RCLUSTER-WP-0020-T03: prepare wave-2 requests for cert-manager, traefik and k3s addons

Requests only, no apply. cert-manager values (codifies out-of-band
acme nameservers arg), traefik HelmChartConfig resources, and a founder-run
.skip-based edit script for coredns/metrics-server/local-path-provisioner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

install/cert-manager/railiance01-resources.values.yaml

@@ -0,0 +1,25 @@
+# Wave-2 resource requests for the cert-manager Helm release on railiance01
+# (RCLUSTER-WP-0020-T03, node budget 2026-10-21). Requests only; no limits are
+# set today and none are added. Applied with --reuse-values so all other
+# release values stay as installed (release revision 1, 2026-03-25).
+#
+# DRIFT (found 2026-10-21): the live controller Deployment carries
+# --acme-http01-solver-nameservers=1.1.1.1:53 AFTER --max-concurrent-challenges,
+# an order the chart cannot render, so it was patched outside Helm and is in no
+# repo. A Helm upgrade would drop it. It is codified here so the upgrade keeps
+# it (only its position in the arg list changes). Founder decides before apply.
+extraArgs:
+  - --acme-http01-solver-nameservers=1.1.1.1:53
+resources:
+  requests:
+    cpu: 10m
+    memory: 80Mi
+cainjector:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 96Mi
+webhook:
+  resources:
+    requests:
+      cpu: 10m

install/k3s-addons/wave2-requests.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Wave-2 request changes for k3s packaged addons (RCLUSTER-WP-0020-T03).
+
+FOUNDER-RUN on railiance01 as root:  sudo python3 wave2-requests.py [--apply]
+
+k3s rewrites /var/lib/rancher/k3s/server/manifests/<addon>.yaml from its
+embedded copy on every start, so a plain edit (or kubectl patch) is reverted.
+The documented way to keep an edit is a sibling `<file>.skip` marker: k3s then
+stops writing that file, and the deploy controller applies our edited copy.
+Trade-off: a k3s upgrade no longer refreshes these three addons; remove the
+.skip marker (and this edit) before a k3s upgrade, then re-run this script.
+`--disable` was rejected: it deletes the running addon objects (DNS outage).
+
+Changes (requests only; limits unchanged):
+  coredns.yaml                                 coredns  cpu 100m -> 50m
+  metrics-server/metrics-server-deployment.yaml          cpu 100m -> 10m
+  local-storage.yaml        local-path-provisioner requests cpu 10m (none before)
+Dry-run by default: prints a unified diff. --apply writes backups, .skip
+markers and the edited files. Rollback: restore the .bak-wave2 copies, delete
+the .skip markers, restart k3s (or just delete the .skip and edited file).
+"""
+import difflib, os, re, shutil, sys
+
+D = "/var/lib/rancher/k3s/server/manifests"
+
+
+def sub_once(text, pattern, repl, label):
+    new, n = re.subn(pattern, repl, text, flags=re.M)
+    if n != 1:
+        sys.exit(f"ABORT {label}: expected exactly 1 match, found {n}; file differs from the reviewed k3s version")
+    return new
+
+
+def coredns(t):
+    return sub_once(t, r"^(\s+requests:\n\s+cpu: )100m$", r"\g<1>50m", "coredns cpu")
+
+
+def metrics(t):
+    return sub_once(t, r"^(\s+requests:\n\s+cpu: )100m$", r"\g<1>10m", "metrics-server cpu")
+
+
+def local_storage(t):
+    if re.search(r"^\s+resources:", t, flags=re.M):
+        sys.exit("ABORT local-storage: a resources block already exists; review by hand")
+    # insert after the provisioner container's image line, same indent as image:
+    return sub_once(
+        t,
+        r"^(\s+)(image: \S*local-path-provisioner\S*)$",
+        lambda m: f"{m.group(1)}{m.group(2)}\n{m.group(1)}resources:\n{m.group(1)}  requests:\n{m.group(1)}    cpu: 10m",
+        "local-path-provisioner image line",
+    )
+
+
+EDITS = {
+    "coredns.yaml": coredns,
+    "metrics-server/metrics-server-deployment.yaml": metrics,
+    "local-storage.yaml": local_storage,
+}
+
+apply = "--apply" in sys.argv
+for rel, fn in EDITS.items():
+    path = os.path.join(D, rel)
+    old = open(path).read()
+    new = fn(old)
+    sys.stdout.writelines(difflib.unified_diff(old.splitlines(True), new.splitlines(True), path, path + " (wave2)"))
+    if apply:
+        shutil.copy2(path, path + ".bak-wave2")
+        open(path + ".skip", "w").close()
+        with open(path, "w") as f:
+            f.write(new)
+        print(f"applied {path} (+ .skip, backup .bak-wave2)")

