Eject Phase 2: Control Room Severance
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 7
- Forks
- 2
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 3
Description
Parent: #206
Summary
Implement the actual disconnection of a workload from the control room. This is done via Pulumi (modifying config and re-running ensure steps) rather than direct API calls, so both infrastructure and Pulumi state stay in sync.
Connections to Sever
| Connection | How to sever |
|---|---|
| Cross-account IAM trust | Remove trust policy entries referencing control room account |
| Mimir password in control room secrets | Delete the secret from control room's AWS Secrets Manager |
| Team Operator control room config | Reconfigure Helm values to remove control room references |
| Observability pipeline (Alloy → control room Mimir/Loki) | Remove or redirect Alloy remote_write endpoints |
| OIDC provider trust (if control-room-issued) | Update or remove OIDC provider |
Approach
Modify ptd.yaml to remove/empty control room fields, then re-run affected ptd ensure steps. Key code areas:
lib/steps/persistent.go— Mimir password sync, guard with nil control room targetlib/steps/steps.go— Step interface accepts nil control room targetpython-pulumi/src/ptd/pulumi_resources/grafana_alloy.py— Conditionally omit control room remote_write blockpython-pulumi/src/ptd/__init__.py,workload.py— Support empty control room fields as "no control room"
Requirements
- Post-severance verification: confirm workload still operates (pods running, sites accessible)
- Rollback plan for transition period
- Safety confirmation prompt (type full workload name to proceed)
Dependencies
- Phase 1 (artifact bundle generation) should be complete first
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Phase 1 dependency, then read lib/steps/persistent.go and lib/steps/steps.go alongside the Pulumi files in python-pulumi/src/ptd/. Trace how empty control room fields flow through the affected ptd ensure steps and Alloy resources. Done means the listed connections are severed, verification confirms pods and sites still operate, and the transition includes rollback and workload-name confirmation safeguards.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, helm, kubernetes, python
- Domain
- cloud, devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100