viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[ci skip] VPA: reduce LimitRange defaults, add overcommit check, protect tier-0

Browse source 
- Reduce Kyverno LimitRange default limits ~4x across all tiers to fix
  800-900% memory overcommitment on worker nodes
- Add cluster health check #25: per-node resource overcommitment
  showing requests and limits vs allocatable capacity
- Add Kyverno policy for Goldilocks VPA mode by tier: tier-0 namespaces
  get VPA Off mode (recommend only, no evictions) to prevent downtime
  on critical infra (traefik, cloudflared, authentik, technitium, etc.)
- Non-tier-0 namespaces get VPA Auto mode for active right-sizing
This commit is contained in:
Viktor Barzin 2026-02-26 23:15:43 +00:00
parent 250f805c32
commit 69c4c0c76e
3 changed files with 242 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

52
stacks/platform/modules/kyverno/resource-governance.tf
View file

@ -117,16 +117,16 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "2"
memory = "4Gi"
cpu = "500m"
memory = "512Mi"
}
defaultRequest = {
cpu = "100m"
memory = "128Mi"
cpu = "50m"
memory = "64Mi"
}
max = {
cpu = "8"
memory = "16Gi"
cpu = "4"
memory = "8Gi"
}
}
]
@ -163,16 +163,16 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "2"
memory = "4Gi"
cpu = "500m"
memory = "512Mi"
}
defaultRequest = {
cpu = "100m"
memory = "128Mi"
cpu = "50m"
memory = "64Mi"
}
max = {
cpu = "4"
memory = "8Gi"
cpu = "2"
memory = "4Gi"
}
}
]
@ -209,8 +209,8 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "4"
memory = "8Gi"
cpu = "1"
memory = "2Gi"
}
defaultRequest = {
cpu = "100m"
@ -255,16 +255,16 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "1"
memory = "2Gi"
cpu = "250m"
memory = "256Mi"
}
defaultRequest = {
cpu = "50m"
memory = "128Mi"
cpu = "25m"
memory = "64Mi"
}
max = {
cpu = "4"
memory = "8Gi"
cpu = "2"
memory = "4Gi"
}
}
]
@ -301,8 +301,8 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "500m"
memory = "1Gi"
cpu = "250m"
memory = "256Mi"
}
defaultRequest = {
cpu = "25m"
@ -363,16 +363,16 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "500m"
memory = "1Gi"
cpu = "250m"
memory = "256Mi"
}
defaultRequest = {
cpu = "25m"
memory = "64Mi"
}
max = {
cpu = "2"
memory = "4Gi"
cpu = "1"
memory = "2Gi"
}
}
]

90
stacks/platform/modules/vpa/main.tf
View file

@ -84,3 +84,93 @@ module "ingress" {
depends_on = [helm_release.goldilocks]
}
# -----------------------------------------------------------------------------
# Kyverno policy — label namespaces for VPA mode by tier
# -----------------------------------------------------------------------------
# Goldilocks reads the goldilocks.fairwinds.com/vpa-update-mode label on
# namespaces to decide the updateMode for VPA objects it creates.
# Tier 0-core gets "off" (recommend only — these are critical infra where
# evictions cause downtime). All other namespaces get "auto".
resource "kubernetes_manifest" "vpa_auto_mode_label" {
manifest = {
apiVersion = "kyverno.io/v1"
kind = "ClusterPolicy"
metadata = {
name = "goldilocks-vpa-auto-mode"
annotations = {
"policies.kyverno.io/title" = "Goldilocks VPA Mode by Tier"
"policies.kyverno.io/description" = "Sets VPA update mode per namespace: Off for tier-0 critical infra (no evictions), Auto for all others."
}
}
spec = {
rules = [
# Tier 0-core: recommend only, never evict
{
name = "label-vpa-off-tier-0"
match = {
any = [
{
resources = {
kinds = ["Namespace"]
selector = {
matchLabels = {
tier = "0-core"
}
}
}
}
]
}
mutate = {
patchStrategicMerge = {
metadata = {
labels = {
"goldilocks.fairwinds.com/vpa-update-mode" = "off"
}
}
}
}
},
# All other namespaces: auto mode
{
name = "label-vpa-auto-default"
match = {
any = [
{
resources = {
kinds = ["Namespace"]
}
}
]
}
exclude = {
any = [
{
resources = {
selector = {
matchLabels = {
tier = "0-core"
}
}
}
}
]
}
mutate = {
patchStrategicMerge = {
metadata = {
labels = {
"goldilocks.fairwinds.com/vpa-update-mode" = "auto"
}
}
}
}
},
]
}
}
depends_on = [helm_release.goldilocks]
}