm\\nsecretumvault config get encryption.cipher # Switch to faster algorithm\\nexport SECRETUMVAULT_CIPHER=kyber-aes # Enable hardware acceleration\\nexport SECRETUMVAULT_HW_ACCEL=enabled","breadcrumbs":"SecretumVault Guide » Slow Performance","id":"1179","title":"Slow Performance"},"118":{"body":"# Backup workspace configuration\\ntar -czf k8s-cluster-backup.tar.gz infra/ config/ runtime/ # Store securely (encrypted)\\nsops -e k8s-cluster-backup.tar.gz > k8s-cluster-backup.tar.gz.enc","breadcrumbs":"First Deployment » Configuration Backup","id":"118","title":"Configuration Backup"},"1180":{"body":"# Use recovery key (if available)\\nsecretumvault recovery-key restore \\\\ --shard1 ... --shard2 ... --shard3 ... # If no recovery key exists, vault is unrecoverable\\n# Use recent backup instead\\nsecretumvault backup restore vault-backup.enc","breadcrumbs":"SecretumVault Guide » Master Key Lost","id":"1180","title":"Master Key Lost"},"1181":{"body":"","breadcrumbs":"SecretumVault Guide » Compliance & Standards","id":"1181","title":"Compliance & Standards"},"1182":{"body":"✅ NIST PQC Standards : CRYSTALS-Kyber, Falcon, SPHINCS+ ✅ FIPS 140-3 Ready : Cryptographic module certification path ✅ NIST SP 800-175B : Post-quantum cryptography guidance ✅ EU Cyber Resilience Act : PQC readiness","breadcrumbs":"SecretumVault Guide » Certifications","id":"1182","title":"Certifications"},"1183":{"body":"SecretumVault is subject to cryptography export controls in some jurisdictions. Ensure compliance with local regulations.","breadcrumbs":"SecretumVault Guide » Export Controls","id":"1183","title":"Export Controls"},"1184":{"body":"Security Overview - Security architecture Encryption Guide - Encryption strategies Secrets Management - Secret handling Vault Service - Microservice architecture KMS Guide - Key management system","breadcrumbs":"SecretumVault Guide » Related Documentation","id":"1184","title":"Related Documentation"},"1185":{"body":"","breadcrumbs":"Encryption » Encryption","id":"1185","title":"Encryption"},"1186":{"body":"","breadcrumbs":"Secure Communication » Secure Communication","id":"1186","title":"Secure Communication"},"1187":{"body":"","breadcrumbs":"Certificate Management » Certificate Management","id":"1187","title":"Certificate Management"},"1188":{"body":"","breadcrumbs":"Compliance » Compliance","id":"1188","title":"Compliance"},"1189":{"body":"","breadcrumbs":"Security Testing » Security Testing","id":"1189","title":"Security Testing"},"119":{"body":"This deployment demonstrated: Workspace creation and configuration Nickel schema structure for infrastructure-as-code Type-safe configuration validation Automatic dependency resolution Multi-server provisioning Task service installation with health checks Kubernetes cluster deployment Storage and networking configuration Verification and testing workflows State management and backup","breadcrumbs":"First Deployment » What You\'ve Learned","id":"119","title":"What You\'ve Learned"},"1190":{"body":"Comprehensive guides for developers building extensions, custom providers, plugins, and integrations on the Provisioning platform.","breadcrumbs":"Development Overview » Development","id":"1190","title":"Development"},"1191":{"body":"Provisioning is designed to be extended and customized for specific infrastructure needs. This section provides everything needed to: Build custom cloud providers interfacing with any infrastructure platform via the Provider SDK Create custom detectors for domain-specific infrastructure analysis and anomaly detection Develop task services for specialized infrastructure operations beyond built-in services Write Nushell plugins for high-performance scripting extensions Integrate external systems via REST APIs and the MCP (Model Context Protocol) Understand platform internals for daemon architecture, caching, and performance optimization The platform uses modern Rust with async/await, Nushell for scripting, and Nickel for configuration - all with production-ready code examples.","breadcrumbs":"Development Overview » Overview","id":"1191","title":"Overview"},"1192":{"body":"","breadcrumbs":"Development Overview » Development Guides","id":"1192","title":"Development Guides"},"1193":{"body":"Extension Development - Framework for extensions (providers, task services, plugins, clusters) with type-safety Custom Provider Development - Build cloud providers with async Rust, credentials, state, error recovery, testing Custom Task Services - Specialized service development for infrastructure operations Custom Detector Development - Cost, compliance, performance, security risk detection Plugin Development - Nushell plugins for high-performance scripting with FFI bindings","breadcrumbs":"Development Overview » Extension Development","id":"1193","title":"Extension Development"},"1194":{"body":"Provisioning Daemon Internals - TCP server, connection pooling, caching, metrics, shutdown, 50x speedup","breadcrumbs":"Development Overview » Platform Internals","id":"1194","title":"Platform Internals"},"1195":{"body":"API Guide - REST API integration with authentication, pagination, error handling, rate limiting Build System - Cargo configuration, feature flags, dependencies, cross-platform compilation Testing - Unit, integration, property-based testing, benchmarking, CI/CD patterns","breadcrumbs":"Development Overview » Integration and APIs","id":"1195","title":"Integration and APIs"},"1196":{"body":"Contributing - Guidelines, standards, review process, licensing","breadcrumbs":"Development Overview » Community","id":"1196","title":"Community"},"1197":{"body":"","breadcrumbs":"Development Overview » Quick Start Paths","id":"1197","title":"Quick Start Paths"},"1198":{"body":"Start with Custom Provider Development - includes template, credential patterns, error handling, tests, and publishing workflow.","breadcrumbs":"Development Overview » I want to build a custom provider","id":"1198","title":"I want to build a custom provider"},"1199":{"body":"See Custom Detector Development - covers analysis frameworks, state tracking, testing, and marketplace distribution.","breadcrumbs":"Development Overview » I want to create custom detectors","id":"1199","title":"I want to create custom detectors"},"12":{"body":"Prerequisites - System requirements (Nushell 0.109.1+, Docker/Podman optional), cloud account setup, tool installation. Installation - Step-by-step installation: binary download, container, or source build with platform verification. Quick Start - 5-minute guide: install → configure → deploy infrastructure (requires 5 minutes and your AWS/UpCloud credentials). First Deployment - Deploy your first infrastructure: create workspace, configure provider, deploy resources, verify success. Verification - Validate installation: check system health, test CLI commands, verify cloud integration, confirm resource creation.","breadcrumbs":"Getting Started » Starting from Scratch","id":"12","title":"Starting from Scratch"},"120":{"body":"Verification - Comprehensive platform health checks Workspace Management - Advanced workspace patterns Batch Workflows - Multi-cloud orchestration Security System - Secure your infrastructure","breadcrumbs":"First Deployment » Next Steps","id":"120","title":"Next Steps"},"1200":{"body":"Read Plugin Development - FFI bindings, type safety, performance optimization, and integration patterns.","breadcrumbs":"Development Overview » I want to extend with Nushell","id":"1200","title":"I want to extend with Nushell"},"1201":{"body":"Study Provisioning Daemon Internals - architecture, caching strategy, connection pooling, metrics collection.","breadcrumbs":"Development Overview » I want to understand system performance","id":"1201","title":"I want to understand system performance"},"1202":{"body":"Check API Guide - REST endpoints, authentication, webhooks, and integration patterns.","breadcrumbs":"Development Overview » I want to integrate external systems","id":"1202","title":"I want to integrate external systems"},"1203":{"body":"Language : Rust (async/await with Tokio), Nushell (scripting) Configuration : Nickel (type-safe) + TOML (generated) Testing : Unit tests, integration tests, property-based tests Performance : Prometheus metrics, connection pooling, LRU caching Security : Post-quantum cryptography, type-safety, secure defaults","breadcrumbs":"Development Overview » Technology Stack","id":"1203","title":"Technology Stack"},"1204":{"body":"All development builds with: cargo