From b7fb7b226f040fd30c7e321e56eed7aed09feab2 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 22 Oct 2026 00:03:48 +0200 Subject: [PATCH] Wave-2 right-sizing and inter-hub removal (RAPPS-WP-0018, CSOC-WP-0017, REUSE-WP-0026) - coulomb-social: requests 100m/256Mi -> 15m/176Mi (limits unchanged) - reuse-surface: main 100m/256Mi -> 5m/64Mi, landing 10m/32Mi -> 5m/16Mi - vergabe-demo-company: memory request 256Mi -> 512Mi, CPU 60m kept - inter-hub (retired, CORE-WP-0007): delete chart, values, Make targets, smoke script and production deploy workflow; release to be uninstalled Full renders vs live: resources only, except the vergabe release-unit label from 64530e1 not yet on its Service and PVCs. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 276069@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c --- .claude/rules/stack-and-commands.md | 4 +- .../inter-hub-production-deploy.yaml | 50 ----------- Makefile | 60 +------------ charts/inter-hub/Chart.yaml | 16 ---- charts/inter-hub/templates/_helpers.tpl | 28 ------ charts/inter-hub/templates/deployment.yaml | 59 ------------- charts/inter-hub/templates/ingress.yaml | 28 ------ charts/inter-hub/templates/service.yaml | 13 --- charts/inter-hub/values.yaml | 55 ------------ docs/inter-hub-on-railiance01.md | 8 ++ docs/operator-setup.md | 1 - helm/coulomb-social-values.yaml | 10 +++ helm/inter-hub-values.yaml | 6 -- helm/reuse-surface-values.yaml | 18 ++++ .../vergabe-demo-company-values.proposed.yaml | 3 +- ...y.railiance.workload-deployment-tooling.md | 1 - tools/inter-hub-smoke.sh | 87 ------------------- tools/k8s-server-dry-run.sh | 20 ----- 18 files changed, 41 insertions(+), 426 deletions(-) delete mode 100644 .gitea/workflows/inter-hub-production-deploy.yaml delete mode 100644 charts/inter-hub/Chart.yaml delete mode 100644 charts/inter-hub/templates/_helpers.tpl delete mode 100644 charts/inter-hub/templates/deployment.yaml delete mode 100644 charts/inter-hub/templates/ingress.yaml delete mode 100644 charts/inter-hub/templates/service.yaml delete mode 100644 charts/inter-hub/values.yaml delete mode 100644 helm/inter-hub-values.yaml delete mode 100755 tools/inter-hub-smoke.sh diff --git a/.claude/rules/stack-and-commands.md b/.claude/rules/stack-and-commands.md index 1166d78..93b53d4 100644 --- a/.claude/rules/stack-and-commands.md +++ b/.claude/rules/stack-and-commands.md @@ -1,7 +1,7 @@ ## Stack - **Language:** Helm values + Kubernetes manifests, Bash Make targets -- **Key deps:** vergabe-teilnahme (Django) and inter-hub releases, shared apps-pg cnpg cluster, SOPS/age; runs against the S2 cluster on railiance01 +- **Key deps:** vergabe-teilnahme (Django), coulomb-social and reuse-surface releases (inter-hub retired and removed), shared apps-pg cnpg cluster, SOPS/age; runs against the S2 cluster on railiance01 ## Dev Commands @@ -13,7 +13,7 @@ make vergabe-dry-run # helm template render, no apply make vergabe-status # pod / svc / ingress / cert state (read-only) make vergabe-deploy # production-touching make vergabe-migrate | vergabe-seed # production-touching (Django management) -make check-inter-hub-image-tag # gate: explicit image tag for prod deploys +make check-vergabe-image-tag # gate: explicit image tag for prod deploys ``` `*-deploy` / `*-migrate` / `*-seed` change production workloads — operator diff --git a/.gitea/workflows/inter-hub-production-deploy.yaml b/.gitea/workflows/inter-hub-production-deploy.yaml deleted file mode 100644 index 39edf9e..0000000 --- a/.gitea/workflows/inter-hub-production-deploy.yaml +++ /dev/null @@ -1,50 +0,0 @@ -name: Inter-Hub production deploy - -on: - workflow_dispatch: - inputs: - image_tag: - description: "Immutable inter-hub image tag to deploy, for example 5101eb5" - required: true - confirm: - description: "Type deploy-inter-hub-production to confirm Railiance01 production deploy" - required: true - -jobs: - deploy: - runs-on: [self-hosted, haskelseed, linux_amd64] - timeout-minutes: 20 - env: - INTER_HUB_IMAGE_TAG: ${{ inputs.image_tag }} - steps: - - name: Check out repository - uses: actions/checkout@v4 - - - name: Validate dispatch inputs - env: - CONFIRM: ${{ inputs.confirm }} - run: | - set -euo pipefail - if [ "$CONFIRM" != "deploy-inter-hub-production" ]; then - echo "Refusing deploy: confirmation text did not match." >&2 - exit 1 - fi - if ! [[ "$INTER_HUB_IMAGE_TAG" =~ ^[A-Za-z0-9._-]+$ ]]; then - echo "Refusing deploy: image_tag contains unsupported characters." >&2 - exit 1 - fi - - - name: Verify image manifest exists - run: make check-inter-hub-image - - - name: Helm server dry-run - run: make inter-hub-server-dry-run - - - name: Deploy Inter-Hub - run: make inter-hub-deploy - - - name: Show release status - run: make inter-hub-status - - - name: Run public smoke checks - run: make inter-hub-smoke diff --git a/Makefile b/Makefile index 7a58d4f..40a4c21 100644 --- a/Makefile +++ b/Makefile @@ -24,14 +24,6 @@ COULOMB_SOCIAL_IMAGE_REPOSITORY ?= forgejo.coulomb.social/coulomb/coulomb-social COULOMB_SOCIAL_INGRESS ?= manifests/coulomb-social-ingress.yaml COULOMB_SOCIAL_ENV_SECRET ?= coulomb-social-env -INTER_HUB_RELEASE ?= inter-hub -INTER_HUB_NAMESPACE ?= inter-hub -INTER_HUB_CHART ?= charts/inter-hub -INTER_HUB_VALUES ?= helm/inter-hub-values.yaml -INTER_HUB_IMAGE_REPOSITORY ?= forgejo.coulomb.social/coulomb/inter-hub -INTER_HUB_IMAGE_TAG ?= -INTER_HUB_BASE_URL ?= https://hub.coulomb.social - REUSE_RELEASE ?= reuse REUSE_NAMESPACE ?= reuse REUSE_CHART ?= charts/reuse-surface @@ -52,7 +44,6 @@ POLICY_NEXUS_REVISION ?= COULOMBCORE_KUBECONFIG ?= $(HOME)/.kube/config RAILIANCE01_KUBECONFIG ?= $(HOME)/.kube/config-railiance01 PRODUCTION_KUBECONFIG ?= $(COULOMBCORE_KUBECONFIG) -INTER_HUB_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG) REUSE_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG) FORGEJO_KUBECONFIG ?= $(RAILIANCE01_KUBECONFIG) FORGEJO_RELEASE ?= forgejo @@ -75,8 +66,6 @@ FORGEJO_MAILER_EXTERNAL_SECRET ?= manifests/forgejo-mailer-externalsecret.yaml REUSE_RUNTIME_EXTERNAL_SECRET ?= manifests/reuse-surface-runtime-externalsecret.yaml PLATFORM_REPO ?= $(HOME)/railiance-platform ESO_CHART_VERSION ?= 0.16.1 -INTER_HUB_IMAGE_REF = $(INTER_HUB_IMAGE_REPOSITORY):$(INTER_HUB_IMAGE_TAG) -INTER_HUB_IMAGE_SET_ARG = $(if $(strip $(INTER_HUB_IMAGE_TAG)),--set image.tag=$(INTER_HUB_IMAGE_TAG),) CORE_HUB_RELEASE ?= core-hub CORE_HUB_NAMESPACE ?= core-hub @@ -139,16 +128,6 @@ check-coulombcore-kubeconfig: ## Verify CoulombCore kubeconfig and k3s API tunne check-production-kubeconfig: check-coulombcore-kubeconfig ## Verify production app cluster API (CoulombCore) -check-inter-hub-image-tag: ## Require an explicit inter-hub image tag for production deploys - @test -n "$(INTER_HUB_IMAGE_TAG)" || { \ - echo "Set INTER_HUB_IMAGE_TAG= for inter-hub production deploys." >&2; \ - echo "Example: INTER_HUB_IMAGE_TAG=91037a4 make inter-hub-deploy" >&2; \ - exit 1; \ - } - -check-inter-hub-image: check-inter-hub-image-tag ## Verify the inter-hub OCI image tag exists before deploy - tools/check-oci-image.sh "$(INTER_HUB_IMAGE_REF)" - check-core-hub-image-tag: ## Require an explicit core-hub image tag for production deploys @test -n "$(CORE_HUB_IMAGE_TAG)" || { \ echo "Set CORE_HUB_IMAGE_TAG= for core-hub production deploys." >&2; \ @@ -315,43 +294,6 @@ coulomb-social-env-secret: ## Create/patch coulomb-social-env (SECRET_KEY, DATAB coulomb-social-env-secret-dry-run: ## Plan coulomb-social-env keys without applying @bash tools/create-coulomb-social-env-secret.sh --dry-run $(COULOMB_SOCIAL_ENV_SECRET_ARGS) -##@ Inter-Hub - -inter-hub-render-baseline: ## Render checked-in inter-hub values for chart validation only - helm template $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \ - --namespace $(INTER_HUB_NAMESPACE) \ - -f $(INTER_HUB_VALUES) - -inter-hub-dry-run: check-railiance01-kubeconfig check-inter-hub-image-tag ## helm template render with an explicit production image tag - KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm template $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \ - --namespace $(INTER_HUB_NAMESPACE) \ - -f $(INTER_HUB_VALUES) $(INTER_HUB_IMAGE_SET_ARG) - -inter-hub-server-dry-run: check-railiance01-kubeconfig check-inter-hub-image ## Helm server dry-run inter-hub upgrade on Railiance01 - KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm upgrade --install $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \ - --namespace $(INTER_HUB_NAMESPACE) --create-namespace \ - -f $(INTER_HUB_VALUES) $(INTER_HUB_IMAGE_SET_ARG) --dry-run=server --timeout 5m - -inter-hub-deploy: check-railiance01-kubeconfig check-inter-hub-image ## Deploy / upgrade inter-hub Helm release on Railiance01 - KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm upgrade --install $(INTER_HUB_RELEASE) $(INTER_HUB_CHART) \ - --namespace $(INTER_HUB_NAMESPACE) --create-namespace \ - -f $(INTER_HUB_VALUES) $(INTER_HUB_IMAGE_SET_ARG) --wait --timeout 5m - -inter-hub-status: check-railiance01-kubeconfig ## Show inter-hub pod / svc / ingress / cert state on Railiance01 - KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl get pods,svc,ingress,certificate -n $(INTER_HUB_NAMESPACE) -l app=$(INTER_HUB_RELEASE) --ignore-not-found - -inter-hub-release-info: check-railiance01-kubeconfig ## Show inter-hub Helm history, values, deployment, and pods - KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm history $(INTER_HUB_RELEASE) -n $(INTER_HUB_NAMESPACE) - KUBECONFIG="$(INTER_HUB_KUBECONFIG)" helm get values $(INTER_HUB_RELEASE) -n $(INTER_HUB_NAMESPACE) - KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl describe deploy/$(INTER_HUB_RELEASE) -n $(INTER_HUB_NAMESPACE) - KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl get pods -n $(INTER_HUB_NAMESPACE) -o wide - -inter-hub-smoke: ## Verify public inter-hub v2 route and OpenAPI surface after rollout - INTER_HUB_BASE_URL="$(INTER_HUB_BASE_URL)" tools/inter-hub-smoke.sh - -inter-hub-logs: check-railiance01-kubeconfig ## Tail inter-hub app logs from Railiance01 - KUBECONFIG="$(INTER_HUB_KUBECONFIG)" kubectl logs -n $(INTER_HUB_NAMESPACE) -l app=$(INTER_HUB_RELEASE) -f --tail=50 - ##@ Core Hub core-hub-helm-adopt: check-production-kubeconfig ## Annotate live Core Hub resources for Helm ownership @@ -652,7 +594,7 @@ help: ## Show this help /^[a-zA-Z0-9_-]+:.*?