Discovered details and known limitations¶
This register collects differences, implicit contracts and factors affecting reproduction of the project. It is based on the commits in the source inventory. Absence from public repositories does not establish that manual configuration never existed; it identifies what cannot be reproduced solely from the reviewed versioned content.
Findings describe the implementation. Actions in the fourth column are proposals and have not been applied to the six original repositories. They are neither penetration-test results nor a measurement of the running environment.
Technical register¶
| ID | Area | Observed evidence | Treatment | Source |
|---|---|---|---|---|
| F01 | Teardown defaults | PIPELINE_ACTION=destroy, ENVIRONMENT=pro; apply jobs are manual. |
Confirm intent and explicitly select action/provider/environment. | CI |
| F02 | Environment isolation | Environment changes state and resource_group; cloud names/labels retain fixed values. | Parameterize resource identity and networking before creating multiple environments. | Variables |
| F03 | GKE exposure | The only versioned Ingress uses the ALB class and an ACM certificate. | Confirm external configuration or design a GKE variant. | Ingress |
| F04 | Registry credential | Pods require the registry Secret; none of the six repositories creates it. | Add bootstrap and rotation using read credentials. | Deployment |
| F05 | Push identity | CD_DEPLOY_TOKEN is used for Git writes; its token type is not recorded. | Document an identity with write_repository and branch permissions. | Deploy |
| F06 | Non-blocking controls | Observed analyzers/summaries allow failures; HIGH is not a delivery gate. | Agree on blocking/exception policy and verify it. | Test |
| F07 | Application tests | No src/test suites exist; packaging uses -DskipTests. | Add contract/functional tests for the desired scope. | Build |
| F08 | Branch rules | Deploy is automatic on protected main; the thesis also describes a manual variant. | Use the reviewed commit for current behavior and retain chronology. | Deploy |
| F09 | Revision and concurrency | The deploy job clones main again; application deliveries are not serialized. | Propagate the manifest SHA and serialize per target/service. | Deploy |
| F10 | Health verification | The job applies YAML and lists resources; no rollout wait or smoke test. | Wait for readiness and verify the interface/API per target. | Deploy |
| F11 | Helm support | The Chart.yaml deployment branch prints an instruction and fails. | Document YAML manifests as the implemented path. | Deploy |
| F12 | Moving versions | Templates at main, several latest tags, stable kubectl, unversioned charts and no IaC lockfiles. | Pin dependencies and record effective configuration. | Versiones IaC |
| F13 | IaC runtime | Terraform HCL executed by OpenTofu 1.12.1; already mentioned in the thesis. | Use precise terminology and confirm historical motivation. | CI |
| F14 | EKS scaling | Node group bounds 1/3/1 without a declared Autoscaler/Karpenter. | Do not claim load-driven scaling before configuring a controller. | EKS |
| F15 | GCP topology | Only first CIDRs from lists are used; GKE has two explicit zones. | Document created resources and per-zone counts. | GCP |
| F16 | Public Kubernetes API | Default values permit public control-plane endpoints. | Define runner connectivity and source restrictions per environment. | Acceso / Access |
| F17 | GKE workload identity | Pool enabled, example binding commented out, app account differs from rest/web. | Do not claim complete application WI; configure it when required. | GCP |
| F18 | PSA recovery | force_unlock… performs state rm, uses a fixed dev resource_group and changes state. | Confirm the original failure; back up and reconcile before exceptional use. | CI |
| F19 | DAG outside main | Create needs reference apply jobs excluded by branch rules. | Validate in CI Lint; possible invalid DAG inferred from static analysis. | CI |
| F20 | Plan report and artifacts | Full show -json is published as a Terraform report; it may contain sensitive values. | Generate create/update/delete widget summary and restrict artifacts. | Estado / State |
| F21 | Data retention | Deletion protection disabled; RDS skips final snapshot and defines no identifier for it. | Decide retention, complete configuration and rehearse restoration. | AWS |
| F22 | Frontend port | Dockerfile EXPOSE 8081; runtime, probes and Service use 8080. | Normalize the Dockerfile declaration. | Dockerfile |
| F23 | Demonstrator authentication | Configuration permits requests; OAuth dependencies do not prove active identity integration. | Define authentication and authorization for use with real data. | Seguridad / Security |
| F24 | Observability | The thesis shows sample OTLP ingestion; no complete versioned integration exists. | Distinguish demonstration from instrumentation, alerting and operational SLOs. | Observabilidad / Observability |
| F25 | Historical planning | An open issue mentions Azure; only AWS and GCP roots exist. | Reconcile the backlog without claiming Azure support. | Issue |
| F26 | Database schema | Hibernate ddl-auto=update; no versioned migrations or data rollback. | Separate image recovery from database recovery. | Runtime |
Suggested work order¶
To reproduce the demonstration: resolve F01–F05, confirm the target and real resource names, prepare registry access and exposure, and review access requirements. Do not start resource creation by treating teardown defaults as bootstrap defaults.
To trust a delivery: address F06–F12 and F26. Define functional checks, security policy and version/data recovery. Retain the exact manifest SHA and ensure the image remains available.
To extend environments or providers: address F02 and F14–F21. Variables and lists alone do not guarantee isolation, resource counts or all required controllers.
Questions for the author¶
- Why was OpenTofu selected for the pipeline? The thesis mentions its use, but does not record the selection rationale.
- Do
destroyandproreflect the final tests or the intended operating policy? How were environments distinguished outside the repository? - Which mechanism provided HTTP/TLS exposure on GKE?
- Which Private Service Access error motivated state removal, and what reconciliation followed?
- Were non-blocking analyses and sample telemetry chosen for educational scope, environment constraints or another reason?
The first three questions were raised during preparation. The others remain decisions to complete. No motivation is assigned without confirmation; see decisions.
Closing a finding¶
Record the issue/MR, configuration-changing commit, validation evidence and affected pages in both languages. Mark the change resolved only after reviewing those elements. When refreshing this register, retain the date and SHAs of the previous edition to explain project evolution.