5 architectural gaps
criticalDatastore connectivity
prodprod cannot open connections to 3 shared datastore(s) on ogm-datacenter: milvus, mysql-n8n, postgres-n8n.
Why it matters — Any application deployed to prod that needs one of these will fail at startup or on its first query — and it will look like an application bug rather than a firewall rule.
What to do
ogm-datacenter publishes these ports through Docker, so plain 'ufw allow' does not apply. Add this environment's public IP to ALLOWED_SOURCES in the ogm-datacenter repository's scripts/setup-firewall.sh and re-run it, so the rule lands in the DOCKER-USER chain.
Runtime parity
dev, stage, prodDev runs applications as plain Docker containers behind nginx, while Stage and Prod both run kubeadm Kubernetes. A deployment that works on Dev exercises none of the Kubernetes path it will hit next.
Why it matters — Anything Kubernetes-specific — manifests, probes, ingress rules, service accounts, image pull secrets, resource limits — is first tested in Stage. Failures that could have been caught locally surface one environment later, on shared infrastructure.
What to do
Install a single-node kubeadm cluster on Dev KVM4 at the same v1.28.x as Stage, or run k3s if the 4 vCPU / 16 GB budget is tight. Dev has 172 GB free and 14.8 GB of available memory, so it has the headroom. The Blueprint designer will then be able to generate identical manifests for all three environments instead of Compose for one and Kubernetes for the others.
Datastore connectivity
devdev cannot open connections to 3 shared datastore(s) on ogm-datacenter: milvus, mysql-n8n, postgres-n8n.
Why it matters — Any application deployed to dev that needs one of these will fail at startup or on its first query — and it will look like an application bug rather than a firewall rule.
What to do
ogm-datacenter publishes these ports through Docker, so plain 'ufw allow' does not apply. Add this environment's public IP to ALLOWED_SOURCES in the ogm-datacenter repository's scripts/setup-firewall.sh and re-run it, so the rule lands in the DOCKER-USER chain.
Datastore connectivity
stagestage cannot open connections to 11 shared datastore(s) on ogm-datacenter: chromadb, elasticsearch, milvus, mongodb, mysql-n8n, neo4j, nfs, postgres-n8n, postgresql, qdrant, redis.
Why it matters — Any application deployed to stage that needs one of these will fail at startup or on its first query — and it will look like an application bug rather than a firewall rule.
What to do
ogm-datacenter publishes these ports through Docker, so plain 'ufw allow' does not apply. Add this environment's public IP to ALLOWED_SOURCES in the ogm-datacenter repository's scripts/setup-firewall.sh and re-run it, so the rule lands in the DOCKER-USER chain.
Single-node cluster
prodprod runs Kubernetes on a single node, which is both the control plane and the only worker.
Why it matters — There is nowhere to reschedule a workload. Losing the node loses the cluster, and control-plane maintenance is indistinguishable from an outage.
What to do
Add at least one worker node to KVM8's cluster so workloads survive control-plane trouble, and keep etcd backed up to ogm-datacenter.