cairnobs

174 Commits 2 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
jcoffey-dev	f756a9d4f6	Rename the project spec and update every reference to it The charter file carried a tool-specific name while being the repository's own document: mission, non-negotiable constraints, the pinned stack, repo conventions and phase status, cited as authority by thirty files across the agent, api, deploy, docs, search and terraform trees. PROJECT-SPEC.md says what it is. All 42 references are updated in the same commit, including the relative link in docs/status.md, so nothing points at a filename that no longer exists.	2026-08-28 15:57:12 -07:00
jcoffey-dev	13cf9a30cb	Rebrand: Sentry -> Cairn OBS Full rebrand across cosmetic branding, code identifiers, and infrastructure/data-plane naming, using the supplied Cairn OBS logo package. Cosmetic: favicon/logo swap (also closes a stale license-audit finding -- the old favicon was SvelteKit's unreplaced scaffold logo), new centered welcome landing page, larger/legible sidebar logo, page titles, CLAUDE.md/README/docs prose. Code identifiers: Go module path github.com/sentry/sentry -> github.com/cairnobs/cairnobs across all 13 modules and ~91 files (protoc regenerated); Rust crates sentry-agent/sentry-parser/sentry-search -> cairnobs-*; CLI sentryctl -> cairnobsctl; Terraform provider fully renamed (sentry_dashboard etc. -> cairnobs_dashboard, provider type, env vars); every session/auth cookie name; agent config paths and Windows service identity. Deliberately preserved: the gRPC wire protocol's protobuf packages (sentry.logs.v1, sentry.agent.v1) and their Go import directory (proto/sentry/...) -- renaming the wire-level package would break every currently-deployed agent binary (confirmed two real hosts, including mail.inbuxa.com, are actively streaming through this exact contract) until rebuilt and redeployed in lockstep with an ingest cutover. Only the Go module path wrapping the generated code changes. Infrastructure: every docker-compose container name (root and three component-level compose files); the Helm chart (directory, Chart.yaml, named-template helpers, all templates, values.yaml image repos); Kubernetes Operator (CRD group sentry.io -> cairnobs.io, both CRD YAML files, Go identifiers, RBAC markers); the coupled enterprise/tenantcrd package. Caught and fixed real path-coupling bugs along the way: the Helm chart's search/ingest volume mounts and the dev-only-credential detection constant vs. docker-compose.yml's literal values had to move together or a security warning would have silently stopped firing. Data plane: Postgres database sentry_metadata -> cairnobs_metadata and role sentry -> cairnobs; ClickHouse database sentry -> cairnobs; Kafka topic sentry.logs.raw -> cairnobs.logs.raw and its consumer groups. Source-level defaults, docker-compose.yml, and every migrate.sh/ provision script default updated together; already-applied migration files left untouched per this repo's immutable-migration convention. Verified at every layer: all 13 Go modules build/vet/test clean, both Rust workspaces (agent, search) build/clippy/test clean, npm run check/ build clean, docker compose config validates on all four compose files. Live-verified against a real docker stack multiple times through this work, including a final fresh-volume run confirming the actual renamed Postgres database/role, ClickHouse database, and Kafka topic all work end to end with a real login and query, zero console errors.	2026-08-21 20:53:32 -07:00
jcoffey-dev	823f5d48d1	Unify the Tenant CRD with enterprise-api -provision-tenant (lightweight) Closes a gap named across CLAUDE.md/docs/architecture.md/deploy/README.md since early Phase 4: the operator's Tenant CRD and -provision-tenant were two disconnected mechanisms. The operator's reconciler generated a K8s Secret with a locally-generated random password that authenticated against nothing (nothing ever called ClickHouse to create a matching user), and unconditionally claimed status.phase=Active the moment a Tenant object existed -- actively misleading, not just incomplete. Two unification shapes were considered (surfaced to the user via AskUserQuestion, given the real difference in blast radius): the operator's reconcile loop becoming a second real actor (new Postgres + ClickHouse admin credentials flowing into the K8s controller, plus real reconcile-loop idempotency/retry design for an inherently one-shot external side effect), or keeping -provision-tenant as the sole real actor and having it also sync its result into the CRD. Went with the lighter option. enterprise/internal/tenantcrd (new): a Syncer using the K8s dynamic client (unstructured.Unstructured + a GroupVersionResource, not deploy/operator's typed Tenant struct -- avoids a cross-module Go dependency between two independently-versioned modules for one type). Upserts the Tenant object, creates/updates a Secret with the real ClickHouse credentials owned by that Tenant via an OwnerReference, then patches status.{clickHouseDatabaseName,clickHouseSecretRef, tantivyIndexPath}. Idempotent and safe to retry: never rotates a credential across a re-sync, never overwrites a pre-existing spec.displayName a human/GitOps process set. cmd/enterprise-api/main.go's runProvisionTenant calls Sync when TENANT_CRD_NAMESPACE is set (empty = no-op, same shape as every other optional dependency in this codebase). Its "already active" refusal is now split: ClickHouse re-provisioning is still refused (rotating a live credential would break every open connection for no benefit), but CR sync alone is now retryable using the credentials already on file in rbacstore -- needed for retrying a previously-failed sync, or backfilling CR sync for a tenant provisioned before this existed. deploy/operator's reconciler rewritten to match: it never claims PhaseActive on its own initiative anymore, only once status.ClickHouseDatabaseName is non-empty (the field -provision-tenant, and only -provision-tenant, sets). Phase is now a pure function of {spec.suspended, status.ClickHouseDatabaseName != ""} recomputed every reconcile, not toggled in place -- fixes a related bug the old code would have hit once suspension was involved: un-suspending an already-provisioned tenant needs to return straight to Active, which isn't derivable from "last observed phase was Suspended" alone. The reconciler no longer creates or manages any Secret, dropped its `secrets` RBAC grant entirely, and gained zero new dependencies. Helm chart: enterprise-api gets its own ServiceAccount/Role/RoleBinding (get/list/create tenants, get/update/patch tenants/status, get/create/ update secrets -- least-privilege, scoped to the release namespace, not a ClusterRole) and a TENANT_CRD_NAMESPACE env var, both gated on tenantOperator.enabled. tenant-operator's ClusterRole loses the secrets grant it no longer needs. Verified in this environment: enterprise/internal/tenantcrd's tests run against k8s.io/client-go's fake dynamic + typed clientsets (real client library, fake transport, no cluster needed); deploy/operator's rewritten tenant_controller_test.go runs against controller-runtime's fake client, including new regression tests for the "must not claim Active without confirmation" and "un-suspending returns to Active, not Provisioning" properties; helm template + parsing the rendered YAML confirms the RBAC split renders exactly as designed under both tenantOperator.enabled=true/false. Not verified: an actual -provision-tenant run against a real cluster with the operator watching (no live cluster in this environment, same disclosed limitation as the rest of /deploy). Docs updated in lockstep: CLAUDE.md, docs/architecture.md, deploy/README.md, deploy/helm/sentry/README.md (including a corrected "Trying the two-tenant example" walkthrough), phase-4-runbook.md (new §11), enterprise/README.md. Also fixed two unrelated stale claims found along the way: docs/architecture.md still said docker-compose.yml ran plain api unconditionally (fixed in an earlier commit, doc not updated then), and enterprise-api's own main.go doc comment still said Helm/ docker-compose wiring wasn't built yet.	2026-08-14 09:07:10 -07:00

