{"id":"autoscaling-placement-within-governance","text":"Workload resource management (multi-level autoscaling + scheduling + storage placement) operates within the governance model: quotas force explicit resource declarations that autoscalers must respect, RBAC controls who configures scaling policies, and project-level self-provisioning governance determines which namespaces workloads can scale into.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[{"type":"SL","antecedents":["autoscaling-and-placement-resource-management","governance-spans-identity-resources-and-namespaces"],"outlist":[],"label":"Connects resource management (depth-3) with governance (depth-3) — autoscaling is not ungoverned"}],"dependents":["runtime-operations-fully-observable-within-governance","runtime-operations-require-integrated-networking-and-resource-governance"],"metadata":{},"explanation":{"steps":[{"node":"autoscaling-placement-within-governance","truth_value":"IN","reason":"SL justification valid","antecedents":["autoscaling-and-placement-resource-management","governance-spans-identity-resources-and-namespaces"],"label":"Connects resource management (depth-3) with governance (depth-3) — autoscaling is not ungoverned"},{"node":"autoscaling-and-placement-resource-management","truth_value":"IN","reason":"SL justification valid","antecedents":["multi-level-autoscaling-architecture","workload-placement-requires-storage-and-scheduling"],"label":"Autoscaling determines how much capacity exists; scheduling determines where workloads land — combining reveals the full resource management picture."},{"node":"multi-level-autoscaling-architecture","truth_value":"IN","reason":"SL justification valid","antecedents":["keda-custom-metrics-autoscaling-model","autoscaler-requires-machine-autoscaler"],"label":"depth-1 KEDA model covers pod-level scaling; base autoscaler belief covers infrastructure-level; combining reveals a three-tier architecture where each tier scales independently but infrastructure scaling gates the capacity available to pod-level scaling"},{"node":"keda-custom-metrics-autoscaling-model","truth_value":"IN","reason":"SL justification valid","antecedents":["keda-custom-resources","keda-trigger-types","vpa-adjusts-requests-limits"],"label":"KEDA horizontal and VPA vertical autoscaling form a complete scaling model"},{"node":"keda-custom-resources","truth_value":"IN","reason":"premise"},{"node":"keda-trigger-types","truth_value":"IN","reason":"premise"},{"node":"vpa-adjusts-requests-limits","truth_value":"IN","reason":"premise"},{"node":"autoscaler-requires-machine-autoscaler","truth_value":"IN","reason":"premise"},{"node":"workload-placement-requires-storage-and-scheduling","truth_value":"IN","reason":"SL justification valid","antecedents":["scheduling-constraints-multi-dimensional","storage-lifecycle-from-provisioning-to-reclaim"],"label":"Both depth-1 nodes represent independent constraint domains that must be jointly satisfied; a pod can match scheduling rules but fail on storage binding, or have storage available but be unschedulable — neither alone determines placement"},{"node":"scheduling-constraints-multi-dimensional","truth_value":"IN","reason":"SL justification valid","antecedents":["node-selector-operators","node-taint-effects-three","affinity-label-selector-operators","scheduling-gates-set-at-creation-only","scheduler-default-node-selector-intersection","topology-manager-single-numa-strictest"],"label":"depth-1 grouping — scheduling is multi-dimensional constraint satisfaction, not simple matching"},{"node":"node-selector-operators","truth_value":"IN","reason":"premise"},{"node":"node-taint-effects-three","truth_value":"IN","reason":"premise"},{"node":"affinity-label-selector-operators","truth_value":"IN","reason":"premise"},{"node":"scheduling-gates-set-at-creation-only","truth_value":"IN","reason":"premise"},{"node":"scheduler-default-node-selector-intersection","truth_value":"IN","reason":"premise"},{"node":"topology-manager-single-numa-strictest","truth_value":"IN","reason":"premise"},{"node":"storage-lifecycle-from-provisioning-to-reclaim","truth_value":"IN","reason":"SL