chore: sync main→staging infra (drop Faro, CSS isolate, cloudflared probes) (#169)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Junyi-99

hack/values-prd.yaml

@@ -1,9 +1,7 @@
 namespace: paperdebugger
 
-nodeSelector:
-  kubernetes.io/hostname: xtras3
-cloudflareNodeSelector:
-  kubernetes.io/hostname: nuc
+nodeSelector: {}
+cloudflareNodeSelector: {}
 
 mongo:
   in_cluster: false

helm-chart/templates/cloudflare.yaml

@@ -33,7 +33,7 @@ spec:
           - name: net.ipv4.ping_group_range
             value: "65532 65532"
       containers:
-        - image: cloudflare/cloudflared:latest
+        - image: {{ .Values.cloudflared.image }}
           name: cloudflared
           env:
             # Defines an environment variable for the tunnel token.
@@ -50,16 +50,28 @@ spec:
             - --protocol
             - http2
             - --loglevel
-            - debug
+            - info
             - --metrics
             - 0.0.0.0:2000
             - run
-          livenessProbe:
+          resources:
+            {{- toYaml .Values.cloudflared.resources | nindent 12 }}
+          # cloudflared's /ready returns 200 only when at least one tunnel
+          # connection is active. Cloudflare rotates edge connections
+          # periodically, so transient /ready failures are expected and
+          # cloudflared reconnects on its own. We therefore drop livenessProbe
+          # (which was killing healthy pods on every reconnect) and rely on
+          # startupProbe for first-connect tolerance plus readinessProbe for
+          # rolling-deploy gating.
+          startupProbe:
             httpGet:
-              # Cloudflared has a /ready endpoint which returns 200 if and only if
-              # it has an active connection to Cloudflare's network.
               path: /ready
               port: 2000
-            failureThreshold: 1
-            initialDelaySeconds: 10
             periodSeconds: 10
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 2000
+            periodSeconds: 10
+            failureThreshold: 3

helm-chart/values.yaml

@@ -19,6 +19,16 @@ paperdebuggerXtraMcpServer:
 nodeSelector: {}
 cloudflareNodeSelector: {}
 
+cloudflared:
+  image: cloudflare/cloudflared:2026.5.0
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 500m
+      memory: 256Mi
+
 mongo:
   in_cluster: true
   uri: "" # if in_cluster is false, use the external mongo instead