NK-WP-0052-T01: prepare wave-2 requests for sso, mfa and net-kingdom-pg

Requests lowered per the 2026-10-21 node budget; lldap (53.7% throttled)
CPU limit 200m -> 1000m. kubectl diff against live: resources only. No apply.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

sso-mfa/k8s/authelia/deployment.yaml

@@ -116,8 +116,8 @@ spec:
 
           resources:
             requests:
-              cpu: "50m"
-              memory: "128Mi"
+              cpu: "5m"
+              memory: "64Mi"
             limits:
               cpu: "500m"
               memory: "256Mi"

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -45,7 +45,7 @@ spec:
             capabilities: {drop: ["ALL"]}
             readOnlyRootFilesystem: true
           resources:
-            requests: {cpu: 25m, memory: 32Mi}
+            requests: {cpu: 5m, memory: 32Mi}
             limits: {cpu: 250m, memory: 128Mi}
           readinessProbe:
             httpGet: {path: /readyz, port: http}

sso-mfa/k8s/keycape/deployment.yaml

@@ -129,7 +129,7 @@ spec:
 
           resources:
             requests:
-              cpu: "25m"
+              cpu: "5m"
               memory: "32Mi"
             limits:
               cpu: "200m"

sso-mfa/k8s/lldap/deployment.yaml

@@ -100,10 +100,10 @@ spec:
 
           resources:
             requests:
-              cpu: "50m"
+              cpu: "25m"
               memory: "64Mi"
             limits:
-              cpu: "200m"
+              cpu: "1000m"
               memory: "128Mi"
 
       volumes:

sso-mfa/k8s/postgresql/cluster.yaml

@@ -78,7 +78,7 @@ spec:
   resources:
     requests:
       memory: "256Mi"
-      cpu: "100m"
+      cpu: "50m"
     limits:
       memory: "1Gi"
       cpu: "1000m"

sso-mfa/k8s/privacyidea/deployment.yaml

@@ -121,8 +121,8 @@ spec:
           # Raise limits for production; privacyIDEA handles crypto and DB queries.
           resources:
             requests:
-              cpu: "100m"
-              memory: "256Mi"
+              cpu: "10m"
+              memory: "160Mi"
             limits:
               cpu: "500m"
               memory: "512Mi"

workplans/NK-WP-0052-wave2-resource-right-sizing.md

@@ -55,4 +55,37 @@ Steps:
 
 Verification: `kubectl -n <ns> get pod -o jsonpath='{..resources}'` shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta.
 
+Prepared 2026-10-22 (wave-2 worker W3; no apply, cluster read-only). Live
+objects are client-side-applied from `sso-mfa/k8s/` (plus out-of-band
+`kubectl patch/set` history); each edited file was diffed against live with
+`kubectl diff`: only `resources` keys change, no other drift. The
+`factor-recovery` sidecar (added by `privacyidea/deploy-factor-recovery.py`,
+not in `deployment.yaml`) is kept by the client-side merge and left at 10m/128Mi.
+
+The `sso` row (4 pods) splits per container; the throttled pod is **lldap**
+(53.7% of CFS periods at its 200m limit; authelia/keycape/provisioner ~0%):
+
+| Container | CPU req | CPU limit | Mem req | Basis |
+|---|---|---|---|---|
+| sso/lldap | 50m -> 25m | 200m -> **1000m** | 64Mi (keep) | p95/peak 20.4/27.0m; limit rule max(2x current, 1000m) |
+| sso/authelia | 50m -> 5m | 500m | 128Mi -> 64Mi | p95/peak 0.5/6.0m, mem p95 50Mi |
+| sso/keycape | 25m -> 5m | 200m | 32Mi | p95 ~1m |
+| sso/identity-provisioner | 25m -> 5m | 250m | 32Mi | p95 0.5m |
+| mfa/privacyidea (main) | 100m -> 10m | 500m | 256Mi -> 160Mi | pod p95/peak 12.2/23.1m; now 125Mi |
+| databases/net-kingdom-pg | 100m -> 50m | 1000m | 256Mi (keep) | DB floor 50m |
+
+Totals: sso 150m -> 40m (as proposed); sso memory 256Mi -> 192Mi (budget 176Mi;
+lldap kept at 64Mi over its 59Mi p95); mfa 110m -> 20m, 384Mi -> 288Mi (budget
+272Mi; sidecar untouched). net-kingdom-pg: `shared_buffers` unset (default
+128MB) — no conflict with the unchanged 256Mi request / 1Gi limit.
+
+Apply (local kubectl, client-side as live, one at a time):
+`kubectl apply -f sso-mfa/k8s/{lldap,authelia,keycape,identity-provisioner}/deployment.yaml`,
+`kubectl apply -f sso-mfa/k8s/privacyidea/deployment.yaml`,
+`kubectl apply -f sso-mfa/k8s/postgresql/cluster.yaml` (DB window).
+Impact: every Deployment is 1 replica with strategy Recreate, so each apply is a
+short outage of that component: authelia/lldap/keycape = SSO login path,
+privacyidea = MFA; net-kingdom-pg restart (CNPG single instance) takes
+privacyIDEA/authelia storage down briefly. Run off-peak, health-check between.
+
 Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after `kubectl get -o yaml` captures as the receipt.