Overdeck · K3s migration

One-command enrollment, proven before mutation

Phase 2 turns the future node join into a deterministic, inspectable transaction. It verifies identity, preflight, recovery, trust and registry contracts while keeping every live mutation path locked.

Phase 2 · dry-run only
17ordered enrollment steps
0live mutations permitted
3independent recovery doors

Owner experience

Install OSSupported Debian-family host
→
Authenticate TailscaleOne online, unique device identity
→
Run one commandPhase 3 canary will execute the reviewed plan
→
Receive proofNode, recovery, workload and Git receipt
tools/k3s/enroll-node.sh debian4 --dry-run \ --fixture tools/k3s/test/fixtures/phase2-debian4.json

Transaction groups

1–3 · Identity and qualification

Tailscale pin, global collision checks, supported-host preflight.

4–7 · Recovery and host convergence

Durable ledger, three-door snapshot, serial access convergence, existing host profile.

8–10 · Temporary join

Ten-minute token metadata, pinned agent configuration, K3s join over tailscale0.

11–15 · Trust proof

Exact Node identity, quarantine, node-pinned Job, token revocation, tokenless restart proof.

16–17 · Source of truth

Paired non-dispatch registry publication and final audit receipt.

Trusted workstation

Owns the plan, ephemeral helpers, cluster observation, receipt validation and Git publication.

no reusable token in fileschecksum-verified helpersprotected labels controller-owned

Candidate cannot

Access Git credentials, cluster-admin kubeconfig, permanent K3s bootstrap authority or trusted scheduling state.

no self-trustno dispatch enablementno Phase 2 write command

Phase boundary

Phase 2: inspect, calculate, preview, validate, publish repository implementation.

Phase 3: bind one reviewed plan digest to one real candidate and unlock its transaction.

Paired source-of-truth preview

nonecandidate execution state
falsebuild / E2E order membership
falsefallback dependency

The two previews are content-addressed and must be published as one logical transaction. Enrollment cannot silently add dispatch capacity.

Package workflow

Verify ZIPSafe paths, checksums, launcher coupling
→
Isolated worktreeCurrent origin/main remains untouched
→
Run gatesUnit, failure, deterministic integration
→
Validate receiptIndependent fail-closed authorization
→
Draft PRNever merge or push main directly

Return overdeck-k3s-phase2-result-<timestamp>.tar.gz to authorize Phase 3 design.