2026-07 / 05
Harumi Platform — retiring three admin tools into one
OutcomeConsolidated three separate operational surfaces into one controlled console, without discarding the data that lived in the tools being retired.
Overview
A single console for cluster health, resources, docs and connection info — replacing three separate admin tools that had each accumulated a different slice of the same operational picture.
Context
The console needed live ArgoCD data, but the only documented admin credential no longer authenticated, and a scoped read-only account had already been provisioned with no way yet to mint it a token.
System
Role: get,list on pods · namespace-scoped, no secrets退役は、削除ではない。
Retire the surface, not the data.
3 ops surfaces → 1 console, zero downtime.Problem
Three tools — a docs site, an old Camunda dashboard, and the infra repo's own notes — each held a piece of "how is the lab doing right now," and none of them was the one place to check. Retiring the oldest of them (rather than just adding a fourth tool) meant first confirming nothing else depended on what lived inside it — which turned out to be false in a way that mattered.
Investigation
Initial hypothesis
A token could be minted by hand for the existing read-only account, skipping the admin password entirely.
Built the console read-only first against live cluster state, then ported each retiring tool's actual content across before touching it — URL directory, per-service connection info, and a disk-health board. Auditing what else lived in the oldest tool's namespace surfaced two pieces of shared infrastructure with nothing to do with its content: the Cloudflare tunnel behind every public hostname in the lab, and a disk-health-monitoring DaemonSet. Both were re-homed onto new pods and confirmed healthy — the tunnel's old and new pods briefly shared one token, by design — before the old namespace was deleted.
Evidence
# resolved via the platform's own account-token endpoint, not a hand-built claimThe hand-built approach was rejected outright by the server, for reasons that pointed at a supported, purpose-built endpoint instead of a workaround.
Rejected fix
Hand-building a token offline. More than one attempt was rejected by the server, and continuing to guess the internal shape it expected would have been reverse-engineering an interface that already had a supported endpoint.
Decision
Reset admin access through the platform's own documented recovery procedure, then generate the token through its own account-token endpoint instead of guessing the internal shape further.
Result
The disk-health agent's Go source turned out to have no copy anywhere once its repository was gone — the daily backup that could have recovered it lives on a machine that was offline. Rather than leave a DaemonSet permanently pinned to an orphaned image, rewrote it from scratch: used a throwaway privileged debug pod on each of the three machines to capture real smartctl JSON output first, then wrote the parser against that — including the one detail that would have silently produced garbage data, a USB-attached drive whose SMART attributes only unlock with an explicit ATA-passthrough flag.
What I would change
Current limitation: The credential this issues is hand-rotated rather than short-lived by default — acceptable for one scoped service account, not a pattern to copy for a wider system.
Next step: Apply the same scoped-RBAC, no-secrets pattern to the planned read-only AI diagnostics layer.