build --release\\ncargo test --all\\ncargo clippy -- -D warnings","breadcrumbs":"Development Overview » Development Environment","id":"1204","title":"Development Environment"},"1205":{"body":"For architecture insights → See provisioning/docs/src/architecture/ For API details → See provisioning/docs/src/api-reference/ For examples → See provisioning/docs/src/examples/ For deployment → See provisioning/docs/src/operations/","breadcrumbs":"Development Overview » Navigation","id":"1205","title":"Navigation"},"1206":{"body":"Creating custom extensions to add providers, task services, and clusters to the Provisioning platform.","breadcrumbs":"Extension Development » Extension Development","id":"1206","title":"Extension Development"},"1207":{"body":"Extensions are modular components that extend platform capabilities: Extension Type Purpose Implementation Complexity Providers Cloud infrastructure backends Nushell scripts + Nickel schemas Moderate Task Services Infrastructure components Nushell installation scripts Simple Clusters Complete deployments Nickel schemas + orchestration Moderate Workflows Automation templates Nickel workflow definitions Simple","breadcrumbs":"Extension Development » Extension Overview","id":"1207","title":"Extension Overview"},"1208":{"body":"Standard extension directory layout: provisioning/extensions///\\n├── nickel/\\n│ ├── schema.ncl # Nickel type definitions\\n│ ├── defaults.ncl # Default configuration\\n│ └── validation.ncl # Validation rules\\n├── scripts/\\n│ ├── install.nu # Installation script\\n│ ├── uninstall.nu # Removal script\\n│ └── validate.nu # Validation script\\n├── templates/\\n│ └── config.template # Configuration templates\\n├── tests/\\n│ └── test_*.nu # Test scripts\\n├── docs/\\n│ └── README.md # Documentation\\n└── metadata.toml # Extension metadata","breadcrumbs":"Extension Development » Extension Structure","id":"1208","title":"Extension Structure"},"1209":{"body":"Every extension requires metadata.toml: # metadata.toml\\n[extension]\\nname = \\"my-provider\\"\\ntype = \\"provider\\"\\nversion = \\"1.0.0\\"\\ndescription = \\"Custom cloud provider\\"\\nauthor = \\"Your Name <[email@example.com](mailto:email@example.com)>\\"\\nlicense = \\"MIT\\" [dependencies]\\nnushell = \\">=0.109.0\\"\\nnickel = \\">=1.15.1\\" [dependencies.extensions]\\n# Other extensions this depends on\\nbase-provider = \\"1.0.0\\" [capabilities]\\ncreate_server = true\\ndelete_server = true\\ncreate_network = true [configuration]\\nrequired_fields = [\\"api_key\\", \\"region\\"]\\noptional_fields = [\\"timeout\\", \\"retry_attempts\\"]","breadcrumbs":"Extension Development » Extension Metadata","id":"1209","title":"Extension Metadata"},"121":{"body":"Validate the Provisioning platform installation and infrastructure health.","breadcrumbs":"Verification » Verification","id":"121","title":"Verification"},"1210":{"body":"Providers implement cloud infrastructure backends.","breadcrumbs":"Extension Development » Creating a Provider Extension","id":"1210","title":"Creating a Provider Extension"},"1211":{"body":"provisioning/extensions/providers/my-provider/\\n├── nickel/\\n│ ├── schema.ncl\\n│ ├── server.ncl\\n│ └── network.ncl\\n├── scripts/\\n│ ├── create_server.nu\\n│ ├── delete_server.nu\\n│ ├── list_servers.nu\\n│ └── validate.nu\\n├── templates/\\n│ └── server.template\\n├── tests/\\n│ └── test_provider.nu\\n└── metadata.toml","breadcrumbs":"Extension Development » Provider Structure","id":"1211","title":"Provider Structure"},"1212":{"body":"# nickel/schema.ncl\\n{ Provider = { name | String, api_key | String, region | String, timeout | default = 30 | Number, server_config = { default_plan | default = \\"medium\\" | String, allowed_plans | Array String, }, }, Server = { name | String, plan | String, zone | String, hostname | String, tags | default = [] | Array String, },\\n}","breadcrumbs":"Extension Development » Provider Schema (Nickel)","id":"1212","title":"Provider Schema (Nickel)"},"1213":{"body":"# scripts/create_server.nu\\n#!/usr/bin/env nu # Create server using provider API\\nexport def main [ config: record # Provider configuration server: record # Server specification\\n] { # Validate configuration validate-config $config # Construct API request let request = { name: $server.name plan: $server.plan zone: $server.zone } # Call provider API let response = http post $\\"($config.api_endpoint)/servers\\" { headers: { Authorization: $\\"Bearer ($config.api_key)\\" } body: ($request | to json) } # Return server details $response | from json\\n} # Validate provider configuration\\ndef validate-config [config: record] { if ($config.api_key | is-empty) { error make {msg: \\"api_key is required\\"} } if ($config.region | is-empty) { error make {msg: \\"region is required\\"} }\\n}","breadcrumbs":"Extension Development » Provider Implementation (Nushell)","id":"1213","title":"Provider Implementation (Nushell)"},"1214":{"body":"All providers must implement: # Required operations\\ncreate_server # Create new server\\ndelete_server # Delete existing server\\nget_server # Get server details\\nlist_servers # List all servers\\nserver_status # Check server status # Optional operations\\ncreate_network # Create network\\ndelete_network # Delete network\\nattach_storage # Attach storage volume\\ncreate_snapshot # Create server snapshot","breadcrumbs":"Extension Development » Provider Interface Contract","id":"1214","title":"Provider Interface Contract"},"1215":{"body":"Task services are installable infrastructure components.","breadcrumbs":"Extension Development » Creating a Task Service Extension","id":"1215","title":"Creating a Task Service Extension"},"1216":{"body":"provisioning/extensions/taskservs/my-service/\\n├── nickel/\\n│ ├── schema.ncl\\n│ └── defaults.ncl\\n├── scripts/\\n│ ├── install.nu\\n│ ├── uninstall.nu\\n│ ├── health.nu\\n│ └── validate.nu\\n├── templates/\\n│ ├── config.yaml.template\\n│ └── systemd.service.template\\n├── tests/\\n│ └── test_service.nu\\n├── docs/\\n│ └── README.md\\n└── metadata.toml","breadcrumbs":"Extension Development » Task Service Structure","id":"1216","title":"Task Service Structure"},"1217":{"body":"# metadata.toml\\n[extension]\\nname = \\"my-service\\"\\ntype = \\"taskserv\\"\\nversion = \\"2.1.0\\"\\ndescription = \\"Custom infrastructure service\\" [dependencies.taskservs]\\n# Task services this depends on\\ncontainerd = \\">=1.7.0\\"\\nkubernetes = \\">=1.28.0\\" [installation]\\nrequires_root = true\\nplatforms = [\\"linux\\"]\\narchitectures = [\\"x86_64\\", \\"aarch64\\"] [health_check]\\nenabled = true\\nendpoint = \\" [http://localhost:8000/health\\"](http://localhost:8000/health\\")\\ninterval = 30\\ntimeout = 5","breadcrumbs":"Extension Development » Task Service Metadata","id":"1217","title":"Task Service Metadata"},"1218":{"body":"# scripts/install.nu\\n#!/usr/bin/env nu export def main [ config: record # Service configuration server: record # Target server details\\n] { print \\"Installing my-service...\\" # Download binaries let version = $config.version? | default \\"latest\\" download-binary $version # Install systemd service install-systemd-service $config # Configure service generate-config $config # Start service start-service # Verify installation verify-installation print \\"Installation complete\\"\\n} def download-binary [version: string] { let url = $\\" [https://github.com/org/my-service/releases/download/($versio](https://github.com/org/my-service/releases/download/($versio)n)/my-service\\" http get $url | save /usr/local/bin/my-service chmod +x /usr/local/bin/my-service\\n} def install-systemd-service [config: record] { let template = open ../templates/systemd.service.template let rendered = $template | str replace --all \\"{{VERSION}}\\" $config.version $rendered | save /etc/systemd/system/my-service.service systemctl daemon-reload\\n} def start-service [] { systemctl enable my-service systemctl start my-service\\n} def verify-installation [] { let status = systemctl is-active my-service if $status != \\"active\\" { error make {msg: \\"Service failed to start\\"} } # Health check sleep 5sec let health = http get [http://localhost:8000/health](http://localhost:8000/health) if $health.status != \\"healthy\\" { error make {msg: \\"Health check failed\\"} }\\n}","breadcrumbs":"Extension Development » Task Service Installation Script","id":"1218","title":"Task Service Installation Script"},"1219":{"body":"Clusters combine servers and task services into