Update Cluster-Plan-Workflow.md

Cluster-Plan-Workflow.md

@@ -146,6 +146,18 @@ That host's `master_servers` / `filer_servers` / `volume_servers` rows get re-em
 
 See [[Cluster Plan Day 2 Operations]] for the full drift / refresh / dry-run workflow.
 
+## What plan does NOT generate
+
+`cluster plan` brings up the infrastructure; a few things it deliberately leaves for the operator:
+
+- **Buckets**: none auto-created. SeaweedFS doesn't pre-create any S3 bucket; the S3 gateway exposes the filer's `/buckets/` directory as the bucket namespace, but it starts empty. After deploy, create buckets via the S3 API (`aws --endpoint http://<s3-host>:8333 s3 mb s3://photos`) or `weed shell` (`bucket.create -name photos`).
+
+- **Filer metadata-store credentials**: the `filer_servers[].config:` block is empty unless you pass `--filer-backend` / `--filer-backend-file` / `$SEAWEEDUP_FILER_BACKEND`. With no backend, the filer falls back to embedded LevelDB at `<dataDir>/<instance>/filerldb2` (no credentials needed; not horizontally scalable). See [[Cluster Plan Inventory Reference]] for the `tag:`-substitution form.
+
+- **S3 IAM identities**: plan emits empty `s3_servers[]` entries; access keys / secret keys / per-user permissions are operator-authored. Hand-edit the `s3_servers[].s3_config.identities` block (see [examples/typical.yaml](https://github.com/seaweedfs/seaweed-up/blob/main/examples/typical.yaml)) before deploy or your S3 gateway runs anonymous-only.
+
+- **Admin UI password**: plan stamps `admin_user: admin` / `admin_password: CHANGE_ME` so the deployed UI isn't silently unauthenticated. The header comment in the generated `cluster.yaml` calls this out — **edit it to a real secret before deploy** or your admin UI accepts a known-bad password.
+
 ## Escape hatches
 
 - `--overwrite` — regenerate `cluster.yaml` from scratch, discarding all hand edits. Use when you've drifted too far to merge cleanly.