Author

SHA1

Message

Date

jcoffey-dev

f756a9d4f6

Rename the project spec and update every reference to it

The charter file carried a tool-specific name while being the repository's own
document: mission, non-negotiable constraints, the pinned stack, repo
conventions and phase status, cited as authority by thirty files across the
agent, api, deploy, docs, search and terraform trees.

PROJECT-SPEC.md says what it is. All 42 references are updated in the same
commit, including the relative link in docs/status.md, so nothing points at a
filename that no longer exists.

2026-08-28 15:57:12 -07:00

jcoffey-dev

13cf9a30cb

Rebrand: Sentry -> Cairn OBS

Full rebrand across cosmetic branding, code identifiers, and
infrastructure/data-plane naming, using the supplied Cairn OBS logo
package. Cosmetic: favicon/logo swap (also closes a stale license-audit
finding -- the old favicon was SvelteKit's unreplaced scaffold logo),
new centered welcome landing page, larger/legible sidebar logo, page
titles, CLAUDE.md/README/docs prose.

Code identifiers: Go module path github.com/sentry/sentry ->
github.com/cairnobs/cairnobs across all 13 modules and ~91 files (protoc
regenerated); Rust crates sentry-agent/sentry-parser/sentry-search ->
cairnobs-*; CLI sentryctl -> cairnobsctl; Terraform provider fully
renamed (sentry_dashboard etc. -> cairnobs_dashboard, provider type,
env vars); every session/auth cookie name; agent config paths and
Windows service identity.

Deliberately preserved: the gRPC wire protocol's protobuf packages
(sentry.logs.v1, sentry.agent.v1) and their Go import directory
(proto/sentry/...) -- renaming the wire-level package would break every
currently-deployed agent binary (confirmed two real hosts, including
mail.inbuxa.com, are actively streaming through this exact contract)
until rebuilt and redeployed in lockstep with an ingest cutover. Only
the Go module path wrapping the generated code changes.

Infrastructure: every docker-compose container name (root and three
component-level compose files); the Helm chart (directory, Chart.yaml,
named-template helpers, all templates, values.yaml image repos);
Kubernetes Operator (CRD group sentry.io -> cairnobs.io, both CRD YAML
files, Go identifiers, RBAC markers); the coupled enterprise/tenantcrd
package. Caught and fixed real path-coupling bugs along the way: the
Helm chart's search/ingest volume mounts and the dev-only-credential
detection constant vs. docker-compose.yml's literal values had to move
together or a security warning would have silently stopped firing.

