From d775ba8fa784412699a3d7cc98db82d6db3c926c Mon Sep 17 00:00:00 2001 From: codex Date: Thu, 22 Oct 2026 00:02:21 +0200 Subject: [PATCH] RCLUSTER-WP-0020-T03: prepare wave-2 requests for cert-manager, traefik and k3s addons Requests only, no apply. cert-manager values (codifies out-of-band acme nameservers arg), traefik HelmChartConfig resources, and a founder-run .skip-based edit script for coredns/metrics-server/local-path-provisioner. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 276069@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c --- .../railiance01-resources.values.yaml | 25 +++++++ install/k3s-addons/wave2-requests.py | 71 +++++++++++++++++++ .../traefik/railiance01-helmchartconfig.yaml | 6 ++ ...udget-knative-caps-and-wave2-allocation.md | 27 +++++++ 4 files changed, 129 insertions(+) create mode 100644 install/cert-manager/railiance01-resources.values.yaml create mode 100644 install/k3s-addons/wave2-requests.py diff --git a/install/cert-manager/railiance01-resources.values.yaml b/install/cert-manager/railiance01-resources.values.yaml new file mode 100644 index 0000000..40c8634 --- /dev/null +++ b/install/cert-manager/railiance01-resources.values.yaml @@ -0,0 +1,25 @@ +# Wave-2 resource requests for the cert-manager Helm release on railiance01 +# (RCLUSTER-WP-0020-T03, node budget 2026-10-21). Requests only; no limits are +# set today and none are added. Applied with --reuse-values so all other +# release values stay as installed (release revision 1, 2026-03-25). +# +# DRIFT (found 2026-10-21): the live controller Deployment carries +# --acme-http01-solver-nameservers=1.1.1.1:53 AFTER --max-concurrent-challenges, +# an order the chart cannot render, so it was patched outside Helm and is in no +# repo. A Helm upgrade would drop it. It is codified here so the upgrade keeps +# it (only its position in the arg list changes). Founder decides before apply. +extraArgs: + - --acme-http01-solver-nameservers=1.1.1.1:53 +resources: + requests: + cpu: 10m + memory: 80Mi +cainjector: + resources: + requests: + cpu: 10m + memory: 96Mi +webhook: + resources: + requests: + cpu: 10m diff --git a/install/k3s-addons/wave2-requests.py b/install/k3s-addons/wave2-requests.py new file mode 100644 index 0000000..a2b728b --- /dev/null +++ b/install/k3s-addons/wave2-requests.py @@ -0,0 +1,71 @@ +#!/usr/bin/env python3 +"""Wave-2 request changes for k3s packaged addons (RCLUSTER-WP-0020-T03). + +FOUNDER-RUN on railiance01 as root: sudo python3 wave2-requests.py [--apply] + +k3s rewrites /var/lib/rancher/k3s/server/manifests/.yaml from its +embedded copy on every start, so a plain edit (or kubectl patch) is reverted. +The documented way to keep an edit is a sibling `.skip` marker: k3s then +stops writing that file, and the deploy controller applies our edited copy. +Trade-off: a k3s upgrade no longer refreshes these three addons; remove the +.skip marker (and this edit) before a k3s upgrade, then re-run this script. +`--disable` was rejected: it deletes the running addon objects (DNS outage). + +Changes (requests only; limits unchanged): + coredns.yaml coredns cpu 100m -> 50m + metrics-server/metrics-server-deployment.yaml cpu 100m -> 10m + local-storage.yaml local-path-provisioner requests cpu 10m (none before) +Dry-run by default: prints a unified diff. --apply writes backups, .skip +markers and the edited files. Rollback: restore the .bak-wave2 copies, delete +the .skip markers, restart k3s (or just delete the .skip and edited file). +""" +import difflib, os, re, shutil, sys + +D = "/var/lib/rancher/k3s/server/manifests" + + +def sub_once(text, pattern, repl, label): + new, n = re.subn(pattern, repl, text, flags=re.M) + if n != 1: + sys.exit(f"ABORT {label}: expected exactly 1 match, found {n}; file differs from the reviewed k3s version") + return new + + +def coredns(t): + return sub_once(t, r"^(\s+requests:\n\s+cpu: )100m$", r"\g<1>50m", "coredns cpu") + + +def metrics(t): + return sub_once(t, r"^(\s+requests:\n\s+cpu: )100m$", r"\g<1>10m", "metrics-server cpu") + + +def local_storage(t): + if re.search(r"^\s+resources:", t, flags=re.M): + sys.exit("ABORT local-storage: a resources block already exists; review by hand") + # insert after the