##/ { printf " \033[36m%-20s\033[0m %s\n", $$1, $$2 } \ /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST) -.PHONY: check-tools check-sops k8s-server-dry-run apps-pg-status apps-pg-restore-drill check-railiance01-kubeconfig check-inter-hub-image-tag check-inter-hub-image check-vergabe-image-tag check-vergabe-image vergabe-dry-run vergabe-deploy vergabe-ingress-deploy vergabe-status vergabe-migrate vergabe-seed vergabe-superuser vergabe-logs vergabe-db-url-secret check-coulomb-social-image-tag coulomb-social-dry-run coulomb-social-deploy coulomb-social-ingress-deploy coulomb-social-status coulomb-social-logs coulomb-social-env-secret coulomb-social-env-secret-dry-run eso-deploy forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy forgejo-mailer-es-deploy forgejo-mailer-es-status forgejo-dry-run forgejo-server-dry-run forgejo-deploy forgejo-ingress-deploy forgejo-ssh-nodeport-deploy forgejo-status forgejo-smoke forgejo-npm-smoke forgejo-verify forgejo-operator-bootstrap forgejo-runner-registration-sops-bootstrap forgejo-secrets-check forgejo-logs forgejo-runner-registration-deploy forgejo-runner-deploy forgejo-runner-status forgejo-runner-logs inter-hub-render-baseline inter-hub-dry-run inter-hub-server-dry-run inter-hub-deploy inter-hub-status inter-hub-release-info inter-hub-smoke inter-hub-logs reuse-dry-run reuse-deploy reuse-status reuse-smoke reuse-logs reuse-forgejo-webhook reuse-openbao-eso-token-apply reuse-openbao-store-deploy reuse-runtime-es-deploy reuse-runtime-es-status reuse-webhook-smoke policy-nexus-check-binding policy-nexus-check-image policy-nexus-render policy-nexus-server-dry-run policy-nexus-deploy policy-nexus-status policy-nexus-smoke policy-nexus-rollback help +.PHONY: check-tools check-sops k8s-server-dry-run apps-pg-status apps-pg-restore-drill check-railiance01-kubeconfig check-vergabe-image-tag check-vergabe-image vergabe-dry-run vergabe-deploy vergabe-ingress-deploy vergabe-status vergabe-migrate vergabe-seed vergabe-superuser vergabe-logs vergabe-db-url-secret check-coulomb-social-image-tag coulomb-social-dry-run coulomb-social-deploy coulomb-social-ingress-deploy coulomb-social-status coulomb-social-logs coulomb-social-env-secret coulomb-social-env-secret-dry-run eso-deploy forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy forgejo-mailer-es-deploy forgejo-mailer-es-status forgejo-dry-run forgejo-server-dry-run forgejo-deploy forgejo-ingress-deploy forgejo-ssh-nodeport-deploy forgejo-status forgejo-smoke forgejo-npm-smoke forgejo-verify forgejo-operator-bootstrap forgejo-runner-registration-sops-bootstrap forgejo-secrets-check forgejo-logs forgejo-runner-registration-deploy forgejo-runner-deploy forgejo-runner-status forgejo-runner-logs reuse-dry-run reuse-deploy reuse-status reuse-smoke reuse-logs reuse-forgejo-webhook reuse-openbao-eso-token-apply reuse-openbao-store-deploy reuse-runtime-es-deploy reuse-runtime-es-status reuse-webhook-smoke policy-nexus-check-binding policy-nexus-check-image policy-nexus-render policy-nexus-server-dry-run policy-nexus-deploy policy-nexus-status policy-nexus-smoke policy-nexus-rollback help .PHONY: forgejo-secret-scan-template-deploy diff --git a/charts/inter-hub/Chart.yaml b/charts/inter-hub/Chart.yaml deleted file mode 100644 index 23104d3..0000000 --- a/charts/inter-hub/Chart.