complete deployments.","breadcrumbs":"Extension Development » Creating a Cluster Extension","id":"1219","title":"Creating a Cluster Extension"},"122":{"body":"","breadcrumbs":"Verification » Installation Verification","id":"122","title":"Installation Verification"},"1220":{"body":"# nickel/schema.ncl\\n{ Cluster = { metadata = { name | String, provider | String, environment | default = \\"production\\" | String, }, infrastructure = { servers | Array { name | String, role | | [ \\"control\\", \\"worker\\", \\"storage\\" | ], plan | String, }, }, services = { taskservs | Array String, order | default = [] | Array String, }, networking = { private_network | default = true | Bool, cidr | default = \\"10.0.0.0/16\\" | String, }, },\\n}","breadcrumbs":"Extension Development » Cluster Schema","id":"1220","title":"Cluster Schema"},"1221":{"body":"# clusters/kubernetes-ha.ncl\\n{ metadata.name = \\"k8s-ha-cluster\\", metadata.provider = \\"upcloud\\", infrastructure.servers = [ {name = \\"control-01\\", role = \\"control\\", plan = \\"large\\"}, {name = \\"control-02\\", role = \\"control\\", plan = \\"large\\"}, {name = \\"control-03\\", role = \\"control\\", plan = \\"large\\"}, {name = \\"worker-01\\", role = \\"worker\\", plan = \\"xlarge\\"}, {name = \\"worker-02\\", role = \\"worker\\", plan = \\"xlarge\\"}, ], services.taskservs = [\\"containerd\\", \\"etcd\\", \\"kubernetes\\", \\"cilium\\"], services.order = [\\"containerd\\", \\"etcd\\", \\"kubernetes\\", \\"cilium\\"], networking.private_network = true, networking.cidr = \\"10.100.0.0/16\\",\\n}","breadcrumbs":"Extension Development » Cluster Definition Example","id":"1221","title":"Cluster Definition Example"},"1222":{"body":"","breadcrumbs":"Extension Development » Extension Testing","id":"1222","title":"Extension Testing"},"1223":{"body":"# tests/test_provider.nu\\nuse std assert # Test provider configuration validation\\nexport def test_validate_config [] { let valid_config = { api_key: \\"test-key\\" region: \\"us-east-1\\" } let result = validate-config $valid_config assert equal $result.valid true\\n} # Test server creation\\nexport def test_create_server [] { let config = load-test-config let server_spec = { name: \\"test-server\\" plan: \\"medium\\" zone: \\"us-east-1a\\" } let result = create-server $config $server_spec assert equal $result.status \\"created\\"\\n} # Run all tests\\nexport def main [] { test_validate_config test_create_server print \\"All tests passed\\"\\n} Run tests: # Test extension\\nprovisioning extension test my-provider # Test specific component\\nnu tests/test_provider.nu","breadcrumbs":"Extension Development » Test Structure","id":"1223","title":"Test Structure"},"1224":{"body":"","breadcrumbs":"Extension Development » Extension Packaging","id":"1224","title":"Extension Packaging"},"1225":{"body":"Package and publish extension: # Build extension package\\nprovisioning extension build my-provider # Validate package\\nprovisioning extension validate my-provider-1.0.0.tar.gz # Publish to registry\\nprovisioning extension publish my-provider-1.0.0.tar.gz \\\\ --registry registry.example.com Package structure: my-provider-1.0.0.tar.gz\\n├── metadata.toml\\n├── nickel/\\n├── scripts/\\n├── templates/\\n├── tests/\\n├── docs/\\n└── manifest.json","breadcrumbs":"Extension Development » OCI Registry Publishing","id":"1225","title":"OCI Registry Publishing"},"1226":{"body":"Install extension from registry: # Install from OCI registry\\nprovisioning extension install my-provider --version 1.0.0 # Install from local file\\nprovisioning extension install ./my-provider-1.0.0.tar.gz # List installed extensions\\nprovisioning extension list # Update extension\\nprovisioning extension update my-provider --version 1.1.0 # Uninstall extension\\nprovisioning extension uninstall my-provider","breadcrumbs":"Extension Development » Extension Installation","id":"1226","title":"Extension Installation"},"1227":{"body":"Follow naming conventions: lowercase with hyphens Version extensions semantically (semver) Document all configuration options Provide comprehensive tests Include usage examples in docs Validate input parameters Handle errors gracefully Log important operations Support idempotent operations Keep dependencies minimal","breadcrumbs":"Extension Development » Best Practices","id":"1227","title":"Best Practices"},"1228":{"body":"Provider Development - Provider specifics Nickel Guide - Nickel language Build System - Building extensions Testing - Testing strategies","breadcrumbs":"Extension Development » Related Documentation","id":"1228","title":"Related Documentation"},"1229":{"body":"Implementing custom cloud provider integrations for the Provisioning platform.","breadcrumbs":"Provider Development » Provider Development","id":"1229","title":"Provider Development"},"123":{"body":"# Check CLI version\\nprovisioning version # Verify Nushell\\nnu --version # 0.109.1+ # Verify Nickel\\nnickel --version # 1.15.1+ # Check SOPS and Age\\nsops --version # 3.10.2+\\nage --version # 1.2.1+ # Verify K9s\\nk9s version # 0.50.6+","breadcrumbs":"Verification » CLI and Core Tools","id":"123","title":"CLI and Core Tools"},"1230":{"body":"Providers abstract cloud infrastructure APIs through a unified interface, allowing infrastructure definitions to be portable across clouds.","breadcrumbs":"Provider Development » Provider Architecture","id":"1230","title":"Provider Architecture"},"1231":{"body":"All providers must implement these core operations: # Server lifecycle\\ncreate_server # Provision new server\\ndelete_server # Remove server\\nget_server # Fetch server details\\nlist_servers # List all servers\\nupdate_server # Modify server configuration\\nserver_status # Get current state # Network operations (optional)\\ncreate_network # Create private network\\ndelete_network # Remove network\\nattach_network # Attach server to network # Storage operations (optional)\\nattach_volume # Attach storage volume\\ndetach_volume # Detach storage volume\\ncreate_snapshot # Snapshot server disk","breadcrumbs":"Provider Development » Provider Interface","id":"1231","title":"Provider Interface"},"1232":{"body":"Use the official provider template: # Generate provider scaffolding\\nprovisioning generate provider --name my-cloud --template standard # Creates:\\n# extensions/providers/my-cloud/\\n# ├── nickel/\\n# │ ├── schema.ncl\\n# │ ├── server.ncl\\n# │ └── network.ncl\\n# ├── scripts/\\n# │ ├── create_server.nu\\n# │ ├── delete_server.nu\\n# │ └── list_servers.nu\\n# └── metadata.toml","breadcrumbs":"Provider Development » Provider Template","id":"1232","title":"Provider Template"},"1233":{"body":"Define provider configuration schema: # nickel/schema.ncl\\n{ ProviderConfig = { name | String, api_endpoint | String, api_key | String, region | String, timeout | default = 30 | Number, retry_attempts | default = 3 | Number, plans = { small = {cpu = 2, memory = 4096, disk = 25}, medium = {cpu = 4, memory = 8192, disk = 50}, large = {cpu = 8, memory = 16384, disk = 100}, }, regions | Array String, }, ServerSpec = { name | String, plan | String, zone | String, image | default = \\"ubuntu-24.04\\" | String, ssh_keys | Array String, user_data | default = \\"\\" | String, },\\n}","breadcrumbs":"Provider Development » Provider Schema (Nickel)","id":"1233","title":"Provider Schema (Nickel)"},"1234":{"body":"Create server implementation: # scripts/create_server.nu\\n#!