PERMISSIONS

Etcd Troubleshooting Skill - Permission Configuration

This document defines the permission grants for the etcd troubleshooting skill to enable faster diagnostics without requiring user approval for read-only operations.

Active Configuration

The project includes a .claude/settings.json file with pre-configured permissions for etcd troubleshooting. These permissions are automatically applied when using Claude Code in this repository.

Note: These permissions apply project-wide (not skill-specific) because Claude Code's permission system operates at the project level. However, since this repository is dedicated to two-node toolbox operations, granting read-only diagnostic permissions is appropriate for all use cases.

To customize permissions for your environment, create or edit .claude/settings.local.json (gitignored) to override project defaults.

Permission Philosophy

Automatic (No User Approval Required):

• Read-only operations on diagnostic data
• File reading from diagnostic output directories
• Basic Ansible fact gathering (no changes)
• OpenShift cluster status queries (read-only)

Requires User Approval:

• Any operation that modifies cluster state
• Running Ansible playbooks (except validation)
• Executing remediation scripts
• Pacemaker resource operations (cleanup, restart, etc.)

Granted Permissions

Bash Tool - Read-Only Commands

The following Bash commands are automatically approved for execution without user permission:

# File reading operations
Bash(cat:*)                    # Read any file
Bash(head:*)                   # Read beginning of files
Bash(tail:*)                   # Read end of files
Bash(less:*)                   # Page through files

# File searching and filtering
Bash(grep:*)                   # Search file contents
Bash(find:*)                   # Find files
Bash(ls:*)                     # List directory contents

# Diagnostic data inspection
Bash(jq:*)                     # Parse JSON output
Bash(yq:*)                     # Parse YAML output

# Git read-only operations
Bash(git log:*)                # View git history
Bash(git status:*)             # Check git status
Bash(git diff:*)               # View differences

# Ansible read-only operations
Bash(ansible cluster_vms -i * -m ping)           # Test connectivity
Bash(ansible cluster_vms -i * -m setup)          # Gather facts
Bash(ansible *_master_* -i * -m shell -a "cat *") # Read files via Ansible
Bash(ansible *_master_* -i * -m shell -a "grep *") # Search files via Ansible
Bash(ansible *_master_* -i * -m shell -a "tail *") # Read file ends via Ansible
Bash(ansible *_master_* -i * -m shell -a "pcs status*") # Read Pacemaker status
Bash(ansible *_master_* -i * -m shell -a "pcs resource status*") # Read resource status
Bash(ansible *_master_* -i * -m shell -a "podman ps*") # List containers
Bash(ansible *_master_* -i * -m shell -a "podman exec etcd etcdctl member list*") # Read member list
Bash(ansible *_master_* -i * -m shell -a "podman exec etcd etcdctl endpoint health*") # Check health
Bash(ansible *_master_* -i * -m shell -a "podman exec etcd etcdctl endpoint status*") # Check status
Bash(ansible *_master_* -i * -m shell -a "crm_attribute --query*") # Query CIB attributes
Bash(ansible *_master_* -i * -m shell -a "journalctl*") # Read system logs
Bash(ansible *_master_* -i * -m shell -a "systemctl status*") # Check service status

# OpenShift read-only operations (via oc-wrapper or with proxy sourcing)
Bash(source deploy/openshift-clusters/proxy.env && oc get*)  # Read cluster resources
Bash(source deploy/openshift-clusters/proxy.env && oc describe*) # Describe resources
Bash(source deploy/openshift-clusters/proxy.env && oc logs*) # Read pod logs
Bash(*oc-wrapper.sh get*)      # Get resources via wrapper
Bash(*oc-wrapper.sh describe*) # Describe resources via wrapper
Bash(*oc-wrapper.sh logs*)     # Read logs via wrapper