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v2 -name: inter-hub -description: | - Interaction Hub Framework reference deployment for Railiance01. -type: application -version: 0.1.0 -appVersion: "0.2.0-alpha.1" -keywords: - - ihf - - inter-hub - - railiance -home: https://forgejo.coulomb.social/coulomb/inter-hub-haskell -sources: - - https://forgejo.coulomb.social/coulomb/inter-hub-haskell -maintainers: - - name: railiance-apps diff --git a/charts/inter-hub/templates/_helpers.tpl b/charts/inter-hub/templates/_helpers.tpl deleted file mode 100644 index f7fa4f1..0000000 --- a/charts/inter-hub/templates/_helpers.tpl +++ /dev/null @@ -1,28 +0,0 @@ -{{/* -Chart name + release name produce a unique resource name. -*/}} -{{- define "interhub.fullname" -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s" $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{- define "interhub.labels" -}} -app: {{ include "interhub.fullname" . }} -app.kubernetes.io/name: {{ include "interhub.fullname" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -app.kubernetes.io/part-of: railiance-apps -helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }} -{{- end -}} - -{{- define "interhub.selectorLabels" -}} -app: {{ include "interhub.fullname" . }} -{{- end -}} - -{{- define "interhub.image" -}} -{{- if not .Values.image.tag -}} -{{- fail "image.tag is required - pin it in helm/inter-hub-values.yaml or pass --set image.tag=" -}} -{{- end -}} -{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}} -{{- end -}} diff --git a/charts/inter-hub/templates/deployment.yaml b/charts/inter-hub/templates/deployment.yaml deleted file mode 100644 index 0646509..0000000 --- a/charts/inter-hub/templates/deployment.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "interhub.fullname" . }} - labels: {{- include "interhub.labels" . | nindent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: {{- include "interhub.selectorLabels" . | nindent 6 }} - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - template: - metadata: - labels: {{- include "interhub.labels" . | nindent 8 }} - spec: - securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} - containers: - - name: inter-hub - image: {{ include "interhub.image" . | quote }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - ports: - - name: http - containerPort: {{ .Values.service.targetPort }} - protocol: TCP - envFrom: - - secretRef: - name: {{ .Values.envSecretName | quote }} - {{- if .Values.probes.enabled }} - readinessProbe: - httpGet: - path: {{ .Values.probes.path }} - port: {{ .Values.probes.port }} - initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }} - periodSeconds: {{ .Values.probes.readiness.periodSeconds }} - timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }} - failureThreshold: {{ .Values.probes.readiness.failureThreshold }} - livenessProbe: - httpGet: - path: {{ .Values.probes.path }} - port: {{ .Values.probes.port }} - initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }} - periodSeconds: {{ .Values.probes.liveness.periodSeconds }} - timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }} - failureThreshold: {{ .Values.probes.liveness.failureThreshold }} - {{- end }} - resources: {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/charts/inter-hub/templates/ingress.yaml b/charts/inter-hub/templates/ingress.yaml deleted file mode 100644 index 959b42e..0000000 --- a/charts/inter-hub/templates/ingress.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.ingress.enabled }} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ include "interhub.fullname" . }} - labels: {{- include "interhub.labels" . | nindent 4 }} - annotations: - {{- toYaml .Values.ingress.annotations | nindent 4 }} -spec: - ingressClassName: {{ .Values.ingress.className }} - {{- if .Values.ingress.tls }} - tls: - - hosts: - - {{ .Values.ingress.host }} - secretName: {{ include "interhub.fullname" . }}-tls - {{- end }} - rules: - - host: {{ .Values.ingress.host }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: {{ include "interhub.fullname" . }} - port: - number: {{ .Values.service.port }} -{{- end }} diff --git a/charts/inter-hub/templates/service.yaml b/charts/inter-hub/templates/service.yaml deleted file mode 100644 index dd8eac4..0000000 --- a/charts/inter-hub/templates/service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "interhub.fullname" . }} - labels: {{- include "interhub.labels" . | nindent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: {{ .Values.service.targetPort }} - protocol: TCP - name: http - selector: {{- include "interhub.selectorLabels" . | nindent 4 }} diff --git a/charts/inter-hub/values.yaml b/charts/inter-hub/values.yaml deleted file mode 100644 index 2af740e..0000000 --- a/charts/inter-hub/values.yaml +++ /dev/null @@ -1,55 +0,0 @@ -image: - repository: forgejo.coulomb.social/coulomb/inter-hub - tag: "" # required; pinned via helm/inter-hub-values.yaml or --set image.tag= - pullPolicy: IfNotPresent - -replicaCount: 1 - -service: - type: ClusterIP - port: 8000 - targetPort: 8000 - -resources: - requests: - cpu: 250m - memory: 512Mi - limits: - cpu: 1000m - memory: 2Gi - -# Env from the K8s Secret created from inter-hub's SOPS handoff file: -# deploy/railiance/secrets/inter-hub.env.sops.yaml -envSecretName: inter-hub-env - -ingress: - enabled: true - className: traefik - host: hub.coulomb.social - tls: true - annotations: - traefik.ingress.kubernetes.io/router.entrypoints: websecure - traefik.ingress.kubernetes.io/router.tls: "true" - cert-manager.io/cluster-issuer: letsencrypt-prod - -probes: - enabled: true - path: / - port: 8000 - liveness: - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - failureThreshold: 3 - readiness: - initialDelaySeconds: 15 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 3 - -podSecurityContext: {} -securityContext: {} - -nodeSelector: {} -tolerations: [] -affinity: {} diff --git a/docs/inter-hub-on-railiance01.md b/docs/inter-hub-on-railiance01.md index 482d96d..208be9f 100644 --- a/docs/inter-hub-on-railiance01.md +++ b/docs/inter-hub-on-railiance01.md @@ -7,6 +7,14 @@ deployments on CoulombCore and railiance01 are scaled to `0`. This document preserves the Railiance01 Helm surface for audit only. Do not deploy Inter-Hub to production. +**Removed 2026-10-21 (`RAPPS-WP-0018`, founder-approved wave 2).** The +`charts/inter-hub` chart, `helm/inter-hub-values.yaml`, the `inter-hub-*` Make +targets, `tools/inter-hub-smoke.sh` and the +`.gitea/workflows/inter-hub-production-deploy.yaml` workflow are deleted. The +release (0 replicas, latent 250m/512Mi request) is uninstalled with +`helm uninstall inter-hub -n inter-hub`. The commands below no longer exist; +recover them from git history if ever needed. + ## Hosts and release surface | Server | IP | Role | diff --git a/docs/operator-setup.md b/docs/operator-setup.md index 687e8bc..5e8eb0b 100644 --- a/docs/operator-setup.md +++ b/docs/operator-setup.md @@ -71,7 +71,6 @@ The app-specific targets also accept explicit overrides: ```bash REUSE_KUBECONFIG=~/.kube/config-railiance01 make reuse-status -INTER_HUB_KUBECONFIG=~/.kube/config-railiance01 make inter-hub-status ``` ## SOPS Age Key Bootstrap diff --git a/helm/coulomb-social-values.yaml b/helm/coulomb-social-values.yaml index f0a6cea..bc34981 100644 --- a/helm/coulomb-social-values.yaml +++ b/helm/coulomb-social-values.yaml @@ -38,3 +38,13 @@ persistence: size: 2Gi mountPath: /app/var/content retain: true + +# Wave-2 right-sizing (CSOC-WP-0017-T01, 2026-10-21 node budget): 7d p95 +# 0.4m CPU / 146Mi. Limits stay at the chart defaults (1000m/1Gi). +resources: + requests: + cpu: 15m + memory: 176Mi + limits: + cpu: 1000m + memory: 1Gi diff --git a/helm/inter-hub-values.yaml b/helm/inter-hub-values.yaml deleted file mode 100644 index 160f6af..0000000 --- a/helm/inter-hub-values.yaml +++ /dev/null @@ -1,6 +0,0 @@ -# Production overrides for the inter-hub Helm chart. -# Non-secret values only; DATABASE_URL and IHP_SESSION_SECRET come from the -# Secret 'inter-hub-env' in the inter-hub namespace. - -image: - tag: "fde5525" # Render baseline only; production deploy requires INTER_HUB_IMAGE_TAG=. diff --git a/helm/reuse-surface-values.yaml b/helm/reuse-surface-values.yaml index db6781c..0e170e6 100644 --- a/helm/reuse-surface-values.yaml +++ b/helm/reuse-surface-values.yaml @@ -15,8 +15,26 @@ image: repository: forgejo.coulomb.social/coulomb/reuse-surface digest: sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0 +# Wave-2 right-sizing (REUSE-WP-0026-T01, 2026-10-21 node budget): pod +# aggregate 110m/288Mi -> 10m/80Mi; 7d p95 2.1m CPU; split by +# per-pod p95 x1.15 (main ~51Mi -> 64Mi, landing ~5Mi -> 16Mi). Limits unchanged. +resources: + requests: + cpu: 5m + memory: 64Mi + limits: + cpu: 500m + memory: 512Mi + landing: enabled: true + resources: + requests: + cpu: 5m + memory: 16Mi + limits: + cpu: 50m + memory: 64Mi title: "REUSE federation endpoint" eyebrow: "reuse.coulomb.social" body: "This is the Railiance REUSE capability federation service. It is an API endpoint for automated clients and operators; there is no browser login for this service." diff --git a/helm/vergabe-demo-company-values.proposed.yaml b/helm/vergabe-demo-company-values.proposed.yaml index 6693145..332a760 100644 --- a/helm/vergabe-demo-company-values.proposed.yaml +++ b/helm/vergabe-demo-company-values.proposed.yaml @@ -11,7 +11,8 @@ replicaCount: 1 resources: requests: cpu: 60m - memory: 256Mi + # Wave-2 (RAPPS-WP-0018-T01): target replay loaded working set 320-480MiB. + memory: 512Mi limits: cpu: 1000m memory: 1Gi diff --git a/registry/capabilities/capability.railiance.workload-deployment-tooling.md b/registry/capabilities/capability.railiance.workload-deployment-tooling.md index 063141c..f9fbfc9 100644 --- a/registry/capabilities/capability.railiance.workload-deployment-tooling.md +++ b/registry/capabilities/capability.railiance.workload-deployment-tooling.md @@ -78,7 +78,6 @@ evidence: - SCOPE.md tests: - tools/forgejo-smoke.sh - - tools/inter-hub-smoke.sh - tools/k8s-server-dry-run.sh consumer_feedback: [] bug_reports: [] diff --git a/tools/inter-hub-smoke.sh b/tools/inter-hub-smoke.sh deleted file mode 100755 index a939be0..0000000 --- a/tools/inter-hub-smoke.sh +++ /dev/null @@ -1,87 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -base_url="${INTER_HUB_BASE_URL:-https://hub.coulomb.social}" -base_url="${base_url%/}" - -tmpdir="$(mktemp -d)" -trap 'rm -rf "$tmpdir"' EXIT - -request() { - local name="$1" - local url="$2" - local expected_status="$3" - local body="$tmpdir/${name}.json" - local status - - status="$(curl -sS -o "$body" -w "%{http_code}" "$url")" - if [[ "$status" != "$expected_status" ]]; then - echo "ERROR: expected $url to return $expected_status, got $status" >&2 - cat "$body" >&2 - echo >&2 - exit 1 - fi - - echo "$body" -} - -hubs_body="$(request hubs "${base_url}/api/v2/hubs" 200)" -python3 - "$hubs_body" <<'PY' -import json -import sys - -with open(sys.argv[1], encoding="utf-8") as fh: - payload = json.load(fh) - -if not isinstance(payload, dict) or not isinstance(payload.get("data"), list): - raise SystemExit("/api/v2/hubs