The KSail-installed cluster autoscaler runs one replica and is the last live replica-floor failure

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

Measured against live prod 2026-09-21T02:10Z: across all PolicyReports, validate-replica-floor returns 39 pass, 46 skip and 1 fail. The fail is kube-system/Deployment/cluster-autoscaler-hetzner-cluster-autoscaler, which runs spec.replicas: 1. It is a true positive, not a stale result (see #2573, where this was verified).

Audience and problem

Platform operators reading the compliance dashboard. The one remaining HA finding is neither fixed nor explained, so it reads as an open gap indefinitely. The autoscaler is installed by KSail, not by a Flux HelmRelease, so the platform repository cannot simply set its replica count — NodeAutoscalerConfig exposes no replicas (the same gap #3954 / ksail#7142 found for its resources).

Expected behaviour

Either the autoscaler runs with a second leader-elected replica, or its single replica is a documented, justified singleton exemption that emits skip like the other documented singletons.

Acceptance criteria

• Decide between a second replica and a documented singleton exemption, with the reasoning recorded here. The autoscaler is leader-elected, so a second replica buys only faster failover.
• The live validate-replica-floor failure count is 0 and the decision is enforced from source.

Size: small.