/usr/bin/env nu export def main [ config: record, # Provider configuration spec: record # Server specification\\n]: nothing -> record { # Validate inputs validate-provider-config $config validate-server-spec $spec # Map plan to provider-specific values let plan = get-plan-details $config $spec.plan # Construct API request let request = { hostname: $spec.name plan: $plan.name zone: $spec.zone storage_devices: [{ action: \\"create\\" storage: $plan.disk title: \\"root\\" }] login: { user: \\"root\\" keys: $spec.ssh_keys } } # Call provider API with retry logic let server = retry-api-call | { | http post $\\"($config.api_endpoint)/server\\" { headers: {Authorization: $\\"Bearer ($config.api_key)\\"} body: ($request | to json) } | from json } $config.retry_attempts # Wait for server to be ready wait-for-server-ready $config $server.uuid # Return server details { id: $server.uuid name: $server.hostname ip_address: $server.ip_addresses.0.address status: \\"running\\" provider: $config.name }\\n} def validate-provider-config [config: record] { if ($config.api_key | is-empty) { error make {msg: \\"API key required\\"} } if ($config.region | is-empty) { error make {msg: \\"Region required\\"} }\\n} def get-plan-details [config: record, plan_name: string]: nothing -> record { $config.plans | get $plan_name\\n} def retry-api-call [operation: closure, max_attempts: int]: nothing -> any { mut attempt = 1 mut last_error = null while $attempt <= $max_attempts { try { return (do $operation) } catch | { err | $last_error = $err if $attempt < $max_attempts { sleep (1sec * $attempt) # Exponential backoff $attempt = $attempt + 1 } } } error make {msg: $\\"API call failed after ($max_attempts) attempts: ($last_error)\\"}\\n} def wait-for-server-ready [config: record, server_id: string] { mut ready = false mut attempts = 0 let max_wait = 120 # 2 minutes while not $ready and $attempts < $max_wait { let status = http get $\\"($config.api_endpoint)/server/($server_id)\\" { headers: {Authorization: $\\"Bearer ($config.api_key)\\"} } | from json if $status.state == \\"started\\" { $ready = true } else { sleep 1sec $attempts = $attempts + 1 } } if not $ready { error make {msg: \\"Server failed to start within timeout\\"} }\\n}","breadcrumbs":"Provider Development » Implementing Server Creation","id":"1234","title":"Implementing Server Creation"},"1235":{"body":"Comprehensive provider testing: # tests/test_provider.nu\\nuse std assert export def test_create_server [] { # Mock provider config let config = { name: \\"test-cloud\\" api_endpoint: \\" [http://localhost:8080\\"](http://localhost:8080\\") api_key: \\"test-key\\" region: \\"test-region\\" plans: { small: {cpu: 2, memory: 4096, disk: 25} } } # Mock server spec let spec = { name: \\"test-server\\" plan: \\"small\\" zone: \\"test-zone\\" ssh_keys: [\\"ssh-rsa AAAA...\\"] } # Test server creation let server = create-server $config $spec assert ($server.id != null) assert ($server.name == \\"test-server\\") assert ($server.status == \\"running\\")\\n} export def test_list_servers [] { let config = load-test-config let servers = list-servers $config assert ($servers | length) > 0\\n} export def main [] { print \\"Running provider tests...\\" test_create_server test_list_servers print \\"All tests passed!\\"\\n}","breadcrumbs":"Provider Development » Provider Testing","id":"1235","title":"Provider Testing"},"1236":{"body":"Robust error handling for provider operations: # Handle API errors gracefully\\ndef handle-api-error [error: record]: nothing -> record { match $error.status { 401 => {error make {msg: \\"Authentication failed - check API key\\"}} 403 => {error make {msg: \\"Permission denied - insufficient privileges\\"}} 404 => {error make {msg: \\"Resource not found\\"}} 429 => {error make {msg: \\"Rate limit exceeded - retry later\\"}} 500 => {error make {msg: \\"Provider API error - contact support\\"}} _ => {error make {msg: $\\"Unknown error: ($error.message)\\"}} }\\n}","breadcrumbs":"Provider Development » Error Handling","id":"1236","title":"Error Handling"},"1237":{"body":"Implement idempotent operations where possible Handle rate limiting with exponential backoff Validate all inputs before API calls Log all API requests and responses (without secrets) Use connection pooling for better performance Cache provider capabilities and quotas Implement proper timeout handling Return consistent error messages Test against provider sandbox/staging environment Version provider schemas carefully","breadcrumbs":"Provider Development » Provider Best Practices","id":"1237","title":"Provider Best Practices"},"1238":{"body":"Extension Development - Extension basics API Guide - REST API patterns Testing - Testing strategies","breadcrumbs":"Provider Development » Related Documentation","id":"1238","title":"Related Documentation"},"1239":{"body":"Developing Nushell plugins for performance-critical operations in the Provisioning platform.","breadcrumbs":"Plugin Development » Plugin Development","id":"1239","title":"Plugin Development"},"124":{"body":"# Validate all configuration files\\nprovisioning validate config # Check environment\\nprovisioning env # Show all configuration\\nprovisioning allenv Expected output: Configuration validation: PASSED - User config: ~/.config/provisioning/user_config.yaml ✓ - System defaults: provisioning/config/config.defaults.toml ✓ - Provider credentials: configured ✓","breadcrumbs":"Verification » Configuration Validation","id":"124","title":"Configuration Validation"},"1240":{"body":"Nushell plugins provide 10-50x performance improvement over HTTP APIs through native Rust implementations.","breadcrumbs":"Plugin Development » Plugin Overview","id":"1240","title":"Plugin Overview"},"1241":{"body":"Plugin Purpose Performance Gain Language nu_plugin_auth Authentication and OS keyring 5x faster Rust nu_plugin_kms KMS encryption operations 10x faster Rust nu_plugin_orchestrator Orchestrator queries 30x faster Rust","breadcrumbs":"Plugin Development » Available Plugins","id":"1241","title":"Available Plugins"},"1242":{"body":"Plugins communicate with Nushell via MessagePack protocol: Nushell ←→ MessagePack ←→ Plugin Process ↓ ↓\\nScript Native Rust","breadcrumbs":"Plugin Development » Plugin Architecture","id":"1242","title":"Plugin Architecture"},"1243":{"body":"","breadcrumbs":"Plugin Development » Creating a Plugin","id":"1243","title":"Creating a Plugin"},"1244":{"body":"Generate plugin scaffold: # Create new plugin\\ncargo new --lib nu_plugin_myfeature\\ncd nu_plugin_myfeature Add dependencies to Cargo.toml: [package]\\nname = \\"nu_plugin_myfeature\\"\\nversion = \\"0.1.0\\"\\nedition = \\"2021\\" [dependencies]\\nnu-plugin = \\"0.109.0\\"\\nnu-protocol = \\"0.109.0\\"\\nserde = {version = \\"1.0\\", features = [\\"derive\\"]}","breadcrumbs":"Plugin Development » Plugin Template","id":"1244","title":"Plugin Template"},"1245":{"body":"Implement plugin interface: // src/lib.rs\\nuse nu_plugin::{EvaluatedCall, LabeledError, Plugin};\\nuse nu_protocol::{Category, PluginSignature, SyntaxShape, Type, Value}; pub struct MyFeaturePlugin; impl Plugin for MyFeaturePlugin { fn signature(&self) -> Vec { vec![ PluginSignature::build(\\"my-feature\\") .usage(\\"Perform my feature operation\\") .required(\\"input\\", SyntaxShape::String, \\"input value\\") .input_output_type(Type::String, Type::String) .category(Category::Custom(\\"provisioning\\".into())), ] } fn run( &mut self, name: &str, call: &EvaluatedCall, input: &Value, ) -> Result { match name { \\"my-feature\\" => self.my_feature(call, input), _ => Err(LabeledError { label: \\"Unknown command\\".into(), msg: format!(\\"Unknown command: {}\\", name), span: None, }), } }\\n} impl MyFeaturePlugin { fn my_feature(&self, call: &EvaluatedCall, _input: &Value) -> Result { let input: String = call.req(0)?; // Perform operation let result = perform_operation(&input); Ok(Value::string(result, call.head)) }\\n} fn perform_operation(input: &str) -> String { // Your implementation here format!(\\"Processed: {}\\", input)\\n} // Plugin entry point\\nfn main() { nu_plugin::serve_plugin(&mut MyFeaturePlugin, nu_plugin::MsgPackSerializer {})\\n}","breadcrumbs":"Plugin Development » Plugin Implementation","id":"1245","title":"Plugin Implementation"},"1246":{"body":"# Build release version\\ncargo build --release # Install plugin\\nnu -c \'plugin add target/release/nu_plugin_myfeature\'\\nnu -c \'plugin use myfeature\' # Test plugin\\nnu -c \'my-feature \\"test input\\"\'","breadcrumbs":"Plugin Development » Building Plugin","id":"1246","title":"Building Plugin"},"1247":{"body":"","breadcrumbs":"Plugin Development » Plugin Performance Optimization","id":"1247","title":"Plugin Performance Optimization"},"1248":{"body":"use std::time::Instant; pub fn benchmark_operation() { let start = Instant::now(); // Operation to benchmark perform_expensive_operation(); let duration = start.elapsed(); eprintln!(\\"Operation took: {:?