From ae6861dec23d214fb5d37a967dbc3f3a4baec5ba Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 22 Oct 2026 00:08:06 +0200 Subject: [PATCH] NK-WP-0052-T01: prepare wave-2 requests for sso, mfa and net-kingdom-pg Requests lowered per the 2026-10-21 node budget; lldap (53.7% throttled) CPU limit 200m -> 1000m. kubectl diff against live: resources only. No apply. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 276069@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c --- sso-mfa/k8s/authelia/deployment.yaml | 4 +-- .../k8s/identity-provisioner/deployment.yaml | 2 +- sso-mfa/k8s/keycape/deployment.yaml | 2 +- sso-mfa/k8s/lldap/deployment.yaml | 4 +-- sso-mfa/k8s/postgresql/cluster.yaml | 2 +- sso-mfa/k8s/privacyidea/deployment.yaml | 4 +-- .../NK-WP-0052-wave2-resource-right-sizing.md | 33 +++++++++++++++++++ 7 files changed, 42 insertions(+), 9 deletions(-) diff --git a/sso-mfa/k8s/authelia/deployment.yaml b/sso-mfa/k8s/authelia/deployment.yaml index 2847789..7bfad83 100644 --- a/sso-mfa/k8s/authelia/deployment.yaml +++ b/sso-mfa/k8s/authelia/deployment.yaml @@ -116,8 +116,8 @@ spec: resources: requests: - cpu: "50m" - memory: "128Mi" + cpu: "5m" + memory: "64Mi" limits: cpu: "500m" memory: "256Mi" diff --git a/sso-mfa/k8s/identity-provisioner/deployment.yaml b/sso-mfa/k8s/identity-provisioner/deployment.yaml index fa574d9..65bf03d 100644 --- a/sso-mfa/k8s/identity-provisioner/deployment.yaml +++ b/sso-mfa/k8s/identity-provisioner/deployment.yaml @@ -45,7 +45,7 @@ spec: capabilities: {drop: ["ALL"]} readOnlyRootFilesystem: true resources: - requests: {cpu: 25m, memory: 32Mi} + requests: {cpu: 5m, memory: 32Mi} limits: {cpu: 250m, memory: 128Mi} readinessProbe: httpGet: {path: /readyz, port: http} diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml index 5bebf09..f79f59e 100644 --- a/sso-mfa/k8s/keycape/deployment.yaml +++ b/sso-mfa/k8s/keycape/deployment.yaml @@ -129,7 +129,7 @@ spec: resources: requests: - cpu: "25m" + cpu: "5m" memory: "32Mi" limits: cpu: "200m" diff --git a/sso-mfa/k8s/lldap/deployment.yaml b/sso-mfa/k8s/lldap/deployment.yaml index 775430d..2e151fd 100644 --- a/sso-mfa/k8s/lldap/deployment.yaml +++ b/sso-mfa/k8s/lldap/deployment.yaml @@ -100,10 +100,10 @@ spec: resources: requests: - cpu: "50m" + cpu: "25m" memory: "64Mi" limits: - cpu: "200m" + cpu: "1000m" memory: "128Mi" volumes: diff --git a/sso-mfa/k8s/postgresql/cluster.yaml b/sso-mfa/k8s/postgresql/cluster.yaml index fb317fe..4cd3d7f 100644 --- a/sso-mfa/k8s/postgresql/cluster.yaml +++ b/sso-mfa/k8s/postgresql/cluster.yaml @@ -78,7 +78,7 @@ spec: resources: requests: memory: "256Mi" - cpu: "100m" + cpu: "50m" limits: memory: "1Gi" cpu: "1000m" diff --git a/sso-mfa/k8s/privacyidea/deployment.yaml b/sso-mfa/k8s/privacyidea/deployment.yaml index bcccc83..fa56b92 100644 --- a/sso-mfa/k8s/privacyidea/deployment.yaml +++ b/sso-mfa/k8s/privacyidea/deployment.yaml @@ -121,8 +121,8 @@ spec: # Raise limits for production; privacyIDEA handles crypto and DB queries. resources: requests: - cpu: "100m" - memory: "256Mi" + cpu: "10m" + memory: "160Mi" limits: cpu: "500m" memory: "512Mi" diff --git a/workplans/NK-WP-0052-wave2-resource-right-sizing.md b/workplans/NK-WP-0052-wave2-resource-right-sizing.md index 1c03344..5a2494f 100644 --- a/workplans/NK-WP-0052-wave2-resource-right-sizing.md +++ b/workplans/NK-WP-0052-wave2-resource-right-sizing.md @@ -55,4 +55,37 @@ Steps: Verification: `kubectl -n get pod -o jsonpath='{..resources}'` shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta. +Prepared 2026-10-22 (wave-2 worker W3; no apply, cluster read-only). Live +objects are client-side-applied from `sso-mfa/k8s/` (plus out-of-band +`kubectl patch/set` history); each edited file was diffed against live with +`kubectl diff`: only `resources` keys change, no other drift. The +`factor-recovery` sidecar (added by `privacyidea/deploy-factor-recovery.py`, +not in `deployment.yaml`) is kept by the client-side merge and left at 10m/128Mi. + +The `sso` row (4 pods) splits per container; the throttled pod is **lldap** +(53.7% of CFS periods at its 200m limit; authelia/keycape/provisioner ~0%): + +| Container | CPU req | CPU limit | Mem req | Basis | +|---|---|---|---|---| +| sso/lldap | 50m -> 25m | 200m -> **1000m** | 64Mi (keep) | p95/peak 20.4/27.0m; limit rule max(2x current, 1000m) | +| sso/authelia | 50m -> 5m | 500m | 128Mi -> 64Mi | p95/peak 0.5/6.0m, mem p95 50Mi | +| sso/keycape | 25m -> 5m | 200m | 32Mi | p95 ~1m | +| sso/identity-provisioner | 25m -> 5m | 250m | 32Mi | p95 0.5m | +| mfa/privacyidea (main) | 100m -> 10m | 500m | 256Mi -> 160Mi | pod p95/peak 12.2/23.1m; now 125Mi | +| databases/net-kingdom-pg | 100m -> 50m | 1000m | 256Mi (keep) | DB floor 50m | + +Totals: sso 150m -> 40m (as proposed); sso memory 256Mi -> 192Mi (budget 176Mi; +lldap kept at 64Mi over its 59Mi p95); mfa 110m -> 20m, 384Mi -> 288Mi (budget +272Mi; sidecar untouched). net-kingdom-pg: `shared_buffers` unset (default +128MB) — no conflict with the unchanged 256Mi request / 1Gi limit. + +Apply (local kubectl, client-side as live, one at a time): +`kubectl apply -f sso-mfa/k8s/{lldap,authelia,keycape,identity-provisioner}/deployment.yaml`, +`kubectl apply -f sso-mfa/k8s/privacyidea/deployment.yaml`, +`kubectl apply -f sso-mfa/k8s/postgresql/cluster.yaml` (DB window). +Impact: every Deployment is 1 replica with strategy Recreate, so each apply is a +short outage of that component: authelia/lldap/keycape = SSO login path, +privacyidea = MFA; net-kingdom-pg restart (CNPG single instance) takes +privacyIDEA/authelia storage down briefly. Run off-peak, health-check between. + Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after `kubectl get -o yaml` captures as the receipt.