---
id: w1/m19.1/t005
title: Tenant node birth — pool min 1/max 3 (permanent) → apps Running, LE certs issued
worker: worker1
status: done
estimate: 20m
depends_on: [w1/m19.1/t004]
---

## Objective

Give the hosted apps a home: raise the tenant pool to min 1 / max 3 (permanent — user decision 2026-07-11: a hosting platform keeps at least one tenant node warm; t001's max 0 was only the ghost-clearing interim), let the in-cluster autoscaler create the node into the freed slot, and watch the stack come alive.

## Context

- Waiting consumers: 3 App pods (agentmarketcap, beancount-cms, eden-cms-v2) Pending + cert-manager ACME HTTP01 solver pods Pending — all need an untainted tenant node.
- Post-pivot the overlay apply targets the app cluster (t003's rewritten workflow does this).
- Build-from-git apps must rebuild images (zot died with the old cluster) — the operator's build path handles it; watch build Jobs.

## Steps

1. Overlay: tenant pool `min-size: "1"`, `max-size: "3"` (remove t001's TEMP on tenant); push; CI applies.
2. Watch: machine → node Ready → App pods schedule → build Jobs (if any) → solvers schedule → LE certs issue (`kubectl get certificates -A`).

## Files

- infra/clusterapi/overlays/hetzner-caph/cluster.yaml

## Acceptance criteria

- [ ] Tenant node Ready; 5/5 quota used (2 CP + 2 platform + 1 tenant).
- [ ] 3 App CRs reach Running phase with URLs; certificates Ready=True.

## Out of scope

- DNS cutover (t006); OpenBao (m19, post-quota).