}\\", duration);\\n}","breadcrumbs":"Plugin Development » Benchmarking","id":"1248","title":"Benchmarking"},"1249":{"body":"Implement caching for expensive operations: use std::collections::HashMap;\\nuse std::sync::{Arc, Mutex}; pub struct CachedPlugin { cache: Arc>>,\\n} impl CachedPlugin { fn get_or_compute(&self, key: &str) -> String { let mut cache = self.cache.lock().unwrap(); if let Some(value) = cache.get(key) { return value.clone(); } let value = expensive_computation(key); cache.insert(key.to_string(), value.clone()); value }\\n}","breadcrumbs":"Plugin Development » Caching","id":"1249","title":"Caching"},"125":{"body":"# List available providers\\nprovisioning providers # Test provider connection (UpCloud example)\\nprovisioning provider test upcloud # Test provider connection (AWS example)\\nprovisioning provider test aws","breadcrumbs":"Verification » Provider Connectivity","id":"125","title":"Provider Connectivity"},"1250":{"body":"","breadcrumbs":"Plugin Development » Testing Plugins","id":"1250","title":"Testing Plugins"},"1251":{"body":"#[cfg(test)]\\nmod tests { use super::*; use nu_protocol::{Span, Value}; #[test] fn test_my_feature() { let plugin = MyFeaturePlugin; let input = Value::string(\\"test\\", Span::test_data()); let result = plugin.my_feature(&mock_call(), &input).unwrap(); assert_eq!(result.as_string().unwrap(), \\"Processed: test\\"); } fn mock_call() -> EvaluatedCall { // Mock EvaluatedCall for testing todo!() }\\n}","breadcrumbs":"Plugin Development » Unit Tests","id":"1251","title":"Unit Tests"},"1252":{"body":"# tests/test_plugin.nu\\nuse std assert def test_plugin_functionality [] { let result = my-feature \\"test input\\" assert equal $result \\"Processed: test input\\"\\n} def main [] { test_plugin_functionality print \\"Plugin tests passed\\"\\n}","breadcrumbs":"Plugin Development » Integration Tests","id":"1252","title":"Integration Tests"},"1253":{"body":"Keep plugin logic focused and single-purpose Minimize dependencies to reduce binary size Use async operations for I/O-bound tasks Implement proper error handling Document all plugin commands Version plugins with semantic versioning Provide fallback to HTTP API if plugin unavailable Cache expensive computations Profile and benchmark performance improvements","breadcrumbs":"Plugin Development » Plugin Best Practices","id":"1253","title":"Plugin Best Practices"},"1254":{"body":"Build System - Building Rust plugins Extension Development - Extension basics Testing - Testing strategies","breadcrumbs":"Plugin Development » Related Documentation","id":"1254","title":"Related Documentation"},"1255":{"body":"Integrate third-party APIs with Provisioning infrastructure.","breadcrumbs":"API Guide » API Integration Guide","id":"1255","title":"API Integration Guide"},"1256":{"body":"Create clients for external APIs: // src/api_client.rs\\nuse reqwest::Client; pub struct ApiClient { endpoint: String, api_key: String, client: Client,\\n} impl ApiClient { pub async fn call(&self, path: &str) -> Result { let url = format!(\\"{}{}\\", self.endpoint, path); self.client .get(&url) .bearer_auth(&self.api_key) .send() .await }\\n}","breadcrumbs":"API Guide » API Client Development","id":"1256","title":"API Client Development"},"1257":{"body":"Handle webhooks from external systems: #[post(\\"/webhooks/{service}\\")]\\npub async fn handle_webhook(path: web::Path, body: web::Bytes) -> impl Responder { let service = path.into_inner(); match service.as_str() { \\"github\\" => handle_github_webhook(&body), \\"stripe\\" => handle_stripe_webhook(&body), _ => HttpResponse::NotFound().finish(), }\\n}","breadcrumbs":"API Guide » Webhook Integration","id":"1257","title":"Webhook Integration"},"1258":{"body":"Robust error handling for API calls with retries: pub async fn call_api_with_retry( client: &ApiClient, path: &str, max_retries: u32,\\n) -> Result { for attempt in 0..max_retries { match client.call(path).await { Ok(response) => return Ok(response), Err(e) if attempt < max_retries - 1 => { let delay = Duration::from_secs(2_u64.pow(attempt)); tokio::time::sleep(delay).await; } Err(e) => return Err(e), } } Err(ApiError::MaxRetriesExceeded.into())\\n}","breadcrumbs":"API Guide » Error Handling","id":"1258","title":"Error Handling"},"1259":{"body":"Extension Development REST API Reference","breadcrumbs":"API Guide » Related Documentation","id":"1259","title":"Related Documentation"},"126":{"body":"","breadcrumbs":"Verification » Workspace Verification","id":"126","title":"Workspace Verification"},"1260":{"body":"Building, testing, and packaging the Provisioning platform and extensions with Cargo, Just, and Nickel.","breadcrumbs":"Build System » Build System","id":"1260","title":"Build System"},"1261":{"body":"Tool Purpose Version Required Cargo Rust compilation and testing Latest stable Just Task runner for common operations Latest Nickel Schema validation and type checking 1.15.1+ Nushell Script execution and testing 0.109.0+","breadcrumbs":"Build System » Build Tools","id":"1261","title":"Build Tools"},"1262":{"body":"","breadcrumbs":"Build System » Building Platform Services","id":"1262","title":"Building Platform Services"},"1263":{"body":"# Build all Rust services in release mode\\ncd provisioning/platform\\ncargo build --release --workspace # Or using just task runner\\njust build-platform Binary outputs in target/release/: provisioning-orchestrator provisioning-control-center provisioning-vault-service provisioning-installer","breadcrumbs":"Build System » Build All Services","id":"1263","title":"Build All Services"},"1264":{"body":"# Orchestrator service\\ncd provisioning/platform/crates/orchestrator\\ncargo build --release # Control Center service\\ncd provisioning/platform/crates/control-center\\ncargo build --release # Development build (faster compilation)\\ncargo build","breadcrumbs":"Build System » Build Individual Service","id":"1264","title":"Build Individual Service"},"1265":{"body":"","breadcrumbs":"Build System » Testing","id":"1265","title":"Testing"},"1266":{"body":"# Rust unit and integration tests\\ncargo test --workspace # Nushell script tests\\njust test-nushell # Complete test suite\\njust test-all","breadcrumbs":"Build System » Run All Tests","id":"1266","title":"Run All Tests"},"1267":{"body":"# Test orchestrator crate\\ncargo test -p provisioning-orchestrator # Test with output visible\\ncargo test -p provisioning-orchestrator -- --nocapture # Test specific function\\ncargo test -p provisioning-orchestrator test_workflow_creation # Run tests matching pattern\\ncargo test workflow","breadcrumbs":"Build System » Test Specific Component","id":"1267","title":"Test Specific Component"},"1268":{"body":"# Run 350+ security test cases\\ncargo test -p security --test \'*\' # Specific security component\\ncargo test -p security authentication\\ncargo test -p security authorization\\ncargo test -p security kms","breadcrumbs":"Build System » Security Tests","id":"1268","title":"Security Tests"},"1269":{"body":"","breadcrumbs":"Build System » Code Quality","id":"1269","title":"Code Quality"},"127":{"body":"# List workspaces\\nprovisioning workspace list # Show current workspace\\nprovisioning workspace current # Verify workspace structure\\nls -la / Expected structure: workspace-name/\\n├── infra/ # Infrastructure Nickel schemas\\n├── config/ # Workspace configuration\\n├── extensions/ # Custom extensions\\n└── runtime/ # State and logs","breadcrumbs":"Verification » Workspace Structure","id":"127","title":"Workspace Structure"},"1270":{"body":"# Format all Rust code\\ncargo fmt --all # Check formatting without modifying\\ncargo fmt --all -- --check # Format Nickel schemas\\nnickel fmt provisioning/schemas/**/*.ncl","breadcrumbs":"Build System » Formatting","id":"1270","title":"Formatting"},"1271":{"body":"# Run Clippy linter\\ncargo clippy --all -- -D warnings # Auto-fix Clippy warnings\\ncargo clippy --all --fix # Clippy with all features enabled\\ncargo clippy --all --all-features -- -D warnings","breadcrumbs":"Build System » Linting","id":"1271","title":"Linting"},"1272":{"body":"# Type check Nickel schemas\\nnickel typecheck provisioning/schemas/main.ncl # Evaluate schema\\nnickel eval provisioning/schemas/main.ncl # Format Nickel files\\nnickel fmt provisioning/schemas/**/*.ncl","breadcrumbs":"Build System » Nickel Validation","id":"1272","title":"Nickel Validation"},"1273":{"body":"The platform uses automated CI workflows for quality assurance.","breadcrumbs":"Build System » Continuous Integration","id":"1273","title":"Continuous Integration"},"1274":{"body":"Key CI jobs: 1. Rust Build and Test - cargo build --release --workspace - cargo test --workspace - cargo clippy --all -- -D warnings 2. Nushell Validation - nu --check core/cli/provisioning - Run Nushell test suite 3. Nickel Schema Validation - nickel typecheck schemas/main.ncl - Validate all schema files 4. Security Tests - Run 350+ security test cases - Vulnerability scanning 5. Documentation Build - mdbook build docs - Markdown linting","breadcrumbs":"Build System » GitHub Actions