diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 4aebf09..83acc33 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -42,7 +42,7 @@ | workplan | RPF-WP-0060 | active | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md | | workplan | RPF-WP-0061 | active | — | workplans/RPF-WP-0061-self-service-ccr-intake.md | | workplan | RPF-WP-0062 | finished | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md | -| workplan | RPF-WP-0063 | ready | — | workplans/RPF-WP-0063-wave2-resource-right-sizing.md | +| workplan | RPF-WP-0063 | active | — | workplans/RPF-WP-0063-wave2-resource-right-sizing.md | | task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | | task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | | task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md | diff --git a/argocd/railiance01/drafts/external-secrets.application.yaml b/argocd/railiance01/drafts/external-secrets.application.yaml index 2e5c5ea..a813671 100644 --- a/argocd/railiance01/drafts/external-secrets.application.yaml +++ b/argocd/railiance01/drafts/external-secrets.application.yaml @@ -27,6 +27,15 @@ spec: serviceAccount: create: true name: external-secrets + # Wave-2 requests (RPF-WP-0063-T01); mirrors helm/external-secrets-resources.values.yaml + resources: + requests: {cpu: 10m, memory: 64Mi} + certController: + resources: + requests: {cpu: 10m, memory: 64Mi} + webhook: + resources: + requests: {cpu: 10m, memory: 80Mi} destination: server: https://kubernetes.default.svc namespace: external-secrets diff --git a/helm/external-secrets-resources.values.yaml b/helm/external-secrets-resources.values.yaml new file mode 100644 index 0000000..d18e12a --- /dev/null +++ b/helm/external-secrets-resources.values.yaml @@ -0,0 +1,18 @@ +# Wave-2 resource requests for the ESO Helm release on railiance01 +# (RPF-WP-0063-T01, node budget 2026-10-21). Requests only: there are no +# requests or limits today and no limits are added. Applied on top of the +# release's stored values with --reuse-values. +resources: + requests: + cpu: 10m + memory: 64Mi +certController: + resources: + requests: + cpu: 10m + memory: 64Mi +webhook: + resources: + requests: + cpu: 10m + memory: 80Mi diff --git a/helm/forgejo-db-cluster.yaml b/helm/forgejo-db-cluster.yaml index 5caade1..a22be17 100644 --- a/helm/forgejo-db-cluster.yaml +++ b/helm/forgejo-db-cluster.yaml @@ -26,8 +26,8 @@ spec: # timeouts on :8000 under node CPU pressure). Sized like net-kingdom-pg on ~4Gi node. resources: requests: - cpu: 200m - memory: 512Mi + cpu: 105m + memory: 288Mi limits: cpu: "1" memory: 1Gi diff --git a/helm/openbao-ui-overlay-k8s.yaml b/helm/openbao-ui-overlay-k8s.yaml index a80606a..651cbd2 100644 --- a/helm/openbao-ui-overlay-k8s.yaml +++ b/helm/openbao-ui-overlay-k8s.yaml @@ -48,7 +48,7 @@ spec: periodSeconds: 20 resources: requests: - cpu: 25m + cpu: 10m memory: 32Mi limits: cpu: 200m diff --git a/workplans/RPF-WP-0063-wave2-resource-right-sizing.md b/workplans/RPF-WP-0063-wave2-resource-right-sizing.md index 78afa2a..851d556 100644 --- a/workplans/RPF-WP-0063-wave2-resource-right-sizing.md +++ b/workplans/RPF-WP-0063-wave2-resource-right-sizing.md @@ -4,7 +4,7 @@ type: workplan title: "Wave-2 resource right-sizing from the 2026-10-21 allocation review" domain: financials repo: railiance-platform -status: ready +status: active flavor: implementation owner: claude created: "2026-10-21" @@ -60,4 +60,42 @@ Steps: Verification: `kubectl -n get pod -o jsonpath='{..resources}'` shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta. +Prepared 2026-10-22 (wave-2 worker W3; no apply, cluster read-only). Each +render was diffed against live with `kubectl diff` (Secret objects skipped): + +- `external-secrets` x3 — live source is Helm release `external-secrets` + (rev 8, chart 0.16.1, not Argo; the Argo Application is still a draft). + New `helm/external-secrets-resources.values.yaml` (force-added; `helm/*.yaml` + is gitignored); the draft Application values mirror it. Render = chart 0.16.1 + + `installCRDs: true` + `serviceAccount` (draft values minus the Argo CRD + annotation, which live does not carry) + this file: diff = only the three + Deployments' `resources.requests.{cpu,memory}`. Apply: + `helm upgrade external-secrets external-secrets --repo https://charts.external-secrets.io --version 0.16.1 -n external-secrets --reuse-values -f helm/external-secrets-resources.values.yaml`. + Restarts controller, cert-controller and webhook (brief ExternalSecret + admission/refresh pause; no ingress impact). +- `openbao/railiance-platform` = Deployment `openbao-ui-gateway` (label + part-of railiance-platform), container `nginx`, `helm/openbao-ui-overlay-k8s.yaml`: + CPU request 25m -> 10m. Rendered through `scripts/openbao-ui-overlay-apply.sh` + with apply turned into diff: only `resources.requests.cpu`; ConfigMaps clean. + Apply: `make openbao-overlay-apply` (it always does a rollout restart of the + private UI gateway; OpenBao itself is untouched). +- `databases/forgejo-db` (CNPG, `helm/forgejo-db-cluster.yaml`): requests + 200m/512Mi -> 105m/288Mi, limits 1/1Gi unchanged. `shared_buffers` is not + set (PostgreSQL default 128MB), well below the 288Mi request and the + unchanged 1Gi limit, so memory is lowered as proposed. Diff of the full + `forgejo-db-deploy` set: only `Cluster/forgejo-db` `spec.resources.requests`. + Apply: `make forgejo-db-deploy`. CNPG restarts the single instance: + Forgejo database outage for the restart; do it in the one-at-a-time DB + window with a health check after. +- `playwright/rapp-playwright`: live source is `rapp-playwright/manifests/workload.yaml` + (commit `1557742` there). Request 100m/256Mi -> 65m/336Mi; CPU limit 1 -> 2 + (throttle rule: new limit = max(2x current, 1000m); 2000m is 32x the 7d + peak 62.7m). Server-side diff with field manager `rapp-playwright` (the live + owner): only the three resource keys (NetworkPolicy: generation bump only). + **Drift:** the repo's `make deploy` used the default field manager and would + conflict on these fields; the Makefile now passes `--field-manager=rapp-playwright`. + Apply (local kubectl): `make -C rapp-playwright render IMAGE_REFERENCE=` + then `kubectl apply --server-side --field-manager=rapp-playwright -f rapp-playwright/.rendered/workload.yaml`. + Strategy Recreate: the playwright pod is down for the restart (internal service only). + Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after `kubectl get -o yaml` captures as the receipt.