the-custodian/docs/evidence/2026-10-21-wave1-apply.md

CUST-WP-0071 wave 1 — apply evidence (2026-10-21)

Authority: docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md (wave 1; local kubectl allowed; probe uninstall approved). Target: railiance01, node 92.205.62.239, verified before each step. Method: applied from the workstation kubeconfig, one owner at a time, in the order STATE-WP-0099 requires.

Node CPU requests (of 4000m allocatable)

After step	CPU requested	Memory requested	Change
Before	3605m (90%)	9856Mi	—
1 Knative (requests 220→60m, HPA max 20/5/10→3/2/3)	3445m	9856Mi	−160m
2 Probe uninstalled	—	—	−50m / −128Mi
3 state-hub API 250→390m	—	—	+140m
4 state-hub-db none→70m/416Mi	3605m (90%)	10144Mi	+70m
5 rapp-telemetry (Prometheus 205m/1152Mi, Grafana 35m/512Mi, 10d retention)	—	—	+10m / +880Mi
6a Forgejo runner (dind 100m/432Mi, runner 25m/64Mi)	3740m (93%)	11520Mi (72%)	+125m / +496Mi
6b Forgejo server (Helm reconciliation, revision 10)	3840m (96%)	12496Mi (78%)	+100m effective / +976Mi

Wave 1 nets out as the review predicted. The node is now at 93% of CPU requests. Further increases, including the deferred Forgejo server and routine state-hub release surges, depend on the wave-2 reductions (STATE-WP-0099-T06, RESOURCE-WP-0008).

Verification per owner

• Knative (RAIL-KNATIVE-WP-0003 finished, RCLUSTER-WP-0020-T02):

  • all six deployments request 10m and are Ready;
  • HPA max is 3/2/3;
  • Kourier is ClusterIP and ksvc rapp-qonto is Ready;
  • the PodDisruptionBudgets are unchanged.

  The policy reject-secret-last-applied refused the runtime-generated webhook certificate object, which stayed unchanged; follow-up RCLUSTER-WP-0020-T04.

• Probe (CORE-WP-0012-T02): the Helm release was removed. Namespace coulomb was kept until the founder checks for a leftover probe credential object.

• state-hub (STATE-WP-0099-T03..T05):

  • Helm revision 78, API at 390m, health ok, schema current;
  • the image also moved 5dd3df9 → c103cbf (an already-committed values bump);
  • rollback: revision 77;
  • the DB in namespace databases requests 70m/416Mi and is healthy.

• rapp-telemetry (RAPP-TELEMETRY-WP-0002-T03):

  • targets all up, about 7.3 days of history retained;
  • the forgejo effective-request series is 0.1;
  • host/k3s cAdvisor series are present;
  • rollback: revision 4.

• Forgejo (FORGE-WP-0011-T02):

  • runner: the founder-run, redacted diff showed resources only, so it was applied, and the daemon is up;
  • server: deferred, because the Helm upgrade would also apply the NetKingdom sign-in declaration (railiance-apps 4d6a8dd) over the source activated natively on 19 Oct (CUST-WP-0080 T42/T43).

Follow-ups raised

• whitehat-security WHITEHAT-IN-0003: a secret-aware release-diff review facility, so the founder accepts a redacted report instead of diffing by hand.
• RCLUSTER-WP-0020-T04: make the installer compatible with the annotation policy, and fix its ssh/kubeconfig access path.
• Forgejo Helm reconciliation together with the sign-in owners. Retire the legacy "gitea" naming when convenient (the upstream chart name, not the retired Gitea server).

Forgejo server reconciliation (later the same evening)

The founder ran the final helm upgrade of make forgejo-deploy after a redacted diff review. The prerequisite manifests matched live, and the eso-deploy chain was skipped deliberately. Results:

• Helm revision 10 now matches live.
• The server requests 200m/1104Mi with a 1536Mi limit, and is healthy.
• The NetKingdom sign-in source is unchanged: the chart took its update path with identical values. The redirect still uses S256 PKCE, the HTTPS callback and a single scope list.

Details: railiance-forge FORGE-WP-0011-T03. Wave 1 is complete.