Add the option to install a large-cluster manifest and cordon control plane to dedicated machines

manifests/ate-install/base/kustomization.yaml

@@ -18,10 +18,18 @@ kind: Kustomization
 # ate-otel-config.yaml carries the OTLP settings every component above consumes
 # via envFrom. The kind overlay lists its own copy of the same ConfigMap name
 # instead of building on this directory, so the two never collide.
+#
+# pod-certificate-controller.yaml is deliberately absent. hack/install-ate.sh
+# applies it on its own before this bundle, through the podcert-size10 overlay
+# on large clusters, and then sets WORKERS_PER_SIGNER on the Deployment.
+# Listing the base file here would re-apply it after those steps and revert
+# both the overlay's flags and the env override. The same goes for the
+# sandboxconfig and atenet-egress files: install-ate.sh applies the variant it
+# selects, so they are not listed here either.
 resources:
   - ../ate-api-server.yaml
   - ../ate-controller.yaml
   - ../atelet.yaml
   - ../atenet-router.yaml
-  - ../pod-certificate-controller.yaml
+  - ../atenet-router-monitoring.yaml
   - ../ate-otel-config.yaml

manifests/ate-install/components/cordon-control-plane/kustomization.yaml

@@ -0,0 +1,67 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Pins each control plane workload to its own dedicated node. Selected by
+# hack/install-ate.sh under --cordon-control-plane, which wraps every
+# control plane apply in a kustomization that includes this component.
+#
+# Assumes a node pool whose nodes carry the label and the taint
+# ate.dev/workloadType=ate-control-plane:NoSchedule. The hostname
+# anti-affinity matches every pod carrying the label, replicas included, so
+# the pool needs one node per pod: 7 at the shipped replica counts (two
+# ate-api-server, one of each other workload), and more if replicas are
+# raised. Keep at least one spare beyond that: the Deployments surge a new
+# pod before removing the old one, and with no free node the new pod stays
+# Pending and the rollout never completes. A pool that is too small leaves
+# pods Pending rather than failing loudly.
+#
+# One patch with a name-regex target rather than one per workload: the
+# install applies these workloads through several different streams (the
+# base bundle, a lone ate-api-server redeploy, the podcert overlay, the
+# postgres file, and the egress variants), and kustomize leaves a stream
+# alone when nothing in it matches, so the same component fits every path.
+
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+patches:
+  - target:
+      kind: Deployment|StatefulSet
+      name: ate-api-server|ate-controller|atenet-router|atenet-egress|podcertificate-controller|postgres
+    patch: |-
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: overridden-by-target
+      spec:
+        template:
+          metadata:
+            labels:
+              ate.dev/workloadType: ate-control-plane
+          spec:
+            nodeSelector:
+              ate.dev/workloadType: ate-control-plane
+            tolerations:
+            - key: ate.dev/workloadType
+              operator: Equal
+              value: ate-control-plane
+              effect: NoSchedule
+            affinity:
+              podAntiAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                - labelSelector:
+                    matchLabels:
+                      ate.dev/workloadType: ate-control-plane
+                  namespaceSelector: {}
+                  topologyKey: kubernetes.io/hostname

manifests/ate-install/kind/kustomization.yaml

@@ -21,12 +21,15 @@ kind: Kustomization
 # overlay is also built standalone; listing it in both would be a duplicate
 # resource. hack/install-ate.sh applies the ConfigMap directly for the targeted
 # single-component redeploys.
+#
+# pod-certificate-controller.yaml is deliberately absent, as in ../base:
+# hack/install-ate.sh applies and deletes it on its own, and re-applying the
+# base file from this bundle would revert the WORKERS_PER_SIGNER override.
 resources:
   - ../ate-api-server.yaml
   - ../ate-controller.yaml
   - ./atelet
   - ../atenet-router.yaml
-  - ../pod-certificate-controller.yaml
   - ate-otel-config.yaml
   - rustfs.yaml
   - ./otel-collector.yaml

manifests/ate-install/podcert-size10/kustomization.yaml

@@ -0,0 +1,40 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# size10 cluster overlay for podcertificate-controller: raises the client-go
+# rate limits above the built-in 5 QPS / 10 burst so signing keeps up with
+# the request volume the size10 postgres profile enables. Selected by
+# hack/install-ate.sh when --cluster-size=size10.
+
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../pod-certificate-controller.yaml
+
+# JSON-patch style so we only append the two new flags rather than restate
+# the whole args list — keeps the overlay from drifting if the base flags
+# change.
+patches:
+  - target:
+      kind: Deployment
+      name: podcertificate-controller
+      namespace: podcertificate-controller-system
+    patch: |-
+      - op: add
+        path: /spec/template/spec/containers/0/args/-
+        value: --kube-api-qps=100
+      - op: add
+        path: /spec/template/spec/containers/0/args/-
+        value: --kube-api-burst=200

manifests/ate-install/postgres-size10/postgres-config-patch.yaml

@@ -0,0 +1,78 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Merge-patched into postgres-config by hack/install-ate.sh when
+# --cluster-size=size10. `kubectl patch --type merge` replaces the
+# postgresql.conf key without touching pg_hba.conf or reload-tls.sh, both
+# defined in manifests/ate-install/postgres/postgres.yaml.
+#
+# Sized to match the container resource patch in hack/install-ate.sh
+# (140 GiB memory, 80 vCPU request, no CPU limit, on a dedicated node).
+# Every value below depends on those numbers -- if the container is resized
+# the tuning has to move with it.
+data:
+  postgresql.conf: |
+    # Repeated from manifests/ate-install/postgres/postgres.yaml: kubectl merge patch
+    # replaces the whole postgresql.conf value, so anything omitted here would
+    # revert to the compiled-in default. TLS and hba paths have to stay wired
+    # up or the server refuses connections.
+    listen_addresses = '*'
+    ssl = on
+    ssl_cert_file = '/run/servicedns.podcert.ate.dev/credential-bundle.pem'
+    ssl_key_file = '/run/servicedns.podcert.ate.dev/credential-bundle.pem'
+    ssl_ca_file = '/run/podidentity.podcert.ate.dev/trust-bundle.pem'
+    hba_file = '/etc/postgresql/pg_hba.conf'
+
+    # Memory: container holds 140 GiB. shared_buffers at 25 % is the standard
+    # starting point; going higher rarely helps on PG 18 because the OS page
+    # cache double-buffers. effective_cache_size is a planner hint, not an
+    # allocation.
+    shared_buffers = 35GB
+    effective_cache_size = 100GB
+    work_mem = 32MB
+    maintenance_work_mem = 2GB
+    wal_buffers = 64MB
+    huge_pages = try
+
+    # 2 ate-api-server replicas at pool_max_conns=64 + 3-conn watch pool each
+    # = 134 steady-state; 300 leaves room to double replicas and for psql /
+    # monitoring / migrations.
+    max_connections = 300
+
+    # 1 GB max_wal_size (the compiled default) forces a checkpoint every few
+    # seconds under sustained writes and caps throughput well below what the
+    # disk can do. 16 GB stretches the interval out; completion_target 0.9
+    # spreads the flush across it.
+    max_wal_size = 16GB
+    min_wal_size = 4GB
+    checkpoint_completion_target = 0.9
+    wal_compression = on
+
+    # Parallelism sized to the container's vCPU (no CPU limit, so it can
+    # burst to the whole dedicated node). per_gather stays modest because
+    # the outbox workload is short OLTP, not analytical scans -- unlimited
+    # parallelism there starves concurrent short queries.
+    max_worker_processes = 88
+    max_parallel_workers = 64
+    max_parallel_workers_per_gather = 4
+    max_parallel_maintenance_workers = 6
+
+    # PD-backed SSD assumptions.
+    random_page_cost = 1.1
+    effective_io_concurrency = 200
+
+    # The outbox pattern churns dead tuples fast; give autovacuum more workers
+    # and a shorter naptime than the defaults so it stays ahead of writes.
+    autovacuum_max_workers = 6
+    autovacuum_naptime = 10s

manifests/ate-install/postgres/postgres.yaml

@@ -207,7 +207,7 @@ spec:
         # down to fit a CI runner.
         resources:
           requests:
-            cpu: "2"
+            cpu: "4"
             memory: "1Gi"
           limits:
             cpu: "16"