---
id: w1/m19.1/t001
title: Align desired state to reality — KCP 3→2, platform max 3→2, tenant max 0 (TEMP), ghosts cleared
worker: worker1
status: done
estimate: 15m
depends_on: []
---

## Objective

Make the declared machine counts match what the 5-server quota can actually host, so the three quota-blocked ghost machine objects (CP#3, platform#3, tenant#1) are deleted and zero machines sit in a provisioning state — `clusterctl move` (t002) refuses to run otherwise.

## Context

- Ghosts: `Machine` objects exist on the mgmt cluster but CAPH gets `resource_limit_exceeded` from Hetzner on every server create (m19 t006 op log, 23:30).
- KCP `replicas: 3` at overlay line ~534; platform pool autoscaler max annotation ~line 794; tenant pool min/max annotations ~lines 173–174.
- The autoscaler re-raises MachineDeployment replicas while demand exists (openbao-1 Pending demands platform#3; app pods demand tenant#1) — the max annotations are what actually cap it.
- Every change carries a `TEMP (m19.1): revert when the Hetzner quota is raised` comment so next week's revert is a grep away.

## Steps

1. Overlay edits: KCP `replicas: 3`→`2`; platform `cluster-api-autoscaler-node-group-max-size: "3"`→`"2"`; tenant max `"3"`→`"0"` (min stays 0 for now; t005 flips it to min 1/max 3 permanently).
2. Push (app-cluster.yml applies to mgmt); if the CA holds a stale replica count, scale the MDs down by hand once — the annotations stop re-raising.
3. Verify on mgmt: `kubectl get machines -A` shows exactly 4 (2 CP + 2 platform), all `Running`, none provisioning.

## Files

- infra/clusterapi/overlays/hetzner-caph/cluster.yaml

## Acceptance criteria

- [ ] `kubectl get machines -A` on mgmt: 4 machines, all phase Running, zero deletionTimestamps/provisioning.
- [ ] All three TEMP edits carry the revert comment.

## Out of scope

- The revert itself (next week, after the quota raise — tracked in m19).