justification valid","antecedents":["ocp-storage-uses-csi-plugin-architecture","pvc-three-phases","unbound-pvc-waits-indefinitely","storageclass-default-reclaimpolicy-delete"],"label":"depth-1 grouping — storage resources follow a complete lifecycle with specific phase transitions and cleanup semantics"},{"node":"ocp-storage-uses-csi-plugin-architecture","truth_value":"IN","reason":"premise"},{"node":"pvc-three-phases","truth_value":"IN","reason":"premise"},{"node":"unbound-pvc-waits-indefinitely","truth_value":"IN","reason":"premise"},{"node":"storageclass-default-reclaimpolicy-delete","truth_value":"IN","reason":"premise"},{"node":"governance-spans-identity-resources-and-namespaces","truth_value":"IN","reason":"SL justification valid","antecedents":["authorization-and-resource-governance-model","openshift-identity-lifecycle-chain","project-self-provisioning-governance"],"label":"Depth-3 — the three governance layers (identity, resource, namespace) interact: project self-provisioning is constrained by both identity chain and resource quotas"},{"node":"authorization-and-resource-governance-model","truth_value":"IN","reason":"SL justification valid","antecedents":["openshift-extends-k8s-authorization-model","quota-forces-complete-resource-declarations"],"label":"Authorization gates who can act; quotas gate how much — both enforce strictness"},{"node":"openshift-extends-k8s-authorization-model","truth_value":"IN","reason":"SL justification valid","antecedents":["ocp-two-authorization-api-groups","openshift-has-own-authorization-api","scc-api-group-security-openshift","default-clusterroles-list"],"label":"Parallel authorization APIs reflect OpenShift's extension of Kubernetes security model"},{"node":"ocp-two-authorization-api-groups","truth_value":"IN","reason":"premise"},{"node":"openshift-has-own-authorization-api","truth_value":"IN","reason":"premise"},{"node":"scc-api-group-security-openshift","truth_value":"IN","reason":"premise"},{"node":"default-clusterroles-list","truth_value":"IN","reason":"premise"},{"node":"quota-forces-complete-resource-declarations","truth_value":"IN","reason":"SL justification valid","antecedents":["ocp-quota-forces-explicit-resource-specs","ocp-extended-resources-no-overcommit"],"label":"Quotas enforce exhaustive resource declarations with no implicit defaults"},{"node":"ocp-quota-forces-explicit-resource-specs","truth_value":"IN","reason":"premise"},{"node":"ocp-extended-resources-no-overcommit","truth_value":"IN","reason":"premise"},{"node":"openshift-identity-lifecycle-chain","truth_value":"IN","reason":"SL justification valid","antecedents":["oauth-config-singleton-named-cluster","oauth-requires-integratedoauth-type","user-api-group-user-openshift-io","useridentitymapping-maps-user-to-identity","oauthclientauthorization-delete-revokes"],"label":"Five resources form a directed chain from authentication config to session lifecycle"},{"node":"oauth-config-singleton-named-cluster","truth_value":"IN","reason":"premise"},{"node":"oauth-requires-integratedoauth-type","truth_value":"IN","reason":"premise"},{"node":"user-api-group-user-openshift-io","truth_value":"IN","reason":"premise"},{"node":"useridentitymapping-maps-user-to-identity","truth_value":"IN","reason":"premise"},{"node":"oauthclientauthorization-delete-revokes","truth_value":"IN","reason":"premise"},{"node":"project-self-provisioning-governance","truth_value":"IN","reason":"SL justification valid","antecedents":["ocp-admin-can-disable-self-provisioning","ocp-disable-self-provisioning-two-steps","project-request-template-in-openshift-config-ns","project-request-message-shown-when-denied"],"label":"Four beliefs describe the complete self-provisioning governance lifecycle"},{"node":"ocp-admin-can-disable-self-provisioning","truth_value":"IN","reason":"premise"},{"node":"ocp-disable-self-provisioning-two-steps","truth_value":"IN","reason":"premise"},{"node":"project-request-template-in-openshift-config-ns","truth_value":"IN","reason":"premise"},{"node":"project-request-message-shown-when-denied","truth_value":"IN","reason":"premise"}]}}