Operational Playbook

llms.txt lists every page for an agent

Optional: hand this page to your coding agentThe steps work by hand too.

Read https://intentius.io/chant/lexicons/gcp/operational-playbook/.
Run `npx chant lint src/` and `npx chant build src/ --output manifests.yaml`, and fix each WGC finding they report.
For a resource I say is stuck, read the status and events I paste from `kubectl describe` and tell me the cause from the page's tables and the fix.
Open a pull request with the fix. Do not run `kubectl apply` or `kubectl delete` against a cluster.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Show the whole prompt

Read https://intentius.io/chant/lexicons/gcp/operational-playbook/.
Run `npx chant lint src/` and `npx chant build src/ --output manifests.yaml`, and fix each WGC finding they report.
For a resource I say is stuck, read the status and events I paste from `kubectl describe` and tell me the cause from the page's tables and the fix.
Open a pull request with the fix. Do not run `kubectl apply` or `kubectl delete` against a cluster.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Optional: hand this page to your coding agent

Read https://intentius.io/chant/lexicons/gcp/operational-playbook/.
Run `npx chant lint src/` and `npx chant build src/ --output manifests.yaml`, and fix each WGC finding they report.
For a resource I say is stuck, read the status and events I paste from `kubectl describe` and tell me the cause from the page's tables and the fix.
Open a pull request with the fix. Do not run `kubectl apply` or `kubectl delete` against a cluster.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

This playbook covers chant-built Config Connector manifests from build to troubleshooting.

Build & validate

Step	Command	What it catches
Lint source	`chant lint src/`	Hardcoded project IDs (WGC001), regions (WGC002), public IAM (WGC003)
Build manifests	`chant build src/ --output manifests.yaml`	Post-synth: missing encryption (WGC101), public IAM (WGC102), missing project annotation (WGC103), 14 more checks
Server dry-run	`kubectl apply -f manifests.yaml --dry-run=server`	K8s API validation: CRD schema errors, admission webhooks

Deploy to Kubernetes

# Build
chant build src/ --output manifests.yaml

# Diff before applying
kubectl diff -f manifests.yaml

# Dry run
kubectl apply -f manifests.yaml --dry-run=server

# Apply
kubectl apply -f manifests.yaml

Monitoring reconciliation

# List all Config Connector resources
kubectl get gcp -A

# Check specific resource status
kubectl describe storagebuckets.storage.cnrm.cloud.google.com my-bucket

# Watch for status changes
kubectl get gcp -A -w

Troubleshooting

Status	Meaning	Diagnostic	Fix
UpToDate	Resource in sync	None needed	—
Updating	Applying changes	`kubectl describe` → Events	Wait for completion
UpdateFailed	GCP API error	`kubectl describe` → Events	Check IAM permissions, quota, API enablement
DependencyNotReady	Waiting for ref	`kubectl get gcp`	Ensure referenced resource exists and is UpToDate
DeletionFailed	Cannot delete	`kubectl describe` → Events	Check IAM permissions, child resource dependencies

Common issues

Symptom	Cause	Resolution
Resource stuck in Updating	Missing GCP API	Enable API: add Service resource or `gcloud services enable`
Permission denied	Service account lacks IAM role	Grant role to Config Connector SA
Resource recreated on every apply	Missing deletion-policy annotation	Add `cnrm.cloud.google.com/deletion-policy: abandon`
Namespace not found	ConfigConnectorContext missing	Create ConfigConnectorContext in namespace
Cross-project reference fails	Missing project annotation	Add `cnrm.cloud.google.com/project-id` annotation

Quick reference

Command	Description
`chant build src/`	Synthesize manifests
`chant lint src/`	Check for anti-patterns
`kubectl apply -f manifests.yaml`	Apply to cluster
`kubectl get gcp -A`	List all Config Connector resources
`kubectl describe <resource>`	Check reconciliation status
`kubectl delete -f manifests.yaml`	Remove resources

chant