provisioner container's image line, same indent as image: + return sub_once( + t, + r"^(\s+)(image: \S*local-path-provisioner\S*)$", + lambda m: f"{m.group(1)}{m.group(2)}\n{m.group(1)}resources:\n{m.group(1)} requests:\n{m.group(1)} cpu: 10m", + "local-path-provisioner image line", + ) + + +EDITS = { + "coredns.yaml": coredns, + "metrics-server/metrics-server-deployment.yaml": metrics, + "local-storage.yaml": local_storage, +} + +apply = "--apply" in sys.argv +for rel, fn in EDITS.items(): + path = os.path.join(D, rel) + old = open(path).read() + new = fn(old) + sys.stdout.writelines(difflib.unified_diff(old.splitlines(True), new.splitlines(True), path, path + " (wave2)")) + if apply: + shutil.copy2(path, path + ".bak-wave2") + open(path + ".skip", "w").close() + with open(path, "w") as f: + f.write(new) + print(f"applied {path} (+ .skip, backup .bak-wave2)") diff --git a/install/traefik/railiance01-helmchartconfig.yaml b/install/traefik/railiance01-helmchartconfig.yaml index ada1efe..5062355 100644 --- a/install/traefik/railiance01-helmchartconfig.yaml +++ b/install/traefik/railiance01-helmchartconfig.yaml @@ -7,3 +7,9 @@ spec: valuesContent: |- additionalArguments: - "--entryPoints.websecure.transport.respondingTimeouts.readTimeout=600s" + # Wave-2 requests (RCLUSTER-WP-0020-T03, node budget 2026-10-21): + # 7d CPU p95/peak 3.8/16.0m, memory p95/max 69/149Mi. Requests only; no limits. + resources: + requests: + cpu: 10m + memory: 80Mi diff --git a/workplans/RCLUSTER-WP-0020-node-budget-knative-caps-and-wave2-allocation.md b/workplans/RCLUSTER-WP-0020-node-budget-knative-caps-and-wave2-allocation.md index a6a9d33..7b70e8f 100644 --- a/workplans/RCLUSTER-WP-0020-node-budget-knative-caps-and-wave2-allocation.md +++ b/workplans/RCLUSTER-WP-0020-node-budget-knative-caps-and-wave2-allocation.md @@ -93,6 +93,33 @@ Done when the seven request changes are declared in this repo with a render or diff proof, applied attended, and the host series plus the reserved-resources decision are recorded. +Prepared 2026-10-22 (wave-2 worker W3; no apply, cluster read-only): + +- cert-manager (Helm release `cert-manager` rev 1, chart v1.18.2, installed by + hand 2026-03-25, no prior repo source): `install/cert-manager/railiance01-resources.values.yaml`. + Render = chart v1.18.2 + `crds.enabled=true` (inferred: CRDs are Helm-owned) + + this file. `kubectl diff`: only the three Deployments, keys + `containers[].resources.requests.{cpu,memory}` and one arg reorder. + **Drift:** live controller has `--acme-http01-solver-nameservers=1.1.1.1:53` + patched outside Helm (order the chart cannot produce); codified as + `extraArgs` so an upgrade keeps it. Founder decides. + Apply: `helm upgrade cert-manager cert-manager --repo https://charts.jetstack.io --version v1.18.2 -n cert-manager --reuse-values -f install/cert-manager/railiance01-resources.values.yaml` +- traefik (k3s HelmChart, existing HelmChartConfig practice): + `install/traefik/railiance01-helmchartconfig.yaml` gains `resources.requests`. + Render = k3s chart traefik-38.0.201+up38.0.2 + HelmChart values + this + HelmChartConfig; `kubectl diff` changes only Deployment `traefik` + `resources.requests.{cpu,memory}`. Apply per `install/traefik/README.md`. + Rollout: 1 replica, maxSurge 1 / maxUnavailable 0 — no ingress gap expected. +- coredns, metrics-server, local-path-provisioner (k3s Addon objects from + `/var/lib/rancher/k3s/server/manifests`, rewritten on k3s start): + `install/k3s-addons/wave2-requests.py` (founder-run with sudo on railiance01; + dry-run diff by default, `--apply` writes `.skip` markers + edited files). + Diff of the patched objectset-applied Deployments vs live: only + `resources.requests.cpu` on the three Deployments. coredns rollout has + maxUnavailable 1 with 1 replica: expect a few seconds of DNS gap; run off-peak. +- kube-reserved/system-reserved: NOT ready. Set only after the wave-2 request + decreases across all owners have been applied and measured; no kubelet change made. + ## Applied — 2026-10-21 The installer's ssh hop cannot read the k3s kubeconfig on railiance01, so the identical render.sh output was applied with the workstation kubeconfig. Results: RAIL-KNATIVE-WP-0003-T02. Follow-up: T04.