vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(check-backup-freshness): attach the documented reason to each policy exclusion

Browse Source 
The policy section said WHICH guests are uncovered but not WHY, so every
reader had to reconstruct the ruling from memory or the bus. A missing
reason now prints as 'NO DOCUMENTED REASON', which turns an undocumented
new exclusion into a visible flag instead of a silent line.
This commit is contained in:
vh
2026-10-05 08:03:47 -07:00
parent 67c72ed228
commit c9ace41340
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/check-backup-freshness.sh
+15 -1
View File
@@ -59,6 +59,20 @@ declare -A NS_NODE=(
declare -A NS_JOBS=() # ns → one "enabled|all|vmids|excludes" line per job declare -A NS_JOBS=() # ns → one "enabled|all|vmids|excludes" line per job
declare -A NS_KNOWN=() # ns → 1 once coverage was successfully read declare -A NS_KNOWN=() # ns → 1 once coverage was successfully read
# WHY each policy-excluded guest is out of the backup jobs (2026-10-05). The
# exclusion is derived from jobs.cfg coverage; the REASON is standing policy
# and lives here so the report can say why instead of asking the reader to
# remember. Keep one line per guest with its paper trail; if an entry shows up
# in the policy section with no reason, that is the flag: undocumented hole.
declare -A EXCLUDE_WHY=(
[ana-pve/vm/101]="retired/shut down — Prime ruling 2026-10-04 (bus 01M44MEXG60); last snapshots kept"
[nh3-pve/vm/104]="retired/shut down (nh3-laser) — Prime ruling 2026-10-04 (bus 01M44MEXG60); last snapshots kept"
[ana-pve/ct/114]="subnet-router (ana-scale) — vzdump lock risk; ESH-scale lock once blackholed the site; rebuildable from config (docs/pfi/proxmox-inventory-2026-10-02.md)"
[nh3-pve/ct/107]="subnet-router (nh3-scale) — same scale-router class as ana/esh-scale; rebuildable from config"
[esh-pve/ct/108]="subnet-router (esh-scale) — its vzdump lock blackholed the ESH site; rebuildable from config"
[esh-pve/vm/102]="Windows Parsec/RDP sandbox, no needed state — Prime ruling 2026-09-19 (playbooks/esh-exclude-vm102-from-backup.yaml)"
)
# Every PVE node whose vzdump TASK RESULTS we read. Unlike jobs.cfg this is # Every PVE node whose vzdump TASK RESULTS we read. Unlike jobs.cfg this is
# per-NODE, not cluster-wide, so both ESH nodes appear. sfsrv is absent: tenant. # per-NODE, not cluster-wide, so both ESH nodes appear. sfsrv is absent: tenant.
PVE_NODES=( PVE_NODES=(
@@ -201,7 +215,7 @@ if [ -z "$pbs" ]; then errors+=("PBS-ANA: unreachable or no snapshots"); else
is_covered "$ns" "$vmid" is_covered "$ns" "$vmid"
case $? in case $? in
1) excluded+=("pbs/$guest: no enabled vzdump job covers it$( 1) excluded+=("pbs/$guest: no enabled vzdump job covers it$(
[ -n "$ep" ] && printf ' (last snapshot %s)' "$(date -d "@$ep" '+%Y-%m-%d' 2>/dev/null)")") ;; [ -n "$ep" ] && printf ' (last snapshot %s)' "$(date -d "@$ep" '+%Y-%m-%d' 2>/dev/null)") — ${EXCLUDE_WHY[$guest]:-⚠ NO DOCUMENTED REASON — check this exclusion is intentional}") ;;
*) report "pbs/$guest" "$ep" ;; *) report "pbs/$guest" "$ep" ;;
esac esac
done <<<"$pbs" done <<<"$pbs"