tegwick
a6afb08d82
Receives the State Hub rows of the 2026-10-21 node allocation review (CUST-WP-0071 T03/T04, RESOURCE-WP-0008). The release preflight now derives the API surge from the values the release deploys instead of the stale 100m STATE-WP-0091 constant, and reports the steady remainder after rollout. Ordering: apply after rail-knative reductions, before forge/telemetry increases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 8340@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
72 lines
2.8 KiB
YAML
72 lines
2.8 KiB
YAML
# Production values for the State Hub Railiance chart handoff.
|
|
# Non-secret values only. DATABASE_URL comes from the Secret `state-hub-env`.
|
|
|
|
namespace:
|
|
create: false
|
|
|
|
image:
|
|
repository: forgejo.coulomb.social/coulomb/state-hub
|
|
tag: "main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1"
|
|
|
|
ingress:
|
|
enabled: false
|
|
|
|
# MCP layer on central (CUST-WP-0067-T08). Enabled together with the image tag
|
|
# above: MCP_HOST landed in main-6c1262e, and enabling this on an older image
|
|
# would deploy a pod that binds loopback and never becomes reachable.
|
|
# ClusterIP only — no ingress, same reason the API's is disabled.
|
|
mcp:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
# 2026-09-10: 1,078 observed 5-minute samples, p99 2.35m, peak 30.45m.
|
|
# Preserve the 500m limit for bursts; free 40m for the API rollout surge.
|
|
cpu: 10m
|
|
|
|
config:
|
|
# This deployment is the authoritative hub. Callers verify this rather than
|
|
# trusting that whatever answered on a port is central (CUST-WP-0067-T03).
|
|
instanceRole: primary
|
|
instanceLabel: railiance01
|
|
sbomNexusUrl: "http://sbom-nexus.sbom-nexus.svc.cluster.local:8010"
|
|
# Reversible T04 read cutover; set back to `legacy` to roll back.
|
|
sbomNexusReadMode: nexus
|
|
# Reversible T04 write cutover; set back to `legacy` to roll back future writes.
|
|
sbomNexusWriteMode: nexus
|
|
|
|
resources:
|
|
# Restored to the chart's 250m on 2026-09-21. The earlier 100m was a workaround
|
|
# for a node with <250m unallocated; ~830m of Knative/Kourier requests were
|
|
# released that day (the-custodian docs/kubernetes-change-gate-decision.md).
|
|
# State Hub idles near 5m but bursts past 400m under concurrent agent load.
|
|
# 2026-10-21 (STATE-WP-0099, CUST-WP-0071 node allocation review): 7d p95
|
|
# 258m sat above the 250m request; request = p95 x1.5 = 390m. Limit unchanged.
|
|
# scripts/release_headroom_preflight.py derives the API surge from this value.
|
|
requests:
|
|
cpu: 390m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
|
|
sweep:
|
|
# RMGR-WP-0005-T11: disabled while railiance01 checkouts still target the
|
|
# stale gitea-remote lineage. Re-enable only after the governed remote
|
|
# reconciliation and registrar preflight are complete.
|
|
enabled: false
|
|
# Present in the live release but previously missing here, so deploying from
|
|
# this file alone silently dropped it. Inert while enabled is false.
|
|
hostname: 239.62.205.92.host.secureserver.net
|
|
hostPath: /home/tegwick
|
|
sshHostPath: /home/tegwick/.ssh
|
|
|
|
# Forge read credential (STATE-WP-0084-T02). Coordinates only — the token lives
|
|
# in OpenBao at platform/workloads/state-hub/forge-derivation and reaches the
|
|
# pod through Kubernetes auth, never through this file or a Secret.
|
|
forgeRead:
|
|
enabled: true
|
|
|
|
# RPF-WP-0035-T04: dedicated ESO signing key, API-only explicit reference.
|
|
renamePreflight:
|
|
enabled: true
|
|
secretName: state-hub-rename-preflight
|