From c526b57f3027f6426fa857bf55cb6512412afb9b Mon Sep 17 00:00:00 2001
From: juvdiaz <juvenal.diaz@oracle.com>
Date: Mon, 29 Jun 2026 13:23:33 -0600
Subject: [PATCH] Guard Prometheus data deletion workflow

---
 jeannie | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/jeannie b/jeannie
index bc06699..21d42ac 100755
--- a/jeannie
+++ b/jeannie
@@ -497,9 +497,26 @@ run_tofu_plan_stack() {
 move_prometheus_stack_workers() {
     local stack="bootstrap/platform"
     local namespace="${LAB_MONITORING_NAMESPACE:-monitoring}"
+    local auto_approve="${LAB_AUTO_APPROVE:-true}"
+    local -a approve_args=()
 
     require_debian_server "move-prometheus-stack-workers"
 
+    if [[ "${LAB_CONFIRM_DELETE_PROMETHEUS_DATA:-}" != "true" ]]; then
+        cat >&2 <<'EOF'
+move-prometheus-stack-workers deletes existing prometheus-stack PVC/PV data.
+Rerun with LAB_CONFIRM_DELETE_PROMETHEUS_DATA=true when that data loss is intended.
+EOF
+        exit 1
+    fi
+
+    if truthy "${auto_approve}"; then
+        approve_args+=("-auto-approve")
+    elif ! disabled_value "${auto_approve}"; then
+        echo "LAB_AUTO_APPROVE must be true or false." >&2
+        exit 1
+    fi
+
     export TF_VAR_kubeconfig_path="${TF_VAR_kubeconfig_path:-${KUBECONFIG_PATH}}"
     export KUBECONFIG="${TF_VAR_kubeconfig_path}"
 
@@ -507,9 +524,9 @@ move_prometheus_stack_workers() {
     ensure_homelab_node_labels
     tofu -chdir="${REPO_ROOT}/${stack}" init
     adopt_platform_existing_resources
-    tofu -chdir="${REPO_ROOT}/${stack}" destroy -target=helm_release.prometheus_stack -auto-approve
+    tofu -chdir="${REPO_ROOT}/${stack}" destroy -target=helm_release.prometheus_stack "${approve_args[@]}"
     delete_prometheus_stack_storage "${namespace}"
-    tofu -chdir="${REPO_ROOT}/${stack}" apply -auto-approve
+    tofu -chdir="${REPO_ROOT}/${stack}" apply "${approve_args[@]}"
     kubectl --kubeconfig "${KUBECONFIG_PATH}" -n "${namespace}" get pods -o wide
 }