From 5d30d427351b564228bdb7a172fa5a4abc7773de Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 25 Jul 2026 18:18:42 +1000
Subject: [PATCH] Add VPA recommender (advise mode) to vpa-system

---
 apps/base/vpa-system/deployment.yaml    |  59 ++++++++++
 apps/base/vpa-system/kustomization.yaml |   5 +-
 apps/base/vpa-system/rbac.yaml          | 139 ++++++++++++++++++++++++
 3 files changed, 201 insertions(+), 2 deletions(-)
 create mode 100644 apps/base/vpa-system/deployment.yaml
 create mode 100644 apps/base/vpa-system/rbac.yaml

diff --git a/apps/base/vpa-system/deployment.yaml b/apps/base/vpa-system/deployment.yaml
new file mode 100644
index 0000000..e6e9bf0
--- /dev/null
+++ b/apps/base/vpa-system/deployment.yaml
@@ -0,0 +1,59 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vpa-recommender
+  namespace: vpa-system
+  labels:
+    app.kubernetes.io/name: vpa-recommender
+    app.kubernetes.io/component: recommender
+    app.kubernetes.io/version: "1.7.0"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: vpa-recommender
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: vpa-recommender
+        app.kubernetes.io/component: recommender
+    spec:
+      serviceAccountName: vpa-recommender
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+      containers:
+        - name: recommender
+          image: registry.k8s.io/autoscaling/vpa-recommender:1.7.0
+          args:
+            - --pod-recommendation-min-cpu-millicores=15
+            - --pod-recommendation-min-memory-mb=100
+            - --v=2
+          ports:
+            - containerPort: 8942
+              name: metrics
+          livenessProbe:
+            httpGet:
+              path: /health-check
+              port: metrics
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /health-check
+              port: metrics
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 50m
+              memory: 500Mi
+            limits:
+              cpu: 500m
+              memory: 1000Mi
diff --git a/apps/base/vpa-system/kustomization.yaml b/apps/base/vpa-system/kustomization.yaml
index 8c31f43..7b3e16d 100644
--- a/apps/base/vpa-system/kustomization.yaml
+++ b/apps/base/vpa-system/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
   # VPA CRDs (verticalpodautoscalers + verticalpodautoscalercheckpoints) from
   # the kubernetes/autoscaler repo at the pinned release tag, served through the
   # artifactapi github remote (pattern allowlisted in terraform-artifactapi#14).
-  # The recommender deployment lands separately once these CRDs (and their
-  