From f09583ac5584d56890209599651d9b630d8195b5 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Mon, 12 Oct 2026 23:17:12 -0400
Subject: [PATCH 1/3] manifests: CPU requests and 5 s probes for the
 control-plane pods

ate-api-server, atenet-router, ate-controller and the dataplane sidecars
ran BestEffort, and the atelet reserved 50m. On a node packed with
sandboxes they got almost no CPU, their 1 s probes timed out and kubelet
restarted them mid-run. Give each a CPU request, and every liveness and
readiness probe a 5 s timeout and a failure threshold of 6, as the
postgres probes already have.
---
 manifests/ate-install/ate-api-server.yaml | 11 ++++++++++-
 manifests/ate-install/ate-controller.yaml |  6 ++++++
 manifests/ate-install/atelet.yaml         | 13 ++++++++-----
 manifests/ate-install/atenet-egress.yaml  |  6 ++++++
 manifests/ate-install/atenet-router.yaml  | 17 ++++++++++++++++-
 5 files changed, 46 insertions(+), 7 deletions(-)

diff --git a/manifests/ate-install/ate-api-server.yaml b/manifests/ate-install/ate-api-server.yaml
index 07b1f6ff3c..eebbb6c34d 100644
--- a/manifests/ate-install/ate-api-server.yaml
+++ b/manifests/ate-install/ate-api-server.yaml
@@ -173,6 +173,12 @@ spec:
       containers:
       - name: ate-api-server
         image: ko://go.ate.dev/substrate/cmd/ateapi
+        # Requests, no limits: a node packed with sandboxes gives a BestEffort
+        # pod almost no CPU and its probes time out.
+        resources:
+          requests:
+            cpu: "1"
+            memory: 512Mi
         args:
           - "--grpc-server-cred-bundle=/run/servicedns.podcert.ate.dev/credential-bundle.pem"
           - --config-file=/run/apiconfig.ate.dev/apiconfig.textproto
@@ -279,7 +285,8 @@ spec:
             port: health
           initialDelaySeconds: 5
           periodSeconds: 2
-          failureThreshold: 3
+          timeoutSeconds: 5
+          failureThreshold: 6
         # :9091 is bound near the end of boot, after the store connect and
         # the schema migrations, so nothing answers here until both finish.
         # The store connect alone budgets 60s (30 attempts, 2s apart) and the
@@ -306,6 +313,8 @@ spec:
             port: health
           initialDelaySeconds: 10
           periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
       volumes:
       - name: objectstore-plugin
         emptyDir: {}
diff --git a/manifests/ate-install/ate-controller.yaml b/manifests/ate-install/ate-controller.yaml
index f5aeaba137..691dead55c 100644
--- a/manifests/ate-install/ate-controller.yaml
+++ b/manifests/ate-install/ate-controller.yaml
@@ -102,6 +102,12 @@ spec:
       containers:
       - name: ate-controller
         image: ko://go.ate.dev/substrate/cmd/atecontroller
+        # Requests, no limits: a node packed with sandboxes gives a BestEffort
+        # pod almost no CPU.
+        resources:
+          requests:
+            cpu: 500m
+            memory: 256Mi
         args:
         - --ateapi-ca-file=/run/servicedns-ca/trust-bundle.pem
         - --ateapi-client-cert=/run/podidentity.podcert.ate.dev/credential-bundle.pem
diff --git a/manifests/ate-install/atelet.yaml b/manifests/ate-install/atelet.yaml
index 8836ff8535..a5e534894d 100644
--- a/manifests/ate-install/atelet.yaml
+++ b/manifests/ate-install/atelet.yaml
@@ -264,12 +264,12 @@ spec:
             - ALL
             add:
             - DAC_OVERRIDE
-        # Keep per-node reservations small; omit limits to allow usage to grow
-        # with the number of hosted actors.
