viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[ci skip] right-size all pod resources based on VPA + live metrics audit

Browse source 
Full cluster resource audit: cross-referenced Goldilocks VPA recommendations,
live kubectl top metrics, and Terraform definitions for 100+ containers.

Critical fixes:
- dashy: CPU throttled at 98% (490m/500m) → 2 CPU limit
- stirling-pdf: CPU throttled at 99.7% (299m/300m) → 2 CPU limit
- traefik auth-proxy/bot-block-proxy: mem limit 32Mi → 128Mi

Added explicit resources to ~40 containers that had none:
- audiobookshelf, changedetection, cyberchef, dawarich, diun, echo,
  excalidraw, freshrss, hackmd, isponsorblocktv, linkwarden, n8n,
  navidrome, ntfy, owntracks, privatebin, send, shadowsocks, tandoor,
  tor-proxy, wealthfolio, networking-toolbox, rybbit, mailserver,
  cloudflared, pgadmin, phpmyadmin, crowdsec-web, xray, wireguard,
  k8s-portal, tuya-bridge, ollama-ui, whisper, piper, immich-server,
  immich-postgresql, osrm-foot

GPU containers: added CPU/mem alongside GPU limits:
- ollama: removed CPU/mem limits (models vary in size), keep GPU only
- frigate: req 500m/2Gi, lim 4/8Gi + GPU
- immich-ml: req 100m/1Gi, lim 2/4Gi + GPU

Right-sized ~25 over-provisioned containers:
- kms-web-page: 500m/512Mi → 50m/64Mi (was using 0m/10Mi)
- onlyoffice: CPU 8 → 2 (VPA upper 45m)
- realestate-crawler-api: CPU 2000m → 250m
- blog/travel-blog/webhook-handler: 500m → 100m
- coturn/health/plotting-book: reduced to match actual usage

Conservative methodology: limits = max(VPA upper * 2, live usage * 2)
This commit is contained in:
Viktor Barzin 2026-03-01 19:18:50 +00:00
parent ccf0b2232f
commit 9e4fb23b10
66 changed files with 590 additions and 128 deletions
Download patch file Download diff file Expand all files Collapse all files

10
stacks/platform/modules/cloudflared/main.tf
View file

@ -60,6 +60,16 @@ resource "kubernetes_deployment" "cloudflared" {
port {
container_port = 14333
}
resources {
requests = {
cpu = "15m"
memory = "32Mi"
}
limits = {
cpu = "200m"
memory = "256Mi"
}
}
}
dns_config {
option {

10
stacks/platform/modules/crowdsec/main.tf
View file

@ -159,6 +159,16 @@ resource "kubernetes_deployment" "crowdsec-web" {
container_port = 8000
protocol = "TCP"
}
resources {
requests = {
cpu = "15m"
memory = "32Mi"
}
limits = {
cpu = "250m"
memory = "256Mi"
}
}
}
dns_config {
option {

37
stacks/platform/modules/dbaas/main.tf
View file

@ -221,8 +221,8 @@ resource "kubernetes_service" "mysql" {
spec {
publish_not_ready_addresses = true # bypass InnoDB Cluster readiness gate during partial failures
selector = {
"component" = "mysqld"
"mysql.oracle.com/cluster" = "mysql-cluster"
"component" = "mysqld"
"mysql.oracle.com/cluster" = "mysql-cluster"
"mysql.oracle.com/cluster-role" = "PRIMARY"
}
port {
@ -477,6 +477,16 @@ resource "kubernetes_deployment" "phpmyadmin" {
name = "UPLOAD_LIMIT"
value = "300M"
}
resources {
requests = {
cpu = "15m"
memory = "32Mi"
}
limits = {
cpu = "250m"
memory = "256Mi"
}
}
}
dns_config {
option {
@ -763,12 +773,12 @@ module "ingress" {
# Ensure the CNPG cluster manifest exists (idempotent kubectl apply)
resource "null_resource" "pg_cluster" {
triggers = {
instances = "2"
image = "ghcr.io/cloudnative-pg/postgis:16"
storage_size = "20Gi"
storage_class = "local-path"
memory_limit = "4Gi"
cpu_limit = "2"
instances = "2"
image = "ghcr.io/cloudnative-pg/postgis:16"
storage_size = "20Gi"
storage_class = "local-path"
memory_limit = "4Gi"
cpu_limit = "2"
}
provisioner "local-exec" {
@ -900,6 +910,17 @@ resource "kubernetes_deployment" "pgadmin" {
mount_path = "/var/lib/pgadmin/"
}
resources {
requests = {
cpu = "25m"
memory = "128Mi"
}
limits = {
cpu = "500m"
memory = "512Mi"
}
}
}
volume {
name = "pgadmin"

