access-engine/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md

---
id: FLEX-WP-0038
type: workplan
title: "Wave-2 resource right-sizing for the flex-auth runtime"
domain: infotech
repo: access-engine
status: active
flavor: implementation
owner: access-engine
created: "2026-10-21"
updated: "2026-10-21"
related: [CUST-WP-0071, RESOURCE-WP-0008]
state_hub_workstream_id: "90ae025e-8102-5dfe-9461-7590f2b3fd3e"
---

# Wave-2 resource right-sizing for flex-auth

Receiving record for the node-level allocation review of RESOURCE-WP-0008
(resource-control `3d9b1bd`). Evidence:
`resource-control/docs/evidence/2026-10-21-node-allocation-review/2026-10-21-node-budget.{md,json}`.
The founder placed this task in access-engine, beside `charts/flex-auth`, on
2026-10-21 (`the-custodian/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md`).

```task
id: FLEX-WP-0038-T01
status: wait
blocking_reason: "8 of 9 flex-auth releases wait for owner review of --caller-audience and the sitting image change; ops-warden applied."
priority: low
needs_human: true
state_hub_task_id: "0ed6cd93-972e-56de-b6c8-0528249c90ae"
```

| Workload | Pods | CPU request (m) | CPU limit (m) | 7d CPU p95/peak (m) | Memory request (Mi) | 7d memory p95/peak (Mi) |
|---|---:|---|---:|---|---|---|
| flex-auth/flex-auth | 9 | 145 → 45 | 2700 | 2.2 / 18.6 | 288 → 176 | 140 / 191 |

Proposed values follow the review rule: the largest of p95×1.5, peak×0.5 and the
per-pod floor. Spread them across the 9 pods in the chart's existing resource
values (`charts/flex-auth/values.yaml`). Find the deployed values override first,
and check that the chart actually produces the live objects.

Verify: every flex-auth pod is Ready, with no restarts or OOM kills over 24 hours,
authorization decision latency is unchanged, and the next weekly allocation report
shows no CPU throttling. Rollback: revert the values commit and redeploy through
the existing path.

## Prepared 2026-10-22 (wave-2 worker W1b)

Status stays `wait` / `needs_human`. Local commit only: not pushed, not applied. Diff = full owner render vs live (`kubectl diff`, object names and changed key paths only, Secret objects skipped).

- Live source: 9 Helm releases `flex-auth-*` from `charts/flex-auth` with `values/<release>.yaml`. The `values/access-engine/*` files render differently named objects and are not deployed.
- Change: access-engine `36465de`: chart default request 25m/32Mi -> 5m/20Mi. Overrides: application-readback 24Mi, informed-decision-lifecycle 24Mi, informed-decision-sitting 40Mi (up, because p95 is 35Mi), informed-decision-t03 16Mi. CPU is 5m for every release. Total 45m/204Mi, compared with 176Mi proposed; the difference comes from per-pod rounding.
- Diff: NOT resource-only. In 8 of 9 releases, the chart at HEAD adds `--caller-audience` to the container args (`flex-auth` or `access-engine`, depending on the release). informed-decision-sitting also changes image. Only `flex-auth-ops-warden` diffs resource-only. This drift goes to the founder before any helm upgrade.
- Apply (per release, after founder OK): `helm upgrade --install flex-auth-<release> charts/flex-auth --namespace flex-auth -f values/<release>.yaml --wait --timeout 2m`.

## Applied — 2026-10-22 (FLEX-WP-0038-T01)

Partial: only `flex-auth-ops-warden` was applied (Helm revision 4, resources only). The other 8 releases wait, because chart HEAD adds `--caller-audience` and sitting would change image. Those need access-engine owner review before any resource-only rollout. Evidence: the-custodian docs/evidence/2026-10-22-wave2-apply.md.