+        # Reserve enough CPU to answer probes on a node packed with sandboxes;
+        # omit limits to allow usage to grow with the number of hosted actors.
         resources:
           requests:
-            cpu: 50m
-            memory: 128Mi
+            cpu: "1"
+            memory: 256Mi
         env:
         - name: NODE_NAME
           valueFrom:
@@ -309,7 +309,8 @@ spec:
             port: health
           initialDelaySeconds: 5
           periodSeconds: 2
-          failureThreshold: 3
+          timeoutSeconds: 5
+          failureThreshold: 6
         # /healthz stays 200 while a terminating pod drains; /readyz turns 503,
         # so liveness and readiness diverge correctly during shutdown.
         livenessProbe:
@@ -318,6 +319,8 @@ spec:
             port: health
           initialDelaySeconds: 10
           periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
         volumeMounts:
         # HostToContainer so we also see mounts made under /var/lib/ate after
         # the pod starts, e.g. a snapshots disk or CSI volumes.
diff --git a/manifests/ate-install/atenet-egress.yaml b/manifests/ate-install/atenet-egress.yaml
index 994b2fae6f..25211d85d5 100644
--- a/manifests/ate-install/atenet-egress.yaml
+++ b/manifests/ate-install/atenet-egress.yaml
@@ -1292,6 +1292,10 @@ spec:
       - name: envoy
         # ENVOY_DATAPLANE_IMAGE is substituted for the image URI in renderAtenetEgressManifest
         image: ${ENVOY_DATAPLANE_IMAGE}
+        resources:
+          requests:
+            cpu: 500m
+            memory: 256Mi
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -1338,6 +1342,8 @@ spec:
             path: /ready
             port: envoy-metrics
           periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
         startupProbe:
           failureThreshold: 60
           httpGet:
diff --git a/manifests/ate-install/atenet-router.yaml b/manifests/ate-install/atenet-router.yaml
index 0b122cc46a..c0cd3d3531 100644
--- a/manifests/ate-install/atenet-router.yaml
+++ b/manifests/ate-install/atenet-router.yaml
@@ -202,6 +202,12 @@ spec:
       containers:
       - name: atenet-router
         image: ko://go.ate.dev/substrate/cmd/atenet
+        # Requests, no limits: a node packed with sandboxes gives a BestEffort
+        # pod almost no CPU and its probes time out.
+        resources:
+          requests:
+            cpu: "1"
+            memory: 512Mi
         args:
         - "router"
         # Serve the ingress direction only: the ingress ext_proc handler, plus
@@ -289,7 +295,8 @@ spec:
             port: health
           initialDelaySeconds: 5
           periodSeconds: 2
-          failureThreshold: 3
+          timeoutSeconds: 5
+          failureThreshold: 6
         # /healthz stays 200 while a terminating pod drains; /readyz turns
         # 503, so liveness and readiness diverge correctly during shutdown.
         livenessProbe:
@@ -298,6 +305,8 @@ spec:
             port: health
           initialDelaySeconds: 10
           periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
         volumeMounts:
         # Router's own client identity presented to ateapi.
         - name: "podidentity"
@@ -313,6 +322,10 @@ spec:
       - name: envoy
         # ENVOY_DATAPLANE_IMAGE is substituted for the image URI by ate-setup
         image: ${ENVOY_DATAPLANE_IMAGE}
+        resources:
+          requests:
+            cpu: 500m
+            memory: 256Mi
         command:
         - "/usr/local/bin/envoy"
         - "-c"
@@ -340,6 +353,8 @@ spec:
             path: /ready
             port: envoy-metrics
           periodSeconds: 2
+          timeoutSeconds: 5
+          failureThreshold: 6
         volumeMounts:
         - name: envoy-config
           mountPath: /etc/envoy

From a6690f24ae11cf50ba9d4129f38f569840f1a84d Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 13 Oct 2026 10:49:00 -0400
Subject: [PATCH 2/3] manifests: shrink the control-plane CPU requests to fit a
 4 vCPU kind node

The e2e kind cluster is one 4 vCPU node, and the requests summed to
about 7 CPUs together with the kubeadm pods (ate-api-server 2x1,
atenet-router 1.5, atelet 1.05, atenet-egress 0.7, ate-controller 0.5,
postgres and prometheus 0.36, kube-system 0.95), so ate-api-server
stayed Pending and the install timed out. Lower the requests to 250m
for ate-api-server, atenet-router, both envoys and atelet, and to 100m
for ate-controller, which puts the node at about 3.2 CPUs requested;
the probe settings stay. go test on cmd/ate-setup, cmd/atecontroller
and the atenet manifest tests passes, and the kind overlay renders.
