railiance-platform/argocd/platform-addons/custodian-allocation-review

custodian-allocation-review (CUST-WP-0071-T05) — prepared, not deployed

Weekly workload-demand and allocation assessment for railiance01, selected by the founder on 2026-10-21 (the-custodian docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md). Not referenced by any Application. The draft Application is in argocd/railiance01/drafts/. The CronJob is suspend: true.

Item	Value
Executor owner	railiance-platform (platform-addons, ArgoCD railiance-platform-addons project)
Assessment/report owner	the-custodian (CUST-WP-0071-T05); code in the-custodian/scripts/weekly_allocation_incluster.py
Schedule	0 8 * * 1, timeZone: Europe/Berlin (Monday 08:00), concurrencyPolicy: Forbid, startingDeadlineSeconds: 21600
Telemetry window	7d ending Monday 06:00 UTC of the run's ISO week (DST-independent, so consecutive weeks are comparable)
Image	python:3.12-slim pinned by digest (same as eso-token-renewer); code and data come from a ConfigMap
Identity	SA custodian-assessment/custodian-allocation-review, ClusterRole custodian-allocation-review-reader
RBAC	get/list on core nodes, pods, persistentvolumeclaims, persistentvolumes; storage.k8s.io/storageclasses; metrics.k8s.io/nodes,pods. No watch, no writes, no secrets, configmaps, logs, exec or proxy
Prometheus	http://telemetry-prometheus.telemetry.svc:9090, plain HTTP, no credential
Delivery	One State Hub message per newly retained week, custodian-allocation-review → the-custodian, sent to STATE_HUB_URL=http://state-hub.state-hub.svc:8000. The message id is recorded in receipts.jsonl
Network	networkpolicy.yaml: the namespace denies all ingress and egress by default. Egress is allowed only to DNS (kube-system/kube-dns 53 UDP/TCP), kube-apiserver (10.43.0.1:443 and k3s endpoint 92.205.62.239:6443), Prometheus (telemetry, 9090) and the State Hub API (state-hub app=state-hub, 8000)
Storage	PVC custodian-allocation-review-data (local-path, 1Gi, ArgoCD Prune=false,Delete=false): reports/<YYYY>-W<ww>.json, runs/<week>/<attempt>/ inputs, append-only receipts.jsonl
Resources	requests 20m/96Mi, limits 500m/256Mi, activeDeadlineSeconds: 900, backoffLimit: 2

Behaviour

• Writes only to the PVC and the one hub message per retained week. It never resizes anything or creates tasks. The next Custodian session reviews the message and records owner-repo tasks (ADR-001).
• Idempotency: an existing report for the week means the run does nothing and succeeds. A failed attempt writes a failed receipt and no report, so the Job retry or a manual Job collects again.
• Missed weeks: each retained receipt lists missed_weeks since the previous report. Comparison across a gap stays unknown.
• Delivery is idempotent. A week that already has a message id is never reposted. A failed post exits 1, and the Job retry posts for the already-retained week.
• Missed and failed runs are caught by the-custodian's daily security flow (scripts/weekly_allocation_check.py). It flags a failed latest receipt, or a missing report for the due ISO week after Monday 12:00 Europe/Berlin. It stays inactive until CUSTODIAN_ALLOCATION_RECEIPTS=hub is set.
• Workload rows remain investigate. The queries are namespace-level because kube-state-metrics does not export kube_pod_labels.

Vendored sources

src/ is generated by scripts/vendor_custodian_allocation_review.py from clean owner commits, and vendor.lock.json records each commit and sha256. --check verifies them, and tests/test_custodian_allocation_review.py enforces the check offline. To change the job code, commit in the owner repo and re-vendor. Never edit src/ by hand.

Activation (founder go-ahead required; after CUST-WP-0071-T04 completes)

1. Review this directory and the vendored sources. Re-vendor if the owner repositories have moved on, and keep --check passing.
2. rapp-telemetry:
   • Merge helm/values-railiance01-retention.pending.yaml (10d / 10GB) into helm/values-railiance01.yaml and run the attended helm upgrade.
   • Apply manifests/custodian-assessment-prometheus-ingress.pending.yaml. Without it, telemetry-isolation blocks port 9090 and every query records a transport error.
3. Widen the ArgoCD project. This commit already adds PersistentVolumeClaim and networking.k8s.io/NetworkPolicy to the namespaceResourceWhitelist in argocd/railiance01/bootstrap/02-railiance-platform-addons-project.yaml. The bootstrap is applied by hand, so apply that AppProject during the change window.
4. Set targetRevision in the draft Application to the reviewed commit. Move the draft to argocd/railiance01/applications/, run make argocd-pin-drift, then hand-sync railiance-apps-root and then custodian-allocation-review.
5. Acceptance run, still suspended: kubectl -n custodian-assessment create job --from=cronjob/custodian-allocation-review accept-1. Check that receipts.jsonl shows retained, failed_queries: [], delivery: posted with a message_id, and that the hub message reached the-custodian. Run it on a Monday, because it claims that ISO week's report slot.
6. Activate the daily missed/failed-run check: add Environment=CUSTODIAN_ALLOCATION_RECEIPTS=hub to the-custodian infra/security-flow/custodian-security-flow.service. Exercise it once by leaving a week without a report, or by pointing --allocation-receipts at a failed receipt.
7. Unsuspend through a reviewed commit (suspend: false) and a new targetRevision, not a live patch.

Rollback

• Stop: commit suspend: true and sync. In an emergency, run kubectl -n custodian-assessment patch cronjob custodian-allocation-review -p '{"spec":{"suspend":true}}', then commit the same change.
• Remove: delete the Application (it has no finalizer, so the resources stay), then delete the CronJob, RBAC, NetworkPolicies and ConfigMap. Keep the PVC unless the history is explicitly abandoned, because local-path deletes the data with the claim.

Still open before T05 can be accepted

These items are not provided here: an explicit owner acknowledgment beyond the hub message being read, how owner reviews reach /data/reviews.json, and workload-level metrics. Reports stay at namespace level; the founder declined a pod-label allowlist for now.