tegwick
6b97d01861
The 100m override worked around a node with <250m unallocated. Knative and Kourier released ~830m of requests on 2026-09-21, and State Hub bursts past 400m under concurrent agent load while reserving only 100m. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
69 lines
2.5 KiB
YAML
69 lines
2.5 KiB
YAML
# Production values for the State Hub Railiance chart handoff.
|
|
# Non-secret values only. DATABASE_URL comes from the Secret `state-hub-env`.
|
|
|
|
namespace:
|
|
create: false
|
|
|
|
image:
|
|
repository: forgejo.coulomb.social/coulomb/state-hub
|
|
tag: "main-0747b4d"
|
|
|
|
ingress:
|
|
enabled: false
|
|
|
|
# MCP layer on central (CUST-WP-0067-T08). Enabled together with the image tag
|
|
# above: MCP_HOST landed in main-6c1262e, and enabling this on an older image
|
|
# would deploy a pod that binds loopback and never becomes reachable.
|
|
# ClusterIP only — no ingress, same reason the API's is disabled.
|
|
mcp:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
# 2026-09-10: 1,078 observed 5-minute samples, p99 2.35m, peak 30.45m.
|
|
# Preserve the 500m limit for bursts; free 40m for the API rollout surge.
|
|
cpu: 10m
|
|
|
|
config:
|
|
# This deployment is the authoritative hub. Callers verify this rather than
|
|
# trusting that whatever answered on a port is central (CUST-WP-0067-T03).
|
|
instanceRole: primary
|
|
instanceLabel: railiance01
|
|
sbomNexusUrl: "http://sbom-nexus.sbom-nexus.svc.cluster.local:8010"
|
|
# Reversible T04 read cutover; set back to `legacy` to roll back.
|
|
sbomNexusReadMode: nexus
|
|
# Reversible T04 write cutover; set back to `legacy` to roll back future writes.
|
|
sbomNexusWriteMode: nexus
|
|
|
|
resources:
|
|
# Restored to the chart's 250m on 2026-09-21. The earlier 100m was a workaround
|
|
# for a node with <250m unallocated; ~830m of Knative/Kourier requests were
|
|
# released that day (the-custodian docs/kubernetes-change-gate-decision.md).
|
|
# State Hub idles near 5m but bursts past 400m under concurrent agent load.
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
|
|
sweep:
|
|
# RMGR-WP-0005-T11: disabled while railiance01 checkouts still target the
|
|
# stale gitea-remote lineage. Re-enable only after the governed remote
|
|
# reconciliation and registrar preflight are complete.
|
|
enabled: false
|
|
# Present in the live release but previously missing here, so deploying from
|
|
# this file alone silently dropped it. Inert while enabled is false.
|
|
hostname: 239.62.205.92.host.secureserver.net
|
|
hostPath: /home/tegwick
|
|
sshHostPath: /home/tegwick/.ssh
|
|
|
|
# Forge read credential (STATE-WP-0084-T02). Coordinates only — the token lives
|
|
# in OpenBao at platform/workloads/state-hub/forge-derivation and reaches the
|
|
# pod through Kubernetes auth, never through this file or a Secret.
|
|
forgeRead:
|
|
enabled: true
|
|
|
|
# RPF-WP-0035-T04: dedicated ESO signing key, API-only explicit reference.
|
|
renamePreflight:
|
|
enabled: true
|
|
secretName: state-hub-rename-preflight
|