Pipeline","id":"1274","title":"GitHub Actions Pipeline"},"1275":{"body":"","breadcrumbs":"Build System » Packaging and Distribution","id":"1275","title":"Packaging and Distribution"},"1276":{"body":"# Build optimized binaries\\ncargo build --release --workspace # Strip debug symbols (reduce binary size)\\nstrip target/release/provisioning-orchestrator\\nstrip target/release/provisioning-control-center # Create distribution archive\\njust package","breadcrumbs":"Build System » Create Release Package","id":"1276","title":"Create Release Package"},"1277":{"body":"provisioning-5.0.0-linux-x86_64.tar.gz\\n├── bin/\\n│ ├── provisioning # Main CLI\\n│ ├── provisioning-orchestrator # Orchestrator service\\n│ ├── provisioning-control-center # Control Center\\n│ ├── provisioning-vault-service # Vault service\\n│ └── provisioning-installer # Platform installer\\n├── lib/\\n│ └── nulib/ # Nushell libraries\\n├── schemas/ # Nickel schemas\\n├── config/\\n│ └── config.defaults.toml # Default configuration\\n├── systemd/\\n│ └── *.service # Systemd unit files\\n└── README.md","breadcrumbs":"Build System » Package Structure","id":"1277","title":"Package Structure"},"1278":{"body":"","breadcrumbs":"Build System » Cross-Platform Builds","id":"1278","title":"Cross-Platform Builds"},"1279":{"body":"# Linux x86_64 (primary platform)\\ncargo build --release --target x86_64-unknown-linux-gnu # Linux ARM64 (Raspberry Pi, cloud ARM instances)\\ncargo build --release --target aarch64-unknown-linux-gnu # macOS x86_64\\ncargo build --release --target x86_64-apple-darwin # macOS ARM64 (Apple Silicon)\\ncargo build --release --target aarch64-apple-darwin","breadcrumbs":"Build System » Supported Targets","id":"1279","title":"Supported Targets"},"128":{"body":"# Show workspace configuration\\nprovisioning config show # Validate workspace-specific config\\nprovisioning validate config --workspace ","breadcrumbs":"Verification » Workspace Configuration","id":"128","title":"Workspace Configuration"},"1280":{"body":"# Add target architectures\\nrustup target add x86_64-unknown-linux-gnu\\nrustup target add aarch64-unknown-linux-gnu # Install cross-compilation tool\\ncargo install cross # Cross-compile with Docker\\ncross build --release --target aarch64-unknown-linux-gnu","breadcrumbs":"Build System » Cross-Compilation Setup","id":"1280","title":"Cross-Compilation Setup"},"1281":{"body":"Common build tasks in justfile: # Build all components\\nbuild-all: build-platform build-plugins # Build platform services\\nbuild-platform: cd platform && cargo build --release --workspace # Run all tests\\ntest: test-rust test-nushell test-integration # Test Rust code\\ntest-rust: cargo test --workspace # Test Nushell scripts\\ntest-nushell: nu scripts/test/test_all.nu # Format all code\\nfmt: cargo fmt --all nickel fmt schemas/**/*.ncl # Lint all code\\nlint: cargo clippy --all -- -D warnings nickel typecheck schemas/main.ncl # Create release package\\npackage: ./scripts/package.nu # Clean build artifacts\\nclean: cargo clean rm -rf target/ Usage examples: just build-all # Build everything\\njust test # Run all tests\\njust fmt # Format code\\njust lint # Run linters\\njust package # Create distribution\\njust clean # Remove artifacts","breadcrumbs":"Build System » Just Task Runner","id":"1281","title":"Just Task Runner"},"1282":{"body":"","breadcrumbs":"Build System » Performance Optimization","id":"1282","title":"Performance Optimization"},"1283":{"body":"# Cargo.toml\\n[profile.release]\\nopt-level = 3 # Maximum optimization\\nlto = \\"fat\\" # Link-time optimization\\ncodegen-units = 1 # Better optimization, slower compile\\nstrip = true # Strip debug symbols\\npanic = \\"abort\\" # Smaller binary size","breadcrumbs":"Build System » Release Builds","id":"1283","title":"Release Builds"},"1284":{"body":"# Cargo.toml\\n[profile.dev]\\nopt-level = 1 # Basic optimization\\nincremental = true # Faster recompilation Speed up compilation: # Use faster linker (Linux)\\nsudo apt install lld\\nexport RUSTFLAGS=\\"-C link-arg=-fuse-ld=lld\\" # Parallel compilation\\ncargo build -j 8 # Use cargo-watch for auto-rebuild\\ncargo install cargo-watch\\ncargo watch -x build","breadcrumbs":"Build System » Build Time Optimization","id":"1284","title":"Build Time Optimization"},"1285":{"body":"","breadcrumbs":"Build System » Development Workflow","id":"1285","title":"Development Workflow"},"1286":{"body":"# 1. Start development\\njust clean\\njust build-all # 2. Make changes to code # 3. Test changes quickly\\ncargo check # Fast syntax check\\ncargo test # Test specific functionality # 4. Full validation before commit\\njust fmt\\njust lint\\njust test # 5. Create package for testing\\njust package","breadcrumbs":"Build System » Recommended Workflow","id":"1286","title":"Recommended Workflow"},"1287":{"body":"# Auto-rebuild on file changes\\ncargo watch -x build # Auto-test on changes\\ncargo watch -x test # Run service with auto-reload\\ncargo watch -x \'run --bin provisioning-orchestrator\'","breadcrumbs":"Build System » Hot Reload Development","id":"1287","title":"Hot Reload Development"},"1288":{"body":"","breadcrumbs":"Build System » Debugging Builds","id":"1288","title":"Debugging Builds"},"1289":{"body":"# Build with full debug info\\ncargo build # Build with debug info in release mode\\ncargo build --release --profile release-with-debug # Run with backtraces\\nRUST_BACKTRACE=1 cargo run\\nRUST_BACKTRACE=full cargo run","breadcrumbs":"Build System » Debug Information","id":"1289","title":"Debug Information"},"129":{"body":"","breadcrumbs":"Verification » Infrastructure Verification","id":"129","title":"Infrastructure Verification"},"1290":{"body":"# Verbose build output\\ncargo build -vv # Show build commands\\ncargo build -vvv # Show timing information\\ncargo build --timings","breadcrumbs":"Build System » Build Verbosity","id":"1290","title":"Build Verbosity"},"1291":{"body":"# View dependency tree\\ncargo tree # Duplicate dependencies\\ncargo tree --duplicates # Build graph visualization\\ncargo depgraph | dot -Tpng > deps.png","breadcrumbs":"Build System » Dependency Tree","id":"1291","title":"Dependency Tree"},"1292":{"body":"Always run just test before committing Use cargo fmt and cargo clippy for code quality Test on multiple platforms before release Strip binaries for production distributions Version binaries with semantic versioning Cache dependencies in CI/CD Use release profile for production builds Document build requirements in README Automate common tasks with Just Keep build times reasonable (<5 min)","breadcrumbs":"Build System » Best Practices","id":"1292","title":"Best Practices"},"1293":{"body":"","breadcrumbs":"Build System » Troubleshooting","id":"1293","title":"Troubleshooting"},"1294":{"body":"Compilation fails with linker error: # Install build dependencies\\nsudo apt install build-essential pkg-config libssl-dev Out of memory during build: # Reduce parallel jobs\\ncargo build -j 2 # Use more swap space\\nsudo fallocate -l 8G /swapfile\\nsudo mkswap /swapfile\\nsudo swapon /swapfile Clippy warnings: # Fix automatically where possible\\ncargo clippy --all --fix # Allow specific lints temporarily\\n#[allow(clippy::too_many_arguments)]","breadcrumbs":"Build System » Common Build Issues","id":"1294","title":"Common Build Issues"},"1295":{"body":"Testing - Testing strategies and procedures Contributing - Contribution guidelines including build requirements","breadcrumbs":"Build System » Related Documentation","id":"1295","title":"Related Documentation"},"1296":{"body":"Comprehensive testing strategies for the Provisioning platform including unit tests, integration tests, and 350+ security tests.","breadcrumbs":"Testing » Testing","id":"1296","title":"Testing"},"1297":{"body":"The platform maintains extensive test coverage across multiple test types: Test Type Count Coverage Target Average Runtime Unit Tests 200+ Core logic 80%+ < 5 seconds Integration Tests 100+ Component integration 60%+ < 30 seconds Security Tests 350+ Security components 100% < 60 seconds End-to-End Tests 50+ Full workflows < 5 minutes","breadcrumbs":"Testing » Testing Overview","id":"1297","title":"Testing Overview"},"1298":{"body":"","breadcrumbs":"Testing » Running Tests","id":"1298","title":"Running Tests"},"1299":{"body":"# Run complete test suite\\ncargo test --workspace # With output visible\\ncargo test --workspace -- --nocapture # Parallel execution with 8 threads\\ncargo test --workspace --jobs 8 # Include ignored