3b18b84997
Follow rail-knative 76cb9c7 (RAIL-KNATIVE-WP-0003): overlays set 10m CPU requests for the six substrate containers and add hpa-caps.patch.yaml (maxReplicas activator 3, webhook 2, 3scale-kourier-gateway 3); verify.sh checks both; tests/test_knative_render.py checks overlays, verify.sh, the rail-knative declaration and the render. Not applied. Adds the receiving task for wave-2 railiance-cluster allocation (CUST-WP-0071, RESOURCE-WP-0008). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 8340@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
33 lines
2 KiB
Markdown
33 lines
2 KiB
Markdown
# Knative Serving installation
|
|
|
|
`install.sh` verifies repository-pinned SHA-256 checksums for the upstream
|
|
Serving and Kourier v1.22.0 assets before applying them over SSH. It is
|
|
idempotent.
|
|
|
|
It does not apply the upstream manifests as published. `render.sh` (also
|
|
usable on its own, with no cluster contact) renders them through the kustomize
|
|
overlays in `overlays/`: CRDs verbatim and first, because `serving-core.yaml`
|
|
repeats one of them; then serving-core and kourier with the CPU requests and
|
|
HPA ceilings that rail-knative declares in `substrate/v1.22.0/`
|
|
(`cpu-requests.patch.yaml`: 10m for activator, autoscaler, controller, webhook,
|
|
net-kourier-controller and 3scale-kourier-gateway; `hpa-caps.patch.yaml`:
|
|
maxReplicas activator 3, webhook 2, 3scale-kourier-gateway 3; RAIL-KNATIVE-WP-0003),
|
|
the Kourier Service as `ClusterIP` and the Envoy
|
|
gateway image pinned to `ENVOY_IMAGE`. Memory requests, limits, minReplicas and HPA targets stay
|
|
upstream. Applying the unpatched upstream files restores 300m/200m/100m and
|
|
HPA ceilings 20/5/10, and exhausts railiance01's CPU requests again. `tests/test_knative_render.py`
|
|
proves the render offline and fails if these overlays drift from rail-knative's
|
|
declaration. `install.sh` needs a local `kubectl` for `kubectl kustomize`. Kourier is kept `ClusterIP`; public entry through Traefik, DNS, and
|
|
TLS requires separate reef admission evidence.
|
|
|
|
The installer enables only Knative's
|
|
`kubernetes.podspec-init-containers` feature. Production workloads use init
|
|
containers for fail-closed admission checks such as verifying that egress
|
|
policy has reconciled before application code starts.
|
|
|
|
Run `install.sh railiance01`, then `verify.sh railiance01`; `verify.sh` is
|
|
read-only and also checks the six CPU requests, the three HPA ceilings and the Envoy pin.
|
|
|
|
Before workload admission, rollback deletes Kourier, Serving core, then CRDs
|
|
using the same verified assets. After Knative Services exist, removal requires
|
|
a workload migration and backup review and is not unattended.
|