blumeops/docs/changelog.d/review-cc-observability-stack-audit-2026-05-11.infra.md at b21d13fe2031784a2c0b9e32a5d8b6ab2392d492

Erich Blume f83be3bf37 C1: review CC observability-stack-audit (extend to k3s) (#353 )

## Summary
- Recurring compensating-control review (oldest stale control: 42 days).
- Verified the control is in effect on both clusters:
  - `alloy-k8s` on minikube-indri — Synced/Healthy, DaemonSet 1/1 ready
  - `alloy-ringtail` on k3s-ringtail — Synced/Healthy
  - `loki` (`monitoring/loki-0`) — Running, receiving logs (52 restarts in 18h is worth watching but not blocking review)
- Generalized the description: previously named only minikube, but the indri→ringtail migration means we now operate two clusters and both rely on this control.
- Added a follow-up note: enabling native apiserver audit logging is far more tractable on k3s (`--audit-log-path` / `--audit-policy-file`) than it was on minikube — worth revisiting once the migration concludes.

## Test plan
- [x] `prek` hooks pass
- [x] Verified alloy + loki status via `kubectl --context=minikube-indri` and `argocd app get`

## Notes
- No deployment changes.

Reviewed-on: #353

2026-05-11 16:10:39 -07:00

176 B

Raw Blame History

Reviewed compensating control observability-stack-audit. Updated description to cover ringtail's k3s as well as indri's minikube; both Alloy DaemonSets and Loki are healthy.

176 B Raw Blame History

176 B

Raw Blame History