74 lines
3.6 KiB
Markdown
74 lines
3.6 KiB
Markdown
# CUST-WP-0071 wave 2 — apply evidence (2026-10-21/22, 22:00–22:50 UTC)
|
||
|
||
**Authority:** `docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md`
|
||
(sections "Wave 2" and "Wave 2 apply scope").
|
||
|
||
**Method:**
|
||
- Four worker agents prepared the owner changes in disjoint repo sets.
|
||
- Each change was diffed against live as a full render, showing changed key paths
|
||
only, with no Secret values.
|
||
- Applies went one owner at a time through the owner deploy path. Where an owner's
|
||
`make` target goes through the broken ssh hop, the equivalent local command was
|
||
used.
|
||
- Databases were restarted one at a time, each followed by a health check.
|
||
|
||
## Node CPU requests (of 4000m allocatable)
|
||
|
||
| | CPU requested | Memory requested |
|
||
|---|---:|---:|
|
||
| Before wave 2 | 3840m (96%) | 12496Mi (78%) |
|
||
| After wave 2 | **2755m (68%)** | 12356Mi (77%) |
|
||
|
||
Afterwards, nothing was Pending, every Deployment and StatefulSet was Ready, and all
|
||
50 ExternalSecrets reported SecretSynced. Argo CD apps were Synced and Healthy,
|
||
except bao-notice and informed-decision, which were already OutOfSync before wave 2.
|
||
|
||
## Applied
|
||
|
||
- **Stateless applications:**
|
||
- core-hub (Helm 34), coulomb-social (Helm 17) and reuse-surface (Helm 12).
|
||
- issue-core: Argo CD pin 11af3cb.
|
||
- canned-prompts and sbom-nexus: runtime manifest only, so no migration Job re-ran.
|
||
- tenant-engine, audit-core (Deployment only), mail-address-semantics and rapp-qonto.
|
||
- email-connect, including the approved annotation drift.
|
||
- rein-aharness, including the approved labels; Deployment only.
|
||
- flex-auth-ops-warden (Helm 4).
|
||
- playwright: CPU limit 2 cores.
|
||
- Vergabe: memory 512Mi plus the approved release-unit label, Helm 4.
|
||
- inter-hub: release uninstalled.
|
||
- **Identity stack:**
|
||
- lldap CPU limit raised from 200m to 1 core; it had been throttled 54%.
|
||
- authelia, keycape, identity-provisioner and privacyIDEA right-sized.
|
||
- Checks: KeyCape discovery returns 200, and the forge sign-in redirect works.
|
||
- **Platform:**
|
||
- Argo CD controller and repo-server.
|
||
- ESO (Helm 9) and the openbao UI gateway.
|
||
- cert-manager (Helm 2): the ACME solver nameserver flag is now written into values.
|
||
- traefik, through its HelmChartConfig; ingress returned 200 throughout.
|
||
- **Databases** (single-instance CNPG; each restart confirmed with the new requests
|
||
and Cluster in healthy state):
|
||
|
||
| Cluster | Restarted (UTC) | Notes |
|
||
|---|---|---|
|
||
| platform-pg-2 | — | — |
|
||
| platform-pg | — | dependents logged connection refusals for about 1 min after "healthy", then recovered |
|
||
| user-engine-pg | 22:33 | — |
|
||
| forgejo-db | 22:37 | the forge stayed reachable |
|
||
| net-kingdom-pg | 22:40 | — |
|
||
| target-revenue-pg | 22:42 | the first Argo sync stopped mid-restart; a second sync completed |
|
||
|
||
- **activity-core:** the infrastructure, including the app-db and temporal-db
|
||
StatefulSets and their declared 1Gi limits, the relay and llm-connect.
|
||
|
||
## Not applied (open, with owner records)
|
||
|
||
- **flex-auth:** 8 of 9 releases. Chart HEAD would add `--caller-audience` and change
|
||
sitting's image; that needs owner review (FLEX-WP-0038-T01).
|
||
- **activity-core api, worker and event-router:** the promotion check admits image
|
||
changes only, so this needs an exception (ACTIVITY-WP-0049-T01).
|
||
- **CNPG operator (100m→50m):** it has no source file (RAPP-POSTGRES-WP-0008-T01).
|
||
- **k3s addons** (coredns, metrics-server, local-path-provisioner): founder-run with
|
||
sudo on railiance01 (RCLUSTER-WP-0020-T03). kube-reserved and system-reserved
|
||
follow only after that and a measurement.
|
||
- **Namespaces `coulomb` and `inter-hub`:** the founder checks leftover credential
|
||
objects before deleting them.
|