Data plane: Postgres database sentry_metadata -> cairnobs_metadata and
role sentry -> cairnobs; ClickHouse database sentry -> cairnobs; Kafka
topic sentry.logs.raw -> cairnobs.logs.raw and its consumer groups.
Source-level defaults, docker-compose.yml, and every migrate.sh/
provision script default updated together; already-applied migration
files left untouched per this repo's immutable-migration convention.

Verified at every layer: all 13 Go modules build/vet/test clean, both
Rust workspaces (agent, search) build/clippy/test clean, npm run check/
build clean, docker compose config validates on all four compose files.
Live-verified against a real docker stack multiple times through this
work, including a final fresh-volume run confirming the actual renamed
Postgres database/role, ClickHouse database, and Kafka topic all work
end to end with a real login and query, zero console errors.

2026-08-21 20:53:32 -07:00

jcoffey-dev

823f5d48d1

Unify the Tenant CRD with enterprise-api -provision-tenant (lightweight)

Closes a gap named across CLAUDE.md/docs/architecture.md/deploy/README.md
since early Phase 4: the operator's Tenant CRD and -provision-tenant
were two disconnected mechanisms. The operator's reconciler generated a
K8s Secret with a locally-generated random password that authenticated
against nothing (nothing ever called ClickHouse to create a matching
user), and unconditionally claimed status.phase=Active the moment a
Tenant object existed -- actively misleading, not just incomplete.

Two unification shapes were considered (surfaced to the user via
AskUserQuestion, given the real difference in blast radius): the
operator's reconcile loop becoming a second real actor (new Postgres +
ClickHouse admin credentials flowing into the K8s controller, plus real
reconcile-loop idempotency/retry design for an inherently one-shot
external side effect), or keeping -provision-tenant as the sole real
actor and having it also sync its result into the CRD. Went with the
lighter option.

enterprise/internal/tenantcrd (new): a Syncer using the K8s dynamic
client (unstructured.Unstructured + a GroupVersionResource, not
deploy/operator's typed Tenant struct -- avoids a cross-module Go
dependency between two independently-versioned modules for one type).
Upserts the Tenant object, creates/updates a Secret with the *real*
ClickHouse credentials owned by that Tenant via an OwnerReference, then
patches status.{clickHouseDatabaseName,clickHouseSecretRef,
tantivyIndexPath}. Idempotent and safe to retry: never rotates a
credential across a re-sync, never overwrites a pre-existing
spec.displayName a human/GitOps process set.

cmd/enterprise-api/main.go's runProvisionTenant calls Sync when
TENANT_CRD_NAMESPACE is set (empty = no-op, same shape as every other
optional dependency in this codebase). Its "already active" refusal is
now split: ClickHouse re-provisioning is still refused (rotating a live
credential would break every open connection for no benefit), but CR
sync alone is now retryable using the credentials already on file in
rbacstore -- needed for retrying a previously-failed sync, or
backfilling CR sync for a tenant provisioned before this existed.

deploy/operator's reconciler rewritten to match: it never claims
PhaseActive on its own initiative anymore, only once
status.ClickHouseDatabaseName is non-empty (the field -provision-tenant,
and only -provision-tenant, sets). Phase is now a pure function of
{spec.suspended, status.ClickHouseDatabaseName != ""} recomputed every
reconcile, not toggled in place -- fixes a related bug the old code
would have hit once suspension was involved: un-suspending an
already-provisioned tenant needs to return straight to Active, which
isn't derivable from "last observed phase was Suspended" alone. The
reconciler no longer creates or manages any Secret, dropped its
`secrets` RBAC grant entirely, and gained zero new dependencies.

Helm chart: enterprise-api gets its own ServiceAccount/Role/RoleBinding
(get/list/create tenants, get/update/patch tenants/status, get/create/
update secrets -- least-privilege, scoped to the release namespace, not
a ClusterRole) and a TENANT_CRD_NAMESPACE env var, both gated on
tenantOperator.enabled. tenant-operator's ClusterRole loses the
secrets grant it no longer needs.

Verified in this environment: enterprise/internal/tenantcrd's tests run
against k8s.io/client-go's fake dynamic + typed clientsets (real client
library, fake transport, no cluster needed); deploy/operator's rewritten
tenant_controller_test.go runs against controller-runtime's fake
client, including new regression tests for the "must not claim Active
without confirmation" and "un-suspending returns to Active, not
Provisioning" properties; helm template + parsing the rendered YAML
confirms the RBAC split renders exactly as designed under both
tenantOperator.enabled=true/false. Not verified: an actual
-provision-tenant run against a real cluster with the operator watching
(no live cluster in this environment, same disclosed limitation as the
rest of /deploy). Docs updated in lockstep: CLAUDE.md, docs/architecture.md,
deploy/README.md, deploy/helm/sentry/README.md (including a corrected
"Trying the two-tenant example" walkthrough), phase-4-runbook.md (new
§11), enterprise/README.md. Also fixed two unrelated stale claims found
along the way: docs/architecture.md still said docker-compose.yml ran
plain api unconditionally (fixed in an earlier commit, doc not updated
then), and enterprise-api's own main.go doc comment still said Helm/
docker-compose wiring wasn't built yet.

2026-08-14 09:07:10 -07:00