viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[ci skip] VPA: reduce LimitRange defaults, add overcommit check, protect tier-0

Browse source 
- Reduce Kyverno LimitRange default limits ~4x across all tiers to fix
  800-900% memory overcommitment on worker nodes
- Add cluster health check #25: per-node resource overcommitment
  showing requests and limits vs allocatable capacity
- Add Kyverno policy for Goldilocks VPA mode by tier: tier-0 namespaces
  get VPA Off mode (recommend only, no evictions) to prevent downtime
  on critical infra (traefik, cloudflared, authentik, technitium, etc.)
- Non-tier-0 namespaces get VPA Auto mode for active right-sizing
This commit is contained in:
Viktor Barzin 2026-02-26 23:15:43 +00:00
parent 250f805c32
commit 69c4c0c76e
3 changed files with 242 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

52
stacks/platform/modules/kyverno/resource-governance.tf
View file

@ -117,16 +117,16 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "2"
memory = "4Gi"
cpu = "500m"
memory = "512Mi"
}
defaultRequest = {
cpu = "100m"
memory = "128Mi"
cpu = "50m"
memory = "64Mi"
}
max = {
cpu = "8"
memory = "16Gi"
cpu = "4"
memory = "8Gi"
}
}
]
@ -163,16 +163,16 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "2"
memory = "4Gi"
cpu = "500m"
memory = "512Mi"
}
defaultRequest = {
cpu = "100m"
memory = "128Mi"
cpu = "50m"
memory = "64Mi"
}
max = {
cpu = "4"
memory = "8Gi"
cpu = "2"
memory = "4Gi"
}
}
]
@ -209,8 +209,8 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "4"
memory = "8Gi"
cpu = "1"
memory = "2Gi"
}
defaultRequest = {
cpu = "100m"
@ -255,16 +255,16 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "1"
memory = "2Gi"
cpu = "250m"
memory = "256Mi"
}
defaultRequest = {
cpu = "50m"
memory = "128Mi"
cpu = "25m"
memory = "64Mi"
}
max = {
cpu = "4"
memory = "8Gi"
cpu = "2"
memory = "4Gi"
}
}
]
@ -301,8 +301,8 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "500m"
memory = "1Gi"
cpu = "250m"
memory = "256Mi"
}
defaultRequest = {
cpu = "25m"
@ -363,16 +363,16 @@ resource "kubernetes_manifest" "generate_limitrange_by_tier" {
{
type = "Container"
default = {
cpu = "500m"
memory = "1Gi"
cpu = "250m"
memory = "256Mi"
}
defaultRequest = {
cpu = "25m"
memory = "64Mi"
}
max = {
cpu = "2"
memory = "4Gi"
cpu = "1"
memory = "2Gi"
}
}
]