194281e527
Phase 1 - Quick wins (~4.5 Gi saved): - democratic-csi: add explicit sidecar resources (64-80Mi vs 256Mi LimitRange default) - caretta: 768Mi → 600Mi (VPA upper 485Mi) - immich-ml: 4Gi → 3584Mi (VPA upper 2.95Gi, GPU margin) - onlyoffice: 3Gi → 2304Mi (VPA upper 1.82Gi) Phase 2 - Safety fixes (prevent OOMKills): - frigate: 2Gi/8Gi → 5Gi/10Gi (VPA upper 7.7Gi, was 4% headroom) - openclaw: 1280Mi req → 2Gi req=limit (documented 2Gi requirement) Phase 3 - Additional right-sizing: - authentik workers: 1Gi → 896Mi x3 (VPA upper 722Mi) - shlink: 512Mi/768Mi → 960Mi req=limit (VPA upper 780Mi, safety increase) Phase 4 - Burstable QoS for lower tiers: - tier-3-edge: 128Mi/128Mi → 96Mi req / 192Mi limit - tier-4-aux: 128Mi/128Mi → 64Mi req / 256Mi limit Phase 5 - Monitoring: - Add ClusterMemoryRequestsHigh alert (>85% allocatable, 15m) - Add ContainerNearOOM alert (>85% limit, 30m) - Add PodUnschedulable alert (5m, critical) Cluster: 92.7% → 90.8% memory requests. Stirling-pdf now schedulable.
63 lines
1.4 KiB
YAML
63 lines
1.4 KiB
YAML
authentik:
|
|
log_level: warning
|
|
# log_level: trace
|
|
secret_key: "${secret_key}"
|
|
# This sends anonymous usage-data, stack traces on errors and
|
|
# performance data to authentik.error-reporting.a7k.io, and is fully opt-in
|
|
error_reporting:
|
|
enabled: true
|
|
postgresql:
|
|
# host: postgresql.dbaas
|
|
host: pgbouncer.authentik
|
|
port: 6432
|
|
user: authentik
|
|
password: ${postgres_password}
|
|
redis:
|
|
host: ${redis_host}
|
|
|
|
server:
|
|
replicas: 3
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 1Gi
|
|
limits:
|
|
memory: 1Gi
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: server
|
|
ingress:
|
|
enabled: false
|
|
# hosts:
|
|
# - authentik.viktorbarzin.me
|
|
podAnnotations:
|
|
diun.enable: true
|
|
diun.include_tags: "^202[0-9].[0-9]+.*$" # no need to annotate the worker as it uses the same image
|
|
pdb:
|
|
enabled: true
|
|
minAvailable: 2
|
|
global:
|
|
addPrometheusAnnotations: true
|
|
|
|
worker:
|
|
replicas: 3
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 896Mi
|
|
limits:
|
|
memory: 896Mi
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: worker
|
|
pdb:
|
|
enabled: true
|
|
maxUnavailable: 1
|