tests\\ncargo test --workspace -- --ignored","breadcrumbs":"Testing » All Tests","id":"1299","title":"All Tests"},"13":{"body":"By completing this section, you\'ll know how to: ✅ Install and configure Provisioning ✅ Create your first workspace ✅ Configure cloud providers (AWS, UpCloud, Hetzner, etc.) ✅ Write simple Nickel infrastructure definitions ✅ Deploy infrastructure using Provisioning ✅ Verify and manage deployed resources","breadcrumbs":"Getting Started » What You\'ll Learn","id":"13","title":"What You\'ll Learn"},"130":{"body":"# List all servers\\nprovisioning server list # Check server status\\nprovisioning server status # Test SSH connectivity\\nprovisioning server ssh -- echo \\"Connection successful\\"","breadcrumbs":"Verification » Server Health","id":"130","title":"Server Health"},"1300":{"body":"# Unit tests only (--lib)\\ncargo test --lib # Integration tests only (--test)\\ncargo test --test \'*\' # Documentation tests\\ncargo test --doc # Security test suite\\ncargo test -p security --test \'*\'","breadcrumbs":"Testing » Test by Category","id":"1300","title":"Test by Category"},"1301":{"body":"# Test orchestrator crate\\ncargo test -p provisioning-orchestrator # Test control center\\ncargo test -p provisioning-control-center # Test specific module\\ncargo test -p provisioning-orchestrator workflows:: # Test specific function\\ncargo test -p provisioning-orchestrator test_workflow_creation","breadcrumbs":"Testing » Test Specific Component","id":"1301","title":"Test Specific Component"},"1302":{"body":"Unit tests verify individual functions and modules in isolation.","breadcrumbs":"Testing » Unit Testing","id":"1302","title":"Unit Testing"},"1303":{"body":"// src/workflows.rs\\n#[cfg(test)]\\nmod tests { use super::*; #[test] fn test_create_workflow() { let config = WorkflowConfig { name: \\"test-workflow\\".into(), tasks: vec![], }; let workflow = Workflow::new(config); assert_eq!(workflow.name(), \\"test-workflow\\"); assert_eq!(workflow.status(), WorkflowStatus::Pending); } #[test] fn test_workflow_execution() { let mut workflow = create_test_workflow(); let result = workflow.execute(); assert!(result.is_ok()); assert_eq!(workflow.status(), WorkflowStatus::Completed); } #[test] #[should_panic(expected = \\"Invalid workflow\\")] fn test_invalid_workflow() { Workflow::new(invalid_config()); }\\n}","breadcrumbs":"Testing » Rust Unit Tests","id":"1303","title":"Rust Unit Tests"},"1304":{"body":"# tests/test_provider.nu\\nuse std assert export def test_validate_config [] { let config = {api_key: \\"test-key\\", region: \\"us-east-1\\"} let result = validate-config $config assert equal $result.valid true\\n} export def test_create_server [] { let spec = {name: \\"test-server\\", plan: \\"medium\\"} let server = create-server test-config $spec assert ($server.id != null)\\n} export def main [] { test_validate_config test_create_server print \\"All tests passed\\"\\n} Run Nushell tests: nu tests/test_provider.nu","breadcrumbs":"Testing » Nushell Unit Tests","id":"1304","title":"Nushell Unit Tests"},"1305":{"body":"Integration tests verify components work together correctly.","breadcrumbs":"Testing » Integration Testing","id":"1305","title":"Integration Testing"},"1306":{"body":"// tests/orchestrator_integration.rs\\nuse provisioning_orchestrator::Orchestrator;\\nuse provisioning_database::Database; #[tokio::test]\\nasync fn test_workflow_persistence() { let db = Database::new_test().await; let orchestrator = Orchestrator::new(db.clone()); let workflow_id = orchestrator.create_workflow(test_config()).await.unwrap(); // Verify workflow persisted to database let workflow = db.get_workflow(&workflow_id).await.unwrap(); assert_eq!(workflow.id, workflow_id);\\n} #[tokio::test]\\nasync fn test_api_integration() { let app = create_test_app().await; let response = app .post(\\"/api/v1/workflows\\") .json(&test_workflow()) .send() .await .unwrap(); assert_eq!(response.status(), 201);\\n}","breadcrumbs":"Testing » Service Integration Tests","id":"1306","title":"Service Integration Tests"},"1307":{"body":"Use Docker containers for realistic integration testing: use testcontainers::*; #[tokio::test]\\nasync fn test_with_database() { let docker = clients::Cli::default(); let postgres = docker.run(images::postgres::Postgres::default()); let db_url = format!( \\"postgres://postgres@localhost:{}/test\\", postgres.get_host_port_ipv4(5432) ); // Run tests against real database let db = Database::connect(&db_url).await.unwrap(); // Test database operations...\\n}","breadcrumbs":"Testing » Test Containers","id":"1307","title":"Test Containers"},"1308":{"body":"Comprehensive security testing with 350+ test cases covering all security components.","breadcrumbs":"Testing » Security Testing","id":"1308","title":"Security Testing"},"1309":{"body":"#[tokio::test]\\nasync fn test_jwt_verification() { let auth = AuthService::new(); let token = auth.generate_token(\\"user123\\").unwrap(); let claims = auth.verify_token(&token).unwrap(); assert_eq!(claims.sub, \\"user123\\");\\n} #[tokio::test]\\nasync fn test_invalid_token() { let auth = AuthService::new(); let result = auth.verify_token(\\"invalid.token.here\\"); assert!(result.is_err());\\n} #[tokio::test]\\nasync fn test_token_expiration() { let auth = AuthService::new(); let token = create_expired_token(); let result = auth.verify_token(&token); assert!(matches!(result, Err(AuthError::TokenExpired)));\\n}","breadcrumbs":"Testing » Authentication Tests","id":"1309","title":"Authentication Tests"},"131":{"body":"# List installed task services\\nprovisioning taskserv list # Check service status\\nprovisioning taskserv status # Verify service health\\nprovisioning taskserv health ","breadcrumbs":"Verification » Task Service Health","id":"131","title":"Task Service Health"},"1310":{"body":"#[tokio::test]\\nasync fn test_rbac_enforcement() { let authz = AuthorizationService::new(); let decision = authz.authorize( \\"user:user123\\", \\"workflow:create\\", \\"resource:my-cluster\\" ).await; assert_eq!(decision, Decision::Allow);\\n} #[tokio::test]\\nasync fn test_policy_denial() { let authz = AuthorizationService::new(); let decision = authz.authorize( \\"user:guest\\", \\"server:delete\\", \\"resource:prod-server\\" ).await; assert_eq!(decision, Decision::Deny);\\n}","breadcrumbs":"Testing » Authorization Tests","id":"1310","title":"Authorization Tests"},"1311":{"body":"#[tokio::test]\\nasync fn test_kms_encryption() { let kms = KmsService::new(); let plaintext = b\\"secret data\\"; let ciphertext = kms.encrypt(plaintext).await.unwrap(); let decrypted = kms.decrypt(&ciphertext).await.unwrap(); assert_eq!(plaintext, decrypted.as_slice());\\n} #[tokio::test]\\nasync fn test_encryption_performance() { let kms = KmsService::new(); let plaintext = vec![0u8; 1024]; // 1KB let start = Instant::now(); kms.encrypt(&plaintext).await.unwrap(); let duration = start.elapsed(); // KMS encryption should complete in < 10ms assert!(duration < Duration::from_millis(10));\\n}","breadcrumbs":"Testing » Encryption Tests","id":"1311","title":"Encryption Tests"},"1312":{"body":"Complete workflow testing from start to finish.","breadcrumbs":"Testing » End-to-End Testing","id":"1312","title":"End-to-End Testing"},"1313":{"body":"#[tokio::test]\\nasync fn test_complete_workflow() { let platform = Platform::start_test_instance().await; // Create infrastructure let cluster_id = platform .create_cluster(test_cluster_config()) .await .unwrap(); // Wait for completion (5 minute timeout) platform .wait_for_cluster(&cluster_id, Duration::from_secs(300)) .await; // Verify cluster health let health = platform.check_cluster_health(&cluster_id).await; assert!(health.is_healthy()); // Cleanup platform.delete_cluster(&cluster_id).await.unwrap();\\n}","breadcrumbs":"Testing » Full Workflow Tests","id":"1313","title":"Full Workflow Tests"},"1314":{"body":"Shared test data and utilities.","breadcrumbs":"Testing » Test Fixtures","id":"1314","title":"Test Fixtures"},"1315":{"body":"// tests/fixtures/mod.rs\\npub fn test_workflow_config() -> WorkflowConfig { WorkflowConfig { name: \\"test-workflow\\".into(), tasks: vec![ Task::new(\\"task1\\", TaskType::CreateServer), Task::new(\\"task2\\", TaskType::InstallService), ], }\\n} pub fn test_server_spec() -> ServerSpec { ServerSpec { name: \\"test-server\\".into(), plan: \\"medium\\".into(), zone: \\"us-east-1a\\".into(), image: \\"ubuntu-24.04\\".into(), }\\n}","breadcrumbs":"Testing » Common Test Fixtures","id":"1315","title":"Common Test Fixtures"},"1316":{"body":"Mock external dependencies for isolated testing.","breadcrumbs":"Testing » Mocking","id":"1316","title":"Mocking"},"1317":{"body":"use mockall::*; #[automock]\\ntrait CloudProvider { async fn create_server(&self, spec: &ServerSpec) -> Result;\\n} #[tokio::test]\\nasync fn test_with_mock_provider() { let mut mock_provider = MockCloudProvider::new(); mock_provider .expect_create_server() .returning| ( | _ Ok(test_server())); let result = mock_provider.create_server(&test_spec()).await; assert!