did not return a paginated data list") - -print("ok: /api/v2/hubs returned public discovery JSON") -PY - -widgets_body="$(request widgets "${base_url}/api/v2/widgets" 401)" -hub_registry_body="$(request hub-registry "${base_url}/api/v2/hub-registry" 401)" - -python3 - "$widgets_body" "$hub_registry_body" <<'PY' -import json -import sys - -for path, filename in ( - ("/api/v2/widgets", sys.argv[1]), - ("/api/v2/hub-registry", sys.argv[2]), -): - with open(filename, encoding="utf-8") as fh: - payload = json.load(fh) - code = payload.get("code") if isinstance(payload, dict) else None - if code != "invalid_api_key": - raise SystemExit(f"{path} returned 401 but not invalid_api_key JSON") - print(f"ok: {path} requires an API key") -PY - -openapi_body="$(request openapi "${base_url}/api/v2/openapi.json" 200)" -python3 - "$openapi_body" <<'PY' -import json -import sys - -required_paths = { - "/hubs", - "/hub-capability-manifests", - "/api-consumers", - "/policy-scopes", - "/widgets", - "/hub-registry", -} - -with open(sys.argv[1], encoding="utf-8") as fh: - payload = json.load(fh) - -paths = payload.get("paths") -if not isinstance(paths, dict): - raise SystemExit("/api/v2/openapi.json did not include an OpenAPI paths object") - -missing = sorted(required_paths - set(paths)) -if missing: - raise SystemExit("OpenAPI missing paths: " + ", ".join(missing)) - -print("ok: /api/v2/openapi.json lists expected v2 resources") -PY diff --git a/tools/k8s-server-dry-run.sh b/tools/k8s-server-dry-run.sh index 1b228a2..3ad39fa 100755 --- a/tools/k8s-server-dry-run.sh +++ b/tools/k8s-server-dry-run.sh @@ -8,11 +8,6 @@ VERGABE_RELEASE="${VERGABE_RELEASE:-vergabe-teilnahme}" VERGABE_NAMESPACE="${VERGABE_NAMESPACE:-vergabe-teilnahme}" VERGABE_CHART="${VERGABE_CHART:-charts/vergabe-teilnahme}" VERGABE_VALUES="${VERGABE_VALUES:-helm/vergabe-teilnahme-values.yaml}" -INTER_HUB_RELEASE="${INTER_HUB_RELEASE:-inter-hub}" -INTER_HUB_NAMESPACE="${INTER_HUB_NAMESPACE:-inter-hub}" -INTER_HUB_CHART="${INTER_HUB_CHART:-charts/inter-hub}" -INTER_HUB_VALUES="${INTER_HUB_VALUES:-helm/inter-hub-values.yaml}" -INTER_HUB_IMAGE_TAG="${INTER_HUB_IMAGE_TAG:-}" DRY_RUN_CREATE_NAMESPACES="${DRY_RUN_CREATE_NAMESPACES:-false}" for cmd in kubectl helm; do @@ -33,33 +28,18 @@ fi if [[ "$DRY_RUN_CREATE_NAMESPACES" == "true" ]]; then echo "server dry-run: ensuring namespace $VERGABE_NAMESPACE exists" kubectl create namespace "$VERGABE_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f - - echo "server dry-run: ensuring namespace $INTER_HUB_NAMESPACE exists" - kubectl create namespace "$INTER_HUB_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f - fi tmpdir="$(mktemp -d)" trap 'rm -rf "$tmpdir"' EXIT -inter_hub_image_args=() -if [[ -n "$INTER_HUB_IMAGE_TAG" ]]; then - inter_hub_image_args=(--set "image.tag=$INTER_HUB_IMAGE_TAG") -fi - helm template "$VERGABE_RELEASE" "$VERGABE_CHART" \ --namespace "$VERGABE_NAMESPACE" \ -f "$VERGABE_VALUES" \ > "$tmpdir/vergabe-teilnahme.yaml" -helm template "$INTER_HUB_RELEASE" "$INTER_HUB_CHART" \ - --namespace "$INTER_HUB_NAMESPACE" \ - -f "$INTER_HUB_VALUES" \ - "${inter_hub_image_args[@]}" \ - > "$tmpdir/inter-hub.yaml" - echo "server dry-run: committed manifests" kubectl apply --dry-run=server -f manifests echo "server dry-run: rendered $VERGABE_RELEASE chart" kubectl apply --dry-run=server -n "$VERGABE_NAMESPACE" -f "$tmpdir/vergabe-teilnahme.yaml" -echo "server dry-run: rendered $INTER_HUB_RELEASE chart" -kubectl apply --dry-run=server -n "$INTER_HUB_NAMESPACE" -f "$tmpdir/inter-hub.yaml"