From d4e5bb87102723ac09116ed7e06eb708e08a4140 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 21 Oct 2026 21:08:27 +0200 Subject: [PATCH] CUST-WP-0071: wave 1 applied (except Forgejo server); evidence Co-Authored-By: Claude Opus 5.5 --- WORK-RECORDS.md | 2 +- docs/evidence/2026-10-21-wave1-apply.md | 64 +++++++++++++++++++ ...sured-workload-sizing-and-weekly-review.md | 25 +++++++- 3 files changed, 87 insertions(+), 4 deletions(-) create mode 100644 docs/evidence/2026-10-21-wave1-apply.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 9497be8..ae948cb 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -466,7 +466,7 @@ | task | CUST-WP-0071-T01 | done | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | | task | CUST-WP-0071-T02 | done | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | | task | CUST-WP-0071-T03 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | -| task | CUST-WP-0071-T04 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | +| task | CUST-WP-0071-T04 | progress | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | | task | CUST-WP-0071-T05 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md | | task | CUST-WP-0072-T01 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md | | task | CUST-WP-0072-T02 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md | diff --git a/docs/evidence/2026-10-21-wave1-apply.md b/docs/evidence/2026-10-21-wave1-apply.md new file mode 100644 index 0000000..9d1138e --- /dev/null +++ b/docs/evidence/2026-10-21-wave1-apply.md @@ -0,0 +1,64 @@ +# CUST-WP-0071 wave 1 — apply evidence (2026-10-21) + +**Authority:** `docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md` +(wave 1; local kubectl allowed; probe uninstall approved). +**Target:** railiance01, node 92.205.62.239, verified before each step. +**Method:** applied from the workstation kubeconfig, one owner at a time, in the +order STATE-WP-0099 requires. + +## Node CPU requests (of 4000m allocatable) + +| After step | CPU requested | Memory requested | Change | +|---|---:|---:|---| +| Before | 3605m (90%) | 9856Mi | — | +| 1 Knative (requests 220→60m, HPA max 20/5/10→3/2/3) | 3445m | 9856Mi | −160m | +| 2 Probe uninstalled | — | — | −50m / −128Mi | +| 3 state-hub API 250→390m | — | — | +140m | +| 4 state-hub-db none→70m/416Mi | 3605m (90%) | 10144Mi | +70m | +| 5 rapp-telemetry (Prometheus 205m/1152Mi, Grafana 35m/512Mi, 10d retention) | — | — | +10m / +880Mi | +| 6a Forgejo runner (dind 100m/432Mi, runner 25m/64Mi) | 3740m (93%) | 11520Mi (72%) | +125m / +496Mi | +| 6b Forgejo server | deferred | | (+200m / +976Mi when applied) | + +Wave 1 nets out as the review predicted. The node is now at 93% of CPU +requests. Further increases, including the deferred Forgejo server and routine +state-hub release surges, depend on the wave-2 reductions +(STATE-WP-0099-T06, RESOURCE-WP-0008). + +## Verification per owner + +- **Knative** (RAIL-KNATIVE-WP-0003 finished, RCLUSTER-WP-0020-T02): + - all six deployments request 10m and are Ready; + - HPA max is 3/2/3; + - Kourier is ClusterIP and ksvc rapp-qonto is Ready; + - the PodDisruptionBudgets are unchanged. + + The policy `reject-secret-last-applied` refused the runtime-generated webhook + certificate object, which stayed unchanged; follow-up RCLUSTER-WP-0020-T04. +- **Probe** (CORE-WP-0012-T02): the Helm release was removed. Namespace `coulomb` + was kept until the founder checks for a leftover probe credential object. +- **state-hub** (STATE-WP-0099-T03..T05): + - Helm revision 78, API at 390m, health ok, schema current; + - the image also moved 5dd3df9 → c103cbf (an already-committed values bump); + - rollback: revision 77; + - the DB in namespace `databases` requests 70m/416Mi and is healthy. +- **rapp-telemetry** (RAPP-TELEMETRY-WP-0002-T03): + - targets all up, about 7.3 days of history retained; + - the forgejo effective-request series is 0.1; + - host/k3s cAdvisor series are present; + - rollback: revision 4. +- **Forgejo** (FORGE-WP-0011-T02): + - **runner:** the founder-run, redacted diff showed resources only, so it was + applied, and the daemon is up; + - **server:** deferred, because the Helm upgrade would also apply the NetKingdom + sign-in declaration (railiance-apps 4d6a8dd) over the source activated natively + on 19 Oct (CUST-WP-0080 T42/T43). + +## Follow-ups raised + +- whitehat-security `WHITEHAT-IN-0003`: a secret-aware release-diff review + facility, so the founder accepts a redacted report instead of diffing by hand. +- RCLUSTER-WP-0020-T04: make the installer compatible with the annotation policy, + and fix its ssh/kubeconfig access path. +- Forgejo Helm reconciliation together with the sign-in owners. Retire the + legacy "gitea" naming when convenient (the upstream chart name, not the retired + Gitea server). diff --git a/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md b/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md index 7667efb..7401000 100644 --- a/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md +++ b/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md @@ -152,11 +152,9 @@ unrelated deletion, procurement or automatic resource changes. ```task id: CUST-WP-0071-T04 -status: wait +status: progress priority: medium assignee: the-custodian -depends_on: [CUST-WP-0071-T03] -blocking_reason: "Await reviewed allocation proposals and applicable workload-owner authority." state_hub_task_id: "944f98e2-7e42-5894-925b-752423f3a1cc" ``` @@ -590,3 +588,24 @@ Apply blocker: the founder allowed local kubectl for wave 1, but Claude Code's permission classifier refuses cluster writes from this session ("Protected-Scope IaC Apply"). The founder runs the applies, or adds a permission rule. No production allocation has changed. + +## Wave 1 applied — 2026-10-21 + +All five wave-1 owners were applied one at a time, except the Forgejo server. +Evidence: `docs/evidence/2026-10-21-wave1-apply.md`. + +- Knative: requests −160m, HPA caps 3/2/3. +- Probe: Helm release removed (−50m). +- state-hub: API 390m (Helm revision 78; the image also moved to an + already-committed c103cbf); DB 70m/416Mi. +- rapp-telemetry: sizing, 10-day retention and the new measurement series. +- Forgejo runner: resources only, applied after a founder-run, redacted diff. + +The Forgejo server upgrade is deferred, because it would also re-apply the +NetKingdom sign-in source that was activated natively on 19 Oct (CUST-WP-0080 +T42/T43). + +The node is at 3740m of 4000m CPU (93%) and 72% of memory, as budgeted. T03 and T04 +stay open until the wave-2 receiving tasks reduce requests (routine state-hub +releases need that headroom: STATE-WP-0099-T06) and the effects are observed +over a representative window (RAPP-TELEMETRY-WP-0002-T05 re-measures after 7 days).