---
 manifests/ate-install/ate-api-server.yaml | 2 +-
 manifests/ate-install/ate-controller.yaml | 2 +-
 manifests/ate-install/atelet.yaml         | 6 +++---
 manifests/ate-install/atenet-egress.yaml  | 2 +-
 manifests/ate-install/atenet-router.yaml  | 4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/manifests/ate-install/ate-api-server.yaml b/manifests/ate-install/ate-api-server.yaml
index eebbb6c34d..7a90dcc120 100644
--- a/manifests/ate-install/ate-api-server.yaml
+++ b/manifests/ate-install/ate-api-server.yaml
@@ -177,7 +177,7 @@ spec:
         # pod almost no CPU and its probes time out.
         resources:
           requests:
-            cpu: "1"
+            cpu: 250m
             memory: 512Mi
         args:
           - "--grpc-server-cred-bundle=/run/servicedns.podcert.ate.dev/credential-bundle.pem"
diff --git a/manifests/ate-install/ate-controller.yaml b/manifests/ate-install/ate-controller.yaml
index 691dead55c..738cff2ff3 100644
--- a/manifests/ate-install/ate-controller.yaml
+++ b/manifests/ate-install/ate-controller.yaml
@@ -106,7 +106,7 @@ spec:
         # pod almost no CPU.
         resources:
           requests:
-            cpu: 500m
+            cpu: 100m
             memory: 256Mi
         args:
         - --ateapi-ca-file=/run/servicedns-ca/trust-bundle.pem
diff --git a/manifests/ate-install/atelet.yaml b/manifests/ate-install/atelet.yaml
index a5e534894d..82cd34d90b 100644
--- a/manifests/ate-install/atelet.yaml
+++ b/manifests/ate-install/atelet.yaml
@@ -188,8 +188,8 @@ spec:
           capabilities:
             drop:
             - ALL
-        # Same reservation as atelet and no limits: the plugin now does the
-        # zstd work atelet used to, and must not get less CPU for it.
+        # No limits: the plugin does the zstd work atelet used to, and must
+        # not get less CPU for it.
         resources:
           requests:
             cpu: 50m
@@ -268,7 +268,7 @@ spec:
         # omit limits to allow usage to grow with the number of hosted actors.
         resources:
           requests:
-            cpu: "1"
+            cpu: 250m
             memory: 256Mi
         env:
         - name: NODE_NAME
diff --git a/manifests/ate-install/atenet-egress.yaml b/manifests/ate-install/atenet-egress.yaml
index 25211d85d5..cc64ae8b91 100644
--- a/manifests/ate-install/atenet-egress.yaml
+++ b/manifests/ate-install/atenet-egress.yaml
@@ -1294,7 +1294,7 @@ spec:
         image: ${ENVOY_DATAPLANE_IMAGE}
         resources:
           requests:
-            cpu: 500m
+            cpu: 250m
             memory: 256Mi
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/ate-install/atenet-router.yaml b/manifests/ate-install/atenet-router.yaml
index c0cd3d3531..043767b56f 100644
--- a/manifests/ate-install/atenet-router.yaml
+++ b/manifests/ate-install/atenet-router.yaml
@@ -206,7 +206,7 @@ spec:
         # pod almost no CPU and its probes time out.
         resources:
           requests:
-            cpu: "1"
+            cpu: 250m
             memory: 512Mi
         args:
         - "router"
@@ -324,7 +324,7 @@ spec:
         image: ${ENVOY_DATAPLANE_IMAGE}
         resources:
           requests:
-            cpu: 500m
+            cpu: 250m
             memory: 256Mi
         command:
         - "/usr/local/bin/envoy"

From ba2f092209e860c52b3892272c1bc197034034b9 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 13 Oct 2026 11:07:38 -0400
Subject: [PATCH 3/3] manifests: control-plane CPU requests that leave room for
 the demos on a 4 vCPU kind node

The requests exist for Burstable QoS and CPU shares under contention, so
small values do the job and operators size up with overlays. The kind
e2e lane deploys demo pools beside ate-system and the remaining room on
a 4 vCPU node is about 1.5 CPU.
---
 manifests/ate-install/ate-api-server.yaml | 2 +-
 manifests/ate-install/ate-controller.yaml | 2 +-
 manifests/ate-install/atelet.yaml         | 2 +-
 manifests/ate-install/atenet-egress.yaml  | 2 +-
 manifests/ate-install/atenet-router.yaml  | 4 ++--
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/manifests/ate-install/ate-api-server.yaml b/manifests/ate-install/ate-api-server.yaml
index 7a90dcc120..80f778f499 100644
--- a/manifests/ate-install/ate-api-server.yaml
+++ b/manifests/ate-install/ate-api-server.yaml
@@ -177,7 +177,7 @@ spec:
         # pod almost no CPU and its probes time out.
         resources:
           requests:
-            cpu: 250m
+            cpu: 100m
             memory: 512Mi
         args:
           - "--grpc-server-cred-bundle=/run/servicedns.podcert.ate.dev/credential-bundle.pem"
diff --git a/manifests/ate-install/ate-controller.yaml b/manifests/ate-install/ate-controller.yaml
index 738cff2ff3..cf37d3ab62 100644
--- a/manifests/ate-install/ate-controller.yaml
+++ b/manifests/ate-install/ate-controller.yaml
@@ -106,7 +106,7 @@ spec:
         # pod almost no CPU.
         resources:
           requests:
-            cpu: 100m
+            cpu: 50m
             memory: 256Mi
         args:
         - --ateapi-ca-file=/run/servicedns-ca/trust-bundle.pem
diff --git a/manifests/ate-install/atelet.yaml b/manifests/ate-install/atelet.yaml
index 82cd34d90b..c4c107e3a7 100644
--- a/manifests/ate-install/atelet.yaml
+++ b/manifests/ate-install/atelet.yaml
@@ -268,7 +268,7 @@ spec:
         # omit limits to allow usage to grow with the number of hosted actors.
         resources:
           requests:
-            cpu: 250m
+            cpu: 100m
             memory: 256Mi
         env:
         - name: NODE_NAME
diff --git a/manifests/ate-install/atenet-egress.yaml b/manifests/ate-install/atenet-egress.yaml
index cc64ae8b91..bd5533959f 100644
--- a/manifests/ate-install/atenet-egress.yaml
+++ b/manifests/ate-install/atenet-egress.yaml
@@ -1294,7 +1294,7 @@ spec:
         image: ${ENVOY_DATAPLANE_IMAGE}
         resources:
           requests:
-            cpu: 250m
+            cpu: 100m
             memory: 256Mi
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/manifests/ate-install/atenet-router.yaml b/manifests/ate-install/atenet-router.yaml
index 043767b56f..ac6256f842 100644
--- a/manifests/ate-install/atenet-router.yaml
+++ b/manifests/ate-install/atenet-router.yaml
@@ -206,7 +206,7 @@ spec:
         # pod almost no CPU and its probes time out.
         resources:
           requests:
-            cpu: 250m
+            cpu: 100m
             memory: 512Mi
         args:
         - "router"
@@ -324,7 +324,7 @@ spec:
         image: ${ENVOY_DATAPLANE_IMAGE}
         resources:
           requests:
-            cpu: 250m
+            cpu: 100m
             memory: 256Mi
         command:
         - "/usr/local/bin/envoy"