(result.is_ok());\\n}","breadcrumbs":"Testing » Mock External Services","id":"1317","title":"Mock External Services"},"1318":{"body":"Measure and maintain code coverage.","breadcrumbs":"Testing » Test Coverage","id":"1318","title":"Test Coverage"},"1319":{"body":"# Install tarpaulin\\ncargo install cargo-tarpaulin # Generate HTML coverage report\\ncargo tarpaulin --out Html --output-dir coverage # Generate multiple formats\\ncargo tarpaulin --out Html --out Xml --out Json # View coverage\\nopen coverage/index.html","breadcrumbs":"Testing » Generate Coverage Report","id":"1319","title":"Generate Coverage Report"},"132":{"body":"For Kubernetes clusters: # SSH to control plane\\nprovisioning server ssh # Check cluster nodes\\nkubectl get nodes # Check system pods\\nkubectl get pods -n kube-system # Check cluster info\\nkubectl cluster-info","breadcrumbs":"Verification » Cluster Health","id":"132","title":"Cluster Health"},"1320":{"body":"Unit tests : Minimum 80% code coverage Integration tests : Minimum 60% component coverage Critical paths : 100% coverage required Security components : 100% coverage required","breadcrumbs":"Testing » Coverage Goals","id":"1320","title":"Coverage Goals"},"1321":{"body":"Benchmark critical operations.","breadcrumbs":"Testing » Performance Testing","id":"1321","title":"Performance Testing"},"1322":{"body":"use criterion::{black_box, criterion_group, criterion_main, Criterion}; fn benchmark_workflow_creation(c: &mut Criterion) { c.bench_function(\\"create_workflow\\", | | b { b.iter| ( | { Workflow::new(black_box(test_config())) }) });\\n} fn benchmark_database_query(c: &mut Criterion) { c.bench_function(\\"query_workflows\\", | | b { b.iter| ( | { db.query_workflows(black_box(&filter)) }) });\\n} criterion_group!(benches, benchmark_workflow_creation, benchmark_database_query);\\ncriterion_main!(benches); Run benchmarks: cargo bench","breadcrumbs":"Testing » Benchmark Tests","id":"1322","title":"Benchmark Tests"},"1323":{"body":"Write tests before or alongside code (TDD approach) Keep tests focused and isolated Use descriptive test names that explain what is tested Clean up test resources (databases, files, containers) Mock external dependencies to avoid flaky tests Test both success and error conditions Maintain shared test fixtures for consistency Run tests in CI/CD pipeline Monitor test execution time (fail if too slow) Refactor tests alongside production code","breadcrumbs":"Testing » Test Best Practices","id":"1323","title":"Test Best Practices"},"1324":{"body":"","breadcrumbs":"Testing » Continuous Testing","id":"1324","title":"Continuous Testing"},"1325":{"body":"Auto-run tests on code changes: # Install cargo-watch\\ncargo install cargo-watch # Watch and run tests\\ncargo watch -x test # Watch specific package\\ncargo watch -x \'test -p provisioning-orchestrator\'","breadcrumbs":"Testing » Watch Mode","id":"1325","title":"Watch Mode"},"1326":{"body":"Run tests automatically before commits: # Install pre-commit hooks\\npre-commit install # Runs on every commit:\\n# - cargo test\\n# - cargo clippy\\n# - cargo fmt --check","breadcrumbs":"Testing » Pre-Commit Testing","id":"1326","title":"Pre-Commit Testing"},"1327":{"body":"Build System - Building and running tests Contributing - Test requirements for contributions API Guide - API testing examples","breadcrumbs":"Testing » Related Documentation","id":"1327","title":"Related Documentation"},"1328":{"body":"Guidelines for contributing to the Provisioning platform including setup, workflow, and best practices.","breadcrumbs":"Contributing » Contributing","id":"1328","title":"Contributing"},"1329":{"body":"","breadcrumbs":"Contributing » Getting Started","id":"1329","title":"Getting Started"},"133":{"body":"","breadcrumbs":"Verification » Platform Services Verification","id":"133","title":"Platform Services Verification"},"1330":{"body":"Install required development tools: # Rust toolchain (latest stable)\\ncurl --proto \'=https\' --tlsv1.2 -sSf [https://sh.rustup.rs](https://sh.rustup.rs) | sh # Nushell shell\\nbrew install nushell # Nickel configuration language\\nbrew install nickel # Just task runner\\nbrew install just # Additional development tools\\ncargo install cargo-watch cargo-tarpaulin cargo-audit","breadcrumbs":"Contributing » Prerequisites","id":"1330","title":"Prerequisites"},"1331":{"body":"Follow these guidelines for all code changes and ensure adherence to the project\'s technical standards. Read applicable language guidelines Create feature branch from main Make changes following project standards Write or update tests Run full test suite and linting Create pull request with clear description","breadcrumbs":"Contributing » Development Workflow","id":"1331","title":"Development Workflow"},"1332":{"body":"","breadcrumbs":"Contributing » Code Style Guidelines","id":"1332","title":"Code Style Guidelines"},"1333":{"body":"Rust code guidelines: Use idiomatic Rust patterns No unwrap() in production code Comprehensive error handling with custom error types Format with cargo fmt Pass cargo clippy -- -D warnings with zero warnings Add inline documentation for public APIs","breadcrumbs":"Contributing » Rust Code","id":"1333","title":"Rust Code"},"1334":{"body":"Nushell code guidelines: Use structured data pipelines Avoid external command dependencies where possible Handle errors gracefully with try-catch Document functions with comments Use type annotations for clarity","breadcrumbs":"Contributing » Nushell Scripts","id":"1334","title":"Nushell Scripts"},"1335":{"body":"Nickel configuration guidelines: Define clear type constraints Use lazy evaluation appropriately Provide default values where sensible Document schema fields Validate schemas with nickel typecheck","breadcrumbs":"Contributing » Nickel Schemas","id":"1335","title":"Nickel Schemas"},"1336":{"body":"All contributions must include appropriate tests:","breadcrumbs":"Contributing » Testing Requirements","id":"1336","title":"Testing Requirements"},"1337":{"body":"Unit tests for all new functions Integration tests for component interactions Security tests for security-related changes Documentation tests for code examples","breadcrumbs":"Contributing » Required Tests","id":"1337","title":"Required Tests"},"1338":{"body":"# Run all tests\\njust test # Run specific test suite\\ncargo test -p provisioning-orchestrator # Run with coverage\\ncargo tarpaulin --out Html","breadcrumbs":"Contributing » Running Tests","id":"1338","title":"Running Tests"},"1339":{"body":"Unit tests: Minimum 80% code coverage Critical paths: 100% coverage Security components: 100% coverage","breadcrumbs":"Contributing » Test Coverage Requirements","id":"1339","title":"Test Coverage Requirements"},"134":{"body":"# Check orchestrator status\\ncurl [http://localhost:5000/health](http://localhost:5000/health) # View orchestrator version\\ncurl [http://localhost:5000/version](http://localhost:5000/version) # List active workflows\\nprovisioning workflow list Expected response: { \\"status\\": \\"healthy\\", \\"version\\": \\"x.x.x\\", \\"uptime\\": \\"2h 15m\\"\\n}","breadcrumbs":"Verification » Orchestrator Service","id":"134","title":"Orchestrator Service"},"1340":{"body":"","breadcrumbs":"Contributing » Documentation","id":"1340","title":"Documentation"},"1341":{"body":"All code changes must include: Inline code documentation for public APIs Updated README if adding new components Examples showing usage Migration guide for breaking changes","breadcrumbs":"Contributing » Required Documentation","id":"1341","title":"Required Documentation"},"1342":{"body":"Documentation standards: Use Markdown for all documentation Code blocks must specify language Keep lines ≤150 characters No bare URLs (use markdown links) Test all code examples","breadcrumbs":"Contributing » Documentation Standards","id":"1342","title":"Documentation Standards"},"1343":{"body":"Use conventional commit format: ():