viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Remove all CPU limits cluster-wide to eliminate CFS throttling

Browse source 
CPU limits cause CFS throttling even when nodes have idle capacity.
Move to a request-only CPU model: keep CPU requests for scheduling
fairness but remove all CPU limits. Memory limits stay (incompressible).

Changes across 108 files:
- Kyverno LimitRange policy: remove cpu from default/max in all 6 tiers
- Kyverno ResourceQuota policy: remove limits.cpu from all 5 tiers
- Custom ResourceQuotas: remove limits.cpu from 8 namespace quotas
- Custom LimitRanges: remove cpu from default/max (nextcloud, onlyoffice)
- RBAC module: remove cpu_limits variable and quota reference
- Freedify factory: remove cpu_limit variable and limits reference
- 86 deployment files: remove cpu from all limits blocks
- 6 Helm values files: remove cpu under limits sections
This commit is contained in:
Viktor Barzin 2026-03-14 08:51:45 +00:00
parent 120f83ce93
commit b00f810d3d
108 changed files with 609 additions and 435 deletions
Download patch file Download diff file Expand all files Collapse all files

161
stacks/tor-proxy/main.tf
View file

@ -1,7 +1,8 @@
variable "tls_secret_name" {
type = string
type = string
sensitive = true
}
variable "nfs_server" { type = string }
resource "kubernetes_namespace" "tor-proxy" {
@ -82,7 +83,6 @@ resource "kubernetes_deployment" "tor-proxy" {
memory = "64Mi"
}
limits = {
cpu = "150m"
memory = "256Mi"
}
}
@ -126,3 +126,160 @@ resource "kubernetes_service" "tor-proxy" {
}
}
}
# --- TorrServer ---
module "nfs_torrserver_data" {
source = "../../modules/kubernetes/nfs_volume"
name = "tor-proxy-torrserver-data"
namespace = kubernetes_namespace.tor-proxy.metadata[0].name
nfs_server = var.nfs_server
nfs_path = "/mnt/main/tor-proxy/torrserver"
}
resource "kubernetes_deployment" "torrserver" {
metadata {
name = "torrserver"
namespace = kubernetes_namespace.tor-proxy.metadata[0].name
labels = {
app = "torrserver"
tier = local.tiers.aux
}
}
spec {
replicas = 1
strategy {
type = "Recreate"
}
selector {
match_labels = {
app = "torrserver"
}
}
template {
metadata {
labels = {
app = "torrserver"
}
}
spec {
container {
name = "torrserver"
image = "ghcr.io/yourok/torrserver:MatriX.141"
port {
name = "http"
container_port = 8090
protocol = "TCP"
}
resources {
requests = {
cpu = "100m"
memory = "256Mi"
}
limits = {
memory = "1Gi"
}
}
readiness_probe {
http_get {
path = "/echo"
port = 8090
}
initial_delay_seconds = 5
period_seconds = 10
}
liveness_probe {
http_get {
path = "/echo"
port = 8090
}
initial_delay_seconds = 15
period_seconds = 30
}
volume_mount {
name = "torrserver-data"
mount_path = "/opt/ts"
}
}
volume {
name = "torrserver-data"
persistent_volume_claim {
claim_name = module.nfs_torrserver_data.claim_name
}
}
}
}
}
}
resource "kubernetes_service" "torrserver" {
metadata {
name = "torrserver"
namespace = kubernetes_namespace.tor-proxy.metadata[0].name
labels = {
"app" = "torrserver"
}
}
spec {
selector = {
app = "torrserver"
}
port {
name = "http"
port = 8090
target_port = 8090
}
}
}
# Expose BT peer port for better torrent connectivity
resource "kubernetes_service" "torrserver-bt" {
metadata {
name = "torrserver-bt"
namespace = kubernetes_namespace.tor-proxy.metadata[0].name
labels = {
app = "torrserver-bt"
}
annotations = {
"metallb.universe.tf/allow-shared-ip" = "shared"
}
}
spec {
type = "LoadBalancer"
external_traffic_policy = "Cluster"
selector = {
app = "torrserver"
}
port {
name = "bt-tcp"
port = 5665
target_port = 5665
protocol = "TCP"
}
port {
name = "bt-udp"
port = 5665
target_port = 5665
protocol = "UDP"
}
}
}
module "torrserver_ingress" {
source = "../../modules/kubernetes/ingress_factory"
namespace = kubernetes_namespace.tor-proxy.metadata[0].name
name = "torrserver"
tls_secret_name = var.tls_secret_name
port = "8090"
protected = true
extra_annotations = {
"gethomepage.dev/enabled" = "true"
"gethomepage.dev/name" = "TorrServer"
"gethomepage.dev/description" = "Torrent streaming server"
"gethomepage.dev/icon" = "torrserver.png"
"gethomepage.dev/group" = "Media & Entertainment"
"gethomepage.dev/pod-selector" = ""
}
}