tegwick
b2ddb4b3eb
The claims name the workloads covered by RELREG-WP-0004. Each pin is a digest the live object already shows. Assistant: grok Assistant-Session: 01a16880-25e0-7031-b553-a1e0321ff397
58 lines
3.4 KiB
Markdown
58 lines
3.4 KiB
Markdown
---
|
||
id: FLEX-WP-0038
|
||
type: workplan
|
||
title: "Wave-2 resource right-sizing for the flex-auth runtime"
|
||
domain: infotech
|
||
repo: access-engine
|
||
status: active
|
||
flavor: implementation
|
||
owner: access-engine
|
||
created: "2026-10-21"
|
||
updated: "2026-10-21"
|
||
related: [CUST-WP-0071, RESOURCE-WP-0008]
|
||
state_hub_workstream_id: "90ae025e-8102-5dfe-9461-7590f2b3fd3e"
|
||
---
|
||
|
||
# Wave-2 resource right-sizing for flex-auth
|
||
|
||
Receiving record for the node-level allocation review of RESOURCE-WP-0008
|
||
(resource-control `3d9b1bd`). Evidence:
|
||
`resource-control/docs/evidence/2026-10-21-node-allocation-review/2026-10-21-node-budget.{md,json}`.
|
||
The founder placed this task in access-engine, beside `charts/flex-auth`, on
|
||
2026-10-21 (`the-custodian/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md`).
|
||
|
||
```task
|
||
id: FLEX-WP-0038-T01
|
||
status: wait
|
||
blocking_reason: "8 of 9 flex-auth releases wait for owner review of --caller-audience and the sitting image change; ops-warden applied."
|
||
priority: low
|
||
needs_human: true
|
||
state_hub_task_id: "0ed6cd93-972e-56de-b6c8-0528249c90ae"
|
||
```
|
||
|
||
| Workload | Pods | CPU request (m) | CPU limit (m) | 7d CPU p95/peak (m) | Memory request (Mi) | 7d memory p95/peak (Mi) |
|
||
|---|---:|---|---:|---|---|---|
|
||
| flex-auth/flex-auth | 9 | 145 → 45 | 2700 | 2.2 / 18.6 | 288 → 176 | 140 / 191 |
|
||
|
||
Proposed values follow the review rule: the largest of p95×1.5, peak×0.5 and the
|
||
per-pod floor. Spread them across the 9 pods in the chart's existing resource
|
||
values (`charts/flex-auth/values.yaml`). Find the deployed values override first,
|
||
and check that the chart actually produces the live objects.
|
||
|
||
Verify: every flex-auth pod is Ready, with no restarts or OOM kills over 24 hours,
|
||
authorization decision latency is unchanged, and the next weekly allocation report
|
||
shows no CPU throttling. Rollback: revert the values commit and redeploy through
|
||
the existing path.
|
||
|
||
## Prepared 2026-10-22 (wave-2 worker W1b)
|
||
|
||
Status stays `wait` / `needs_human`. Local commit only: not pushed, not applied. Diff = full owner render vs live (`kubectl diff`, object names and changed key paths only, Secret objects skipped).
|
||
|
||
- Live source: 9 Helm releases `flex-auth-*` from `charts/flex-auth` with `values/<release>.yaml`. The `values/access-engine/*` files render differently named objects and are not deployed.
|
||
- Change: access-engine `36465de`: chart default request 25m/32Mi -> 5m/20Mi. Overrides: application-readback 24Mi, informed-decision-lifecycle 24Mi, informed-decision-sitting 40Mi (up, because p95 is 35Mi), informed-decision-t03 16Mi. CPU is 5m for every release. Total 45m/204Mi, compared with 176Mi proposed; the difference comes from per-pod rounding.
|
||
- Diff: NOT resource-only. In 8 of 9 releases, the chart at HEAD adds `--caller-audience` to the container args (`flex-auth` or `access-engine`, depending on the release). informed-decision-sitting also changes image. Only `flex-auth-ops-warden` diffs resource-only. This drift goes to the founder before any helm upgrade.
|
||
- Apply (per release, after founder OK): `helm upgrade --install flex-auth-<release> charts/flex-auth --namespace flex-auth -f values/<release>.yaml --wait --timeout 2m`.
|
||
|
||
## Applied — 2026-10-22 (FLEX-WP-0038-T01)
|
||
|
||
Partial: only `flex-auth-ops-warden` was applied (Helm revision 4, resources only). The other 8 releases wait, because chart HEAD adds `--caller-audience` and sitting would change image. Those need access-engine owner review before any resource-only rollout. Evidence: the-custodian docs/evidence/2026-10-22-wave2-apply.md.
|