103 lines
4.1 KiB
JSON
103 lines
4.1 KiB
JSON
{
|
|
"items": [
|
|
{
|
|
"blocked_by": [],
|
|
"description": "Finalize Cedar policy definitions for Control Center and wire to live auth evaluation.",
|
|
"id": "control-center-cedar-policies",
|
|
"priority": "High",
|
|
"related_nodes": [
|
|
"solid-boundaries",
|
|
"control-center-maturity"
|
|
]
|
|
},
|
|
{
|
|
"blocked_by": [
|
|
"control-center-cedar-policies"
|
|
],
|
|
"description": "Connect Control Center WebSocket task status streaming to NATS push consumers.",
|
|
"id": "websocket-nats-streaming",
|
|
"priority": "High",
|
|
"related_nodes": [
|
|
"platform-dispatch",
|
|
"control-center-maturity"
|
|
]
|
|
},
|
|
{
|
|
"blocked_by": [],
|
|
"description": "Add Nickel schemas for extension metadata currently using raw TOML.",
|
|
"id": "extension-metadata-schemas",
|
|
"priority": "Medium",
|
|
"related_nodes": [
|
|
"type-safety-nickel",
|
|
"schema-coverage"
|
|
]
|
|
},
|
|
{
|
|
"blocked_by": [
|
|
"extension-metadata-schemas"
|
|
],
|
|
"description": "Validate provider capabilities against workspace requirements at config-load time.",
|
|
"id": "provider-capability-validation",
|
|
"priority": "Medium",
|
|
"related_nodes": [
|
|
"provider-abstraction",
|
|
"workspace-contract"
|
|
]
|
|
},
|
|
{
|
|
"blocked_by": [],
|
|
"description": "Ensure all taskservs declare dependencies.ncl with typed contracts for inter-taskserv dependencies.",
|
|
"id": "taskserv-dependency-contracts",
|
|
"priority": "Medium",
|
|
"related_nodes": [
|
|
"taskserv-pattern",
|
|
"workspace-certification"
|
|
]
|
|
},
|
|
{
|
|
"blocked_by": [],
|
|
"description": "ingressClassName is hardcoded to 'cilium' in all L4 cluster extension install scripts. Should be driven by a field in the cluster extension NCL config (e.g. ingress_class_name) so different clusters can declare different ingress controllers without modifying install scripts. Relevant for wuji where Istio replaces Cilium ingress.",
|
|
"id": "cluster-ext-ingress-class-from-config",
|
|
"priority": "Medium",
|
|
"related_nodes": [
|
|
"cluster-extension-pattern",
|
|
"type-safety-nickel"
|
|
]
|
|
},
|
|
{
|
|
"blocked_by": [
|
|
"cluster-ext-ingress-class-from-config"
|
|
],
|
|
"description": "FIP key names in cluster-deploy.nu (cd-load-fip-env) and bootstrap.nu are derived by stripping a hardcoded workspace prefix ('librecloud-fip-') and assuming fixed role keys (smtp, sgoyol_ingress, wuji). Should be driven by an explicit role field in floating_ips.ncl so the mapping is data-driven and reusable across workspaces.",
|
|
"id": "fip-role-driven-state-mapping",
|
|
"priority": "Low",
|
|
"related_nodes": [
|
|
"provider-abstraction",
|
|
"workspace-contract"
|
|
]
|
|
},
|
|
{
|
|
"blocked_by": [],
|
|
"description": "cluster-deploy.nu processes extensions sequentially even when parallel=true in the DAG. Extensions with no shared depends_on (e.g. hcloud_floater and cert_manager both after metallb) could run concurrently. Requires structured concurrency in Nushell or delegating to background jobs.",
|
|
"id": "cluster-deploy-parallel-extension-execution",
|
|
"priority": "Low",
|
|
"related_nodes": [
|
|
"platform-dispatch",
|
|
"cluster-extension-pattern"
|
|
]
|
|
},
|
|
{
|
|
"blocked_by": [
|
|
"control-center-cedar-policies"
|
|
],
|
|
"description": "The Live Pods section in the component detail view (workspace_component_detail.html) is rendered for all component modes unconditionally. Fetching live pod status requires SSH access to the cluster control plane — this capability must be gated behind explicit RBAC permissions (can_operate or higher) so read-only (can_view) users cannot trigger SSH sessions or see raw infrastructure state. Implement a Cedar policy check in the /pods and /pods/{ns}/{pod}/describe handlers, and conditionally hide the live button in the template when the session lacks the required permission.",
|
|
"id": "ui-live-mode-credential-gate",
|
|
"priority": "High",
|
|
"related_nodes": [
|
|
"solid-boundaries",
|
|
"control-center-maturity",
|
|
"ui-component-detail"
|
|
]
|
|
}
|
|
]
|
|
}
|