infra/stacks/osm_routing/main.tf
Viktor Barzin ca648ff9bb
[ci skip] right-size all pod resources based on VPA + live metrics audit
Full cluster resource audit: cross-referenced Goldilocks VPA recommendations,
live kubectl top metrics, and Terraform definitions for 100+ containers.

Critical fixes:
- dashy: CPU throttled at 98% (490m/500m) → 2 CPU limit
- stirling-pdf: CPU throttled at 99.7% (299m/300m) → 2 CPU limit
- traefik auth-proxy/bot-block-proxy: mem limit 32Mi → 128Mi

Added explicit resources to ~40 containers that had none:
- audiobookshelf, changedetection, cyberchef, dawarich, diun, echo,
  excalidraw, freshrss, hackmd, isponsorblocktv, linkwarden, n8n,
  navidrome, ntfy, owntracks, privatebin, send, shadowsocks, tandoor,
  tor-proxy, wealthfolio, networking-toolbox, rybbit, mailserver,
  cloudflared, pgadmin, phpmyadmin, crowdsec-web, xray, wireguard,
  k8s-portal, tuya-bridge, ollama-ui, whisper, piper, immich-server,
  immich-postgresql, osrm-foot

GPU containers: added CPU/mem alongside GPU limits:
- ollama: removed CPU/mem limits (models vary in size), keep GPU only
- frigate: req 500m/2Gi, lim 4/8Gi + GPU
- immich-ml: req 100m/1Gi, lim 2/4Gi + GPU

Right-sized ~25 over-provisioned containers:
- kms-web-page: 500m/512Mi → 50m/64Mi (was using 0m/10Mi)
- onlyoffice: CPU 8 → 2 (VPA upper 45m)
- realestate-crawler-api: CPU 2000m → 250m
- blog/travel-blog/webhook-handler: 500m → 100m
- coturn/health/plotting-book: reduced to match actual usage

Conservative methodology: limits = max(VPA upper * 2, live usage * 2)
2026-03-01 19:18:50 +00:00

249 lines
5.1 KiB
HCL

variable "tls_secret_name" { type = string }
variable "nfs_server" { type = string }
resource "kubernetes_namespace" "osm-routing" {
metadata {
name = "osm-routing"
labels = {
"istio-injection" : "disabled"
tier = local.tiers.aux
}
}
}
# --- OSRM Foot ---
resource "kubernetes_deployment" "osrm-foot" {
metadata {
name = "osrm-foot"
namespace = kubernetes_namespace.osm-routing.metadata[0].name
labels = {
app = "osrm-foot"
tier = local.tiers.aux
}
}
spec {
replicas = 1
strategy {
type = "Recreate"
}
selector {
match_labels = {
app = "osrm-foot"
}
}
template {
metadata {
labels = {
app = "osrm-foot"
}
}
spec {
container {
name = "osrm-foot"
image = "ghcr.io/project-osrm/osrm-backend:latest"
command = ["osrm-routed", "--algorithm", "MLD", "/data/foot/greater-london-latest.osrm"]
port {
name = "http"
container_port = 5000
protocol = "TCP"
}
volume_mount {
name = "osrm-data"
mount_path = "/data"
}
resources {
requests = {
cpu = "15m"
memory = "256Mi"
}
limits = {
cpu = "100m"
memory = "1Gi"
}
}
}
volume {
name = "osrm-data"
nfs {
server = var.nfs_server
path = "/mnt/main/osm-routing/osrm-data"
}
}
}
}
}
}
resource "kubernetes_service" "osrm-foot" {
metadata {
name = "osrm-foot"
namespace = kubernetes_namespace.osm-routing.metadata[0].name
labels = {
app = "osrm-foot"
}
}
spec {
selector = {
app = "osrm-foot"
}
port {
port = 5000
target_port = 5000
}
}
}
# --- OSRM Bicycle ---
resource "kubernetes_deployment" "osrm-bicycle" {
metadata {
name = "osrm-bicycle"
namespace = kubernetes_namespace.osm-routing.metadata[0].name
labels = {
app = "osrm-bicycle"
tier = local.tiers.aux
}
}
spec {
replicas = 1
strategy {
type = "Recreate"
}
selector {
match_labels = {
app = "osrm-bicycle"
}
}
template {
metadata {
labels = {
app = "osrm-bicycle"
}
}
spec {
container {
name = "osrm-bicycle"
image = "ghcr.io/project-osrm/osrm-backend:latest"
command = ["osrm-routed", "--algorithm", "MLD", "/data/bicycle/greater-london-latest.osrm"]
port {
name = "http"
container_port = 5000
protocol = "TCP"
}
volume_mount {
name = "osrm-data"
mount_path = "/data"
}
resources {
requests = {
cpu = "15m"
memory = "256Mi"
}
limits = {
cpu = "100m"
memory = "1Gi"
}
}
}
volume {
name = "osrm-data"
nfs {
server = var.nfs_server
path = "/mnt/main/osm-routing/osrm-data"
}
}
}
}
}
}
resource "kubernetes_service" "osrm-bicycle" {
metadata {
name = "osrm-bicycle"
namespace = kubernetes_namespace.osm-routing.metadata[0].name
labels = {
app = "osrm-bicycle"
}
}
spec {
selector = {
app = "osrm-bicycle"
}
port {
port = 5000
target_port = 5000
}
}
}
# --- OTP (OpenTripPlanner) ---
resource "kubernetes_deployment" "otp" {
metadata {
name = "otp"
namespace = kubernetes_namespace.osm-routing.metadata[0].name
labels = {
app = "otp"
tier = local.tiers.aux
}
}
spec {
replicas = 0 # Scaled down: TfL GTFS data expired, OTP crash-loops on build
strategy {
type = "Recreate"
}
selector {
match_labels = {
app = "otp"
}
}
template {
metadata {
labels = {
app = "otp"
}
}
spec {
container {
name = "otp"
image = "opentripplanner/opentripplanner:2.6.0"
args = ["--build", "--save"]
port {
name = "http"
container_port = 8080
protocol = "TCP"
}
volume_mount {
name = "otp-data"
mount_path = "/var/opentripplanner"
}
}
volume {
name = "otp-data"
nfs {
server = var.nfs_server
path = "/mnt/main/osm-routing/otp-data"
}
}
}
}
}
}
resource "kubernetes_service" "otp" {
metadata {
name = "otp"
namespace = kubernetes_namespace.osm-routing.metadata[0].name
labels = {
app = "otp"
}
}
spec {
selector = {
app = "otp"
}
port {
port = 8080
target_port = 8080
}
}
}