feat: mark the adopted HA VM 2000 describe-only (#325) - #8
Merged
Conversation
VM 2000 is a hand-built HAOS install that predates this stack, so its live config can never fully match the shape describing it. Converge read that difference as drift on every run, and an unscoped `converge --apply` on SmartHome proposed a SetConfig against it. This repo's README, stack.yaml and CLAUDE.md have always called it "describe-only", but that was prose. The only thing actually preventing a write was the operator remembering to pass --only. `spec.manage: describe-only` moves the constraint into the shape: plan → DESCRIBE-ONLY (adopted; documented, never written), not drift apply → SKIPPED, and naming it in --only does NOT override that Destroy was never a risk for this particular member — `converge --destroy` is CT-scoped and doesn't touch VM members at all — so the comment says so rather than implying a protection that wasn't in play. The marker does make destroy refuse a describe-only LXC. Verified live: `converge stacks/SmartHome` now reports VM 2000 as DESCRIBE-ONLY where it previously said SetConfig, and `--only homeassistant --apply` reports 1 skipped / 0 applied. Deliberately NOT applied to CT 4100. It looks like the other adopted member, but it is stopped and tagged `retired` — Mate runs on the podman host now (podman-host/quadlets/leapmotor-mate.container). Its shape is dead weight pending the CT's deletion, not an adopted member to protect, and marking it describe-only would assert something false. Noted in CLAUDE.md instead. Requires the engine support in Chrison-Homelab/Homelab#325.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies
spec.manage: describe-onlyto VM 2000, the adopted HAOS install.Requires the engine + schema support in Chrison-Homelab/Homelab#327 — merge that first. This PR's
validatecheck will fail until it lands, because the pinnedschema-v1artifact doesn't know themanagefield yet and both specs areadditionalProperties: false.Why
This repo's README,
stack.yamlandCLAUDE.mdhave always described VM 2000 as "describe-only" and "never re-provisioned byconverge --apply". That was prose — nothing enforced it. An unscopedconverge --applyon this stack proposed aSetConfigagainst a hand-built HAOS install, and the only thing preventing it was remembering to pass--only.Now: plan reports
DESCRIBE-ONLYinstead of perpetual drift,--applyreportsSKIPPED, and naming it in--onlydoesn't override either.Verified live once #327 was built locally:
Deliberately NOT applied to CT 4100
It reads like the other adopted member, but it's stopped and tagged
retired— Mate runs on the podman host now (podman-host/quadlets/leapmotor-mate.container). Its shape is dead weight pending the CT's deletion, not an adopted member worth protecting, and marking it describe-only would assert something false. It stays a legitimate drift entry;CLAUDE.mdnow says why.Also
Corrected one thing I'd written before checking: the comment claimed destroy would refuse this member.
converge --destroyis CT-scoped and doesn't touch VM members at all, so destroy was never a risk here. The marker does make destroy refuse a describe-only LXC.