access-engine/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md

id	type	title	domain	repo	status	flavor	owner	created	updated	related	state_hub_workstream_id
FLEX-WP-0038	workplan	Wave-2 resource right-sizing for the flex-auth runtime	infotech	access-engine	active	implementation	access-engine	2026-10-21	2026-10-21	CUST-WP-0071 RESOURCE-WP-0008	90ae025e-8102-5dfe-9461-7590f2b3fd3e

Wave-2 resource right-sizing for flex-auth

Receiving record for the node-level allocation review of RESOURCE-WP-0008 (resource-control 3d9b1bd). Evidence: resource-control/docs/evidence/2026-10-21-node-allocation-review/2026-10-21-node-budget.{md,json}. The founder placed this task in access-engine, beside charts/flex-auth, on 2026-10-21 (the-custodian/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md).

id: FLEX-WP-0038-T01
status: wait
blocking_reason: "8 of 9 flex-auth releases wait for owner review of --caller-audience and the sitting image change; ops-warden applied."
priority: low
needs_human: true
state_hub_task_id: "0ed6cd93-972e-56de-b6c8-0528249c90ae"

Workload	Pods	CPU request (m)	CPU limit (m)	7d CPU p95/peak (m)	Memory request (Mi)	7d memory p95/peak (Mi)
flex-auth/flex-auth	9	145 → 45	2700	2.2 / 18.6	288 → 176	140 / 191

Proposed values follow the review rule: the largest of p95×1.5, peak×0.5 and the per-pod floor. Spread them across the 9 pods in the chart's existing resource values (charts/flex-auth/values.yaml). Find the deployed values override first, and check that the chart actually produces the live objects.

Verify: every flex-auth pod is Ready, with no restarts or OOM kills over 24 hours, authorization decision latency is unchanged, and the next weekly allocation report shows no CPU throttling. Rollback: revert the values commit and redeploy through the existing path.

Prepared 2026-10-22 (wave-2 worker W1b)

Status stays wait / needs_human. Local commit only: not pushed, not applied. Diff = full owner render vs live (kubectl diff, object names and changed key paths only, Secret objects skipped).

• Live source: 9 Helm releases flex-auth-* from charts/flex-auth with values/<release>.yaml. The values/access-engine/* files render differently named objects and are not deployed.
• Change: access-engine 36465de: chart default request 25m/32Mi -> 5m/20Mi. Overrides: application-readback 24Mi, informed-decision-lifecycle 24Mi, informed-decision-sitting 40Mi (up, because p95 is 35Mi), informed-decision-t03 16Mi. CPU is 5m for every release. Total 45m/204Mi, compared with 176Mi proposed; the difference comes from per-pod rounding.
• Diff: NOT resource-only. In 8 of 9 releases, the chart at HEAD adds --caller-audience to the container args (flex-auth or access-engine, depending on the release). informed-decision-sitting also changes image. Only flex-auth-ops-warden diffs resource-only. This drift goes to the founder before any helm upgrade.
• Apply (per release, after founder OK): helm upgrade --install flex-auth-<release> charts/flex-auth --namespace flex-auth -f values/<release>.yaml --wait --timeout 2m.

Applied — 2026-10-22 (FLEX-WP-0038-T01)

Partial: only flex-auth-ops-warden was applied (Helm revision 4, resources only). The other 8 releases wait, because chart HEAD adds --caller-audience and sitting would change image. Those need access-engine owner review before any resource-only rollout. Evidence: the-custodian docs/evidence/2026-10-22-wave2-apply.md.