install/traefik/railiance01-helmchartconfig.yaml

@@ -7,3 +7,9 @@ spec:
   valuesContent: |-
     additionalArguments:
       - "--entryPoints.websecure.transport.respondingTimeouts.readTimeout=600s"
+    # Wave-2 requests (RCLUSTER-WP-0020-T03, node budget 2026-10-21):
+    # 7d CPU p95/peak 3.8/16.0m, memory p95/max 69/149Mi. Requests only; no limits.
+    resources:
+      requests:
+        cpu: 10m
+        memory: 80Mi

workplans/RCLUSTER-WP-0020-node-budget-knative-caps-and-wave2-allocation.md

@@ -93,6 +93,33 @@ Done when the seven request changes are declared in this repo with a render or
 diff proof, applied attended, and the host series plus the reserved-resources
 decision are recorded.
 
+Prepared 2026-10-22 (wave-2 worker W3; no apply, cluster read-only):
+
+- cert-manager (Helm release `cert-manager` rev 1, chart v1.18.2, installed by
+  hand 2026-03-25, no prior repo source): `install/cert-manager/railiance01-resources.values.yaml`.
+  Render = chart v1.18.2 + `crds.enabled=true` (inferred: CRDs are Helm-owned)
+  + this file. `kubectl diff`: only the three Deployments, keys
+  `containers[].resources.requests.{cpu,memory}` and one arg reorder.
+  **Drift:** live controller has `--acme-http01-solver-nameservers=1.1.1.1:53`
+  patched outside Helm (order the chart cannot produce); codified as
+  `extraArgs` so an upgrade keeps it. Founder decides.
+  Apply: `helm upgrade cert-manager cert-manager --repo https://charts.jetstack.io --version v1.18.2 -n cert-manager --reuse-values -f install/cert-manager/railiance01-resources.values.yaml`
+- traefik (k3s HelmChart, existing HelmChartConfig practice):
+  `install/traefik/railiance01-helmchartconfig.yaml` gains `resources.requests`.
+  Render = k3s chart traefik-38.0.201+up38.0.2 + HelmChart values + this
+  HelmChartConfig; `kubectl diff` changes only Deployment `traefik`
+  `resources.requests.{cpu,memory}`. Apply per `install/traefik/README.md`.
+  Rollout: 1 replica, maxSurge 1 / maxUnavailable 0 — no ingress gap expected.
+- coredns, metrics-server, local-path-provisioner (k3s Addon objects from
+  `/var/lib/rancher/k3s/server/manifests`, rewritten on k3s start):
+  `install/k3s-addons/wave2-requests.py` (founder-run with sudo on railiance01;
+  dry-run diff by default, `--apply` writes `.skip` markers + edited files).
+  Diff of the patched objectset-applied Deployments vs live: only
+  `resources.requests.cpu` on the three Deployments. coredns rollout has
+  maxUnavailable 1 with 1 replica: expect a few seconds of DNS gap; run off-peak.
+- kube-reserved/system-reserved: NOT ready. Set only after the wave-2 request
+  decreases across all owners have been applied and measured; no kubelet change made.
+
 ## Applied — 2026-10-21
 
 The installer's ssh hop cannot read the k3s kubeconfig on railiance01, so the identical render.sh output was applied with the workstation kubeconfig. Results: RAIL-KNATIVE-WP-0003-T02. Follow-up: T04.