10
stacks/platform/modules/k8s-portal/main.tf
View file

@ -66,6 +66,16 @@ resource "kubernetes_deployment" "k8s_portal" {
mount_path = "/config"
read_only = true
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
volume {

21
stacks/platform/modules/mailserver/main.tf
View file

@ -351,6 +351,17 @@ resource "kubernetes_deployment" "mailserver" {
}
}
resources {
requests = {
cpu = "25m"
memory = "128Mi"
}
limits = {
cpu = "500m"
memory = "512Mi"
}
}
}
container {
@ -370,6 +381,16 @@ resource "kubernetes_deployment" "mailserver" {
name = "var-run-dovecot"
mount_path = "/var/run/dovecot"
}
resources {
requests = {
cpu = "10m"
memory = "16Mi"
}
limits = {
cpu = "100m"
memory = "64Mi"
}
}
}
volume {

8
stacks/platform/modules/redis/main.tf
View file

@ -119,10 +119,10 @@ resource "kubernetes_service" "redis" {
}
spec {
selector = {
"app.kubernetes.io/component" = "node"
"app.kubernetes.io/instance" = "redis"
"app.kubernetes.io/name" = "redis"
"statefulset.kubernetes.io/pod-name" = "redis-node-0"
"app.kubernetes.io/component" = "node"
"app.kubernetes.io/instance" = "redis"
"app.kubernetes.io/name" = "redis"
"statefulset.kubernetes.io/pod-name" = "redis-node-0"
}
port {
name = "tcp-redis"

8
stacks/platform/modules/traefik/main.tf
View file

@ -380,11 +380,11 @@ resource "kubernetes_deployment" "bot_block_proxy" {
resources {
requests = {
cpu = "5m"
memory = "16Mi"
memory = "32Mi"
}
limits = {
cpu = "50m"
memory = "32Mi"
memory = "128Mi"
}
}
}
@ -569,11 +569,11 @@ resource "kubernetes_deployment" "auth_proxy" {
resources {
requests = {
cpu = "5m"
memory = "16Mi"
memory = "32Mi"
}
limits = {
cpu = "50m"
memory = "32Mi"
memory = "128Mi"
}
}
}

16
stacks/platform/modules/traefik/middleware.tf
View file

@ -150,14 +150,14 @@ resource "kubernetes_manifest" "middleware_crowdsec" {
spec = {
plugin = {
crowdsec-bouncer = {
crowdsecLapiKey = var.crowdsec_api_key
crowdsecLapiHost = "crowdsec-service.crowdsec.svc.cluster.local:8080"
crowdsecMode = "stream"
updateMaxFailure = -1 # fail-open: serve from cache when LAPI is unreachable
redisCacheEnabled = true
redisCacheHost = var.redis_host
redisCacheUnreachableBlock = false # don't block traffic if Redis is also unreachable
clientTrustedIPs = ["10.0.20.0/24", "10.10.0.0/16"] # node + pod CIDRs bypass CrowdSec
crowdsecLapiKey = var.crowdsec_api_key
crowdsecLapiHost = "crowdsec-service.crowdsec.svc.cluster.local:8080"
crowdsecMode = "stream"
updateMaxFailure = -1 # fail-open: serve from cache when LAPI is unreachable
redisCacheEnabled = true
redisCacheHost = var.redis_host
redisCacheUnreachableBlock = false # don't block traffic if Redis is also unreachable
clientTrustedIPs = ["10.0.20.0/24", "10.10.0.0/16"] # node + pod CIDRs bypass CrowdSec
}
}
}

6
stacks/platform/modules/vaultwarden/main.tf
View file

@ -56,11 +56,11 @@ resource "kubernetes_deployment" "vaultwarden" {
resources {
requests = {
cpu = "50m"
memory = "64Mi"
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "200m"
cpu = "100m"
memory = "256Mi"
}
}

20
stacks/platform/modules/wireguard/main.tf
View file

@ -141,6 +141,16 @@ resource "kubernetes_deployment" "wireguard" {
add = ["NET_ADMIN", "SYS_MODULE"]
}
}
resources {
requests = {
cpu = "10m"
memory = "16Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
container {
@ -162,6 +172,16 @@ resource "kubernetes_deployment" "wireguard" {
container_port = 9586
protocol = "TCP"
}
resources {
requests = {
cpu = "10m"
memory = "16Mi"
}
limits = {
cpu = "50m"
memory = "64Mi"
}
}
}
volume {
name = "wg0-key"

10
stacks/platform/modules/xray/main.tf
View file

@ -114,6 +114,16 @@ resource "kubernetes_deployment" "xray" {
mount_path = "/etc/xray/config.json"
sub_path = "config.json"
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
volume {