coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0063-T01: prepare wave-2 requests (ESO, openbao UI gateway, forgejo-db)

Browse source 
Requests only, limits unchanged; no apply. ESO values file for the Helm
release (+ draft Application mirror), openbao-ui-gateway CPU 25m->10m,
forgejo-db 105m/288Mi. Playwright change lives in rapp-playwright 1557742.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
This commit is contained in:
codex 2026-10-22 00:05:54 +02:00
parent 30c48cb993
commit 7fbba919c5
6 changed files with 70 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -42,7 +42,7 @@
| workplan | RPF-WP-0060 | active | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md |
| workplan | RPF-WP-0061 | active | — | workplans/RPF-WP-0061-self-service-ccr-intake.md |
| workplan | RPF-WP-0062 | finished | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
| workplan | RPF-WP-0063 | ready | — | workplans/RPF-WP-0063-wave2-resource-right-sizing.md |
| workplan | RPF-WP-0063 | active | — | workplans/RPF-WP-0063-wave2-resource-right-sizing.md |
| task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
| task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
| task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |

9
argocd/railiance01/drafts/external-secrets.application.yaml
View file

@ -27,6 +27,15 @@ spec:
serviceAccount:
create: true
name: external-secrets
# Wave-2 requests (RPF-WP-0063-T01); mirrors helm/external-secrets-resources.values.yaml
resources:
requests: {cpu: 10m, memory: 64Mi}
certController:
resources:
requests: {cpu: 10m, memory: 64Mi}
webhook:
resources:
requests: {cpu: 10m, memory: 80Mi}
destination:
server: https://kubernetes.default.svc
namespace: external-secrets

18
helm/external-secrets-resources.values.yaml Normal file
View file

@ -0,0 +1,18 @@
# Wave-2 resource requests for the ESO Helm release on railiance01
# (RPF-WP-0063-T01, node budget 2026-10-21). Requests only: there are no
# requests or limits today and no limits are added. Applied on top of the
# release's stored values with --reuse-values.
resources:
requests:
cpu: 10m
memory: 64Mi
certController:
resources:
requests:
cpu: 10m
memory: 64Mi
webhook:
resources:
requests:
cpu: 10m
memory: 80Mi

4
helm/forgejo-db-cluster.yaml
View file

@ -26,8 +26,8 @@ spec:
# timeouts on :8000 under node CPU pressure). Sized like net-kingdom-pg on ~4Gi node.
resources:
requests:
cpu: 200m
memory: 512Mi
cpu: 105m
memory: 288Mi
limits:
cpu: "1"
memory: 1Gi

2
helm/openbao-ui-overlay-k8s.yaml
View file

@ -48,7 +48,7 @@ spec:
periodSeconds: 20
resources:
requests:
cpu: 25m
cpu: 10m
memory: 32Mi
limits:
cpu: 200m

40
workplans/RPF-WP-0063-wave2-resource-right-sizing.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Wave-2 resource right-sizing from the 2026-10-21 allocation review"
domain: financials
repo: railiance-platform
status: ready
status: active
flavor: implementation
owner: claude
created: "2026-10-21"
@ -60,4 +60,42 @@ Steps:
Verification: `kubectl -n <ns> get pod -o jsonpath='{..resources}'` shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta.
Prepared 2026-10-22 (wave-2 worker W3; no apply, cluster read-only). Each
render was diffed against live with `kubectl diff` (Secret objects skipped):
- `external-secrets` x3 — live source is Helm release `external-secrets`
(rev 8, chart 0.16.1, not Argo; the Argo Application is still a draft).
New `helm/external-secrets-resources.values.yaml` (force-added; `helm/*.yaml`
is gitignored); the draft Application values mirror it. Render = chart 0.16.1
+ `installCRDs: true` + `serviceAccount` (draft values minus the Argo CRD
annotation, which live does not carry) + this file: diff = only the three
Deployments' `resources.requests.{cpu,memory}`. Apply:
`helm upgrade external-secrets external-secrets --repo https://charts.external-secrets.io --version 0.16.1 -n external-secrets --reuse-values -f helm/external-secrets-resources.values.yaml`.
Restarts controller, cert-controller and webhook (brief ExternalSecret
admission/refresh pause; no ingress impact).
- `openbao/railiance-platform` = Deployment `openbao-ui-gateway` (label
part-of railiance-platform), container `nginx`, `helm/openbao-ui-overlay-k8s.yaml`:
CPU request 25m -> 10m. Rendered through `scripts/openbao-ui-overlay-apply.sh`
with apply turned into diff: only `resources.requests.cpu`; ConfigMaps clean.
Apply: `make openbao-overlay-apply` (it always does a rollout restart of the
private UI gateway; OpenBao itself is untouched).
- `databases/forgejo-db` (CNPG, `helm/forgejo-db-cluster.yaml`): requests
200m/512Mi -> 105m/288Mi, limits 1/1Gi unchanged. `shared_buffers` is not
set (PostgreSQL default 128MB), well below the 288Mi request and the
unchanged 1Gi limit, so memory is lowered as proposed. Diff of the full
`forgejo-db-deploy` set: only `Cluster/forgejo-db` `spec.resources.requests`.
Apply: `make forgejo-db-deploy`. CNPG restarts the single instance:
Forgejo database outage for the restart; do it in the one-at-a-time DB
window with a health check after.
- `playwright/rapp-playwright`: live source is `rapp-playwright/manifests/workload.yaml`
(commit `1557742` there). Request 100m/256Mi -> 65m/336Mi; CPU limit 1 -> 2
(throttle rule: new limit = max(2x current, 1000m); 2000m is 32x the 7d
peak 62.7m). Server-side diff with field manager `rapp-playwright` (the live
owner): only the three resource keys (NetworkPolicy: generation bump only).
**Drift:** the repo's `make deploy` used the default field manager and would
conflict on these fields; the Makefile now passes `--field-manager=rapp-playwright`.
Apply (local kubectl): `make -C rapp-playwright render IMAGE_REFERENCE=<live digest>`
then `kubectl apply --server-side --field-manager=rapp-playwright -f rapp-playwright/.rendered/workload.yaml`.
Strategy Recreate: the playwright pod is down for the restart (internal service only).
Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after `kubectl get -o yaml` captures as the receipt.