RCLUSTER-WP-0020-T03: prepare wave-2 requests for cert-manager, traefik and k3s addons

Requests only, no apply. cert-manager values (codifies out-of-band
acme nameservers arg), traefik HelmChartConfig resources, and a founder-run
.skip-based edit script for coredns/metrics-server/local-path-provisioner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

install/cert-manager/railiance01-resources.values.yaml

@@ -0,0 +1,25 @@
+# Wave-2 resource requests for the cert-manager Helm release on railiance01
+# (RCLUSTER-WP-0020-T03, node budget 2026-10-21). Requests only; no limits are
+# set today and none are added. Applied with --reuse-values so all other
+# release values stay as installed (release revision 1, 2026-03-25).
+#
+# DRIFT (found 2026-10-21): the live controller Deployment carries
+# --acme-http01-solver-nameservers=1.1.1.1:53 AFTER --max-concurrent-challenges,
+# an order the chart cannot render, so it was patched outside Helm and is in no
+# repo. A Helm upgrade would drop it. It is codified here so the upgrade keeps
+# it (only its position in the arg list changes). Founder decides before apply.
+extraArgs:
+  - --acme-http01-solver-nameservers=1.1.1.1:53
+resources:
+  requests:
+    cpu: 10m
+    memory: 80Mi
+cainjector:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 96Mi
+webhook:
+  resources:
+    requests:
+      cpu: 10m

install/k3s-addons/wave2-requests.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Wave-2 request changes for k3s packaged addons (RCLUSTER-WP-0020-T03).
+
+FOUNDER-RUN on railiance01 as root:  sudo python3 wave2-requests.py [--apply]
+
+k3s rewrites /var/lib/rancher/k3s/server/manifests/<addon>.yaml from its
+embedded copy on every start, so a plain edit (or kubectl patch) is reverted.
+The documented way to keep an edit is a sibling `<file>.skip` marker: k3s then
+stops writing that file, and the deploy controller applies our edited copy.
+Trade-off: a k3s upgrade no longer refreshes these three addons; remove the
+.skip marker (and this edit) before a k3s upgrade, then re-run this script.
+`--disable` was rejected: it deletes the running addon objects (DNS outage).
+
+Changes (requests only; limits unchanged):
+  coredns.yaml                                 coredns  cpu 100m -> 50m
+  metrics-server/metrics-server-deployment.yaml          cpu 100m -> 10m
+  local-storage.yaml        local-path-provisioner requests cpu 10m (none before)
+Dry-run by default: prints a unified diff. --apply writes backups, .skip
+markers and the edited files. Rollback: restore the .bak-wave2 copies, delete
+the .skip markers, restart k3s (or just delete the .skip and edited file).
+"""
+import difflib, os, re, shutil, sys
+
+D = "/var/lib/rancher/k3s/server/manifests"
+
+
+def sub_once(text, pattern, repl, label):
+    new, n = re.subn(pattern, repl, text, flags=re.M)
+    if n != 1:
+        sys.exit(f"ABORT {label}: expected exactly 1 match, found {n}; file differs from the reviewed k3s version")
+    return new
+
+
+def coredns(t):
+    return sub_once(t, r"^(\s+requests:\n\s+cpu: )100m$", r"\g<1>50m", "coredns cpu")
+
+
+def metrics(t):
+    return sub_once(t, r"^(\s+requests:\n\s+cpu: )100m$", r"\g<1>10m", "metrics-server cpu")
+
+
+def local_storage(t):
+    if re.search(r"^\s+resources:", t, flags=re.M):
+        sys.exit("ABORT local-storage: a resources block already exists; review by hand")
+    # insert after the provisioner container's image line, same indent as image:
+    return sub_once(
+        t,
+        r"^(\s+)(image: \S*local-path-provisioner\S*)$",
+        lambda m: f"{m.group(1)}{m.group(2)}\n{m.group(1)}resources:\n{m.group(1)}  requests:\n{m.group(1)}    cpu: 10m",
+        "local-path-provisioner image line",
+    )
+
+
+EDITS = {
+    "coredns.yaml": coredns,
+    "metrics-server/metrics-server-deployment.yaml": metrics,
+    "local-storage.yaml": local_storage,
+}
+
+apply = "--apply" in sys.argv
+for rel, fn in EDITS.items():
+    path = os.path.join(D, rel)
+    old = open(path).read()
+    new = fn(old)
+    sys.stdout.writelines(difflib.unified_diff(old.splitlines(True), new.splitlines(True), path, path + " (wave2)"))
+    if apply:
+        shutil.copy2(path, path + ".bak-wave2")
+        open(path + ".skip", "w").close()
+        with open(path, "w") as f:
+            f.write(new)
+        print(f"applied {path} (+ .skip, backup .bak-wave2)")

install/traefik/railiance01-helmchartconfig.yaml

@@ -7,3 +7,9 @@ spec:
   valuesContent: |-
     additionalArguments:
       - "--entryPoints.websecure.transport.respondingTimeouts.readTimeout=600s"
+    # Wave-2 requests (RCLUSTER-WP-0020-T03, node budget 2026-10-21):
+    # 7d CPU p95/peak 3.8/16.0m, memory p95/max 69/149Mi. Requests only; no limits.
+    resources:
+      requests:
+        cpu: 10m
+        memory: 80Mi