---
id: w1/m19/t002
title: Rewrite the CAPH overlay to the target shape (network / 3xCP / taint / two pools)
worker: worker1
status: done
estimate: 45m
depends_on: []
---

## Objective

Rewrite infra/clusterapi/overlays/hetzner-caph/cluster.yaml per docs/rearchitecture.md section 3, decisions 1-2: CAPH owns the network; control plane is 3 nodes and tainted; two worker pools separate platform from tenants.

## Context

- `HetznerCluster.spec.hcloudNetwork`: `enabled: true`, cidrBlock `10.10.0.0/16`, subnetCidrBlock `10.10.0.0/24` (distinct from bex-infra's 10.0.0.0/16), networkZone eu-central. CAPH then creates network `bex` and attaches every machine - the CCM's existing `HCLOUD_NETWORK=bex` finally resolves.
- KCP: `replicas: 3`; delete the `taints: []` line (restore the control-plane NoSchedule taint); KEEP the w1/m3 MostAllocated scheduler files/extraArgs/extraVolumes exactly as shipped in b02d354.
- Worker pools: new `bex-platform` MachineDeployment (KubeadmConfigTemplate with taint `bex.co/platform=true:NoSchedule` + label `bex.co/pool=platform` via kubeletExtraArgs node-labels/register-with-taints; min-size 2 / max-size 3 autoscaler annotations); existing `bex-worker-0` keeps its m3 annotations (min 0 / max 3 + cx33 capacity hints) and stays untainted (tenant default).
- MachineHealthChecks: add one for bex-platform mirroring bex-worker-0's.

## Steps

1. Edit the overlay; `yq eval-all` parse check; server-side dry-run is NOT possible against live (immutable field - expected until t006 recreates).

## Files

- infra/clusterapi/overlays/hetzner-caph/cluster.yaml

## Acceptance criteria

- [x] Overlay parses; contains hcloudNetwork enabled 10.10.0.0/16, KCP replicas 3 without `taints: []`, both pools with correct annotations/taints, scheduler config intact. _Done 2026-07-10:_ 15 docs (11 original + KubeadmConfigTemplate/MachineDeployment/HCloudMachineTemplate/MachineHealthCheck for `bex-platform`); platform pool derived from the worker template with taint `bex.co/platform=true:NoSchedule` + label `bex.co/pool=platform`, min 2/max 3 + cx33 capacity hints; `platform` spread placement group added. Note: yq reformatted the file (semantics-preserving); the copied MD annotation comment mentioning min-0 belongs to the tenant pool — t010 cleanup item.
- [x] A reviewer can diff the overlay against docs/rearchitecture.md section 3 and find every decision represented (decisions 1+2 fully; 3+4 live in t004/t005 files).

## Out of scope

- local-capd overlay changes (mock topology stays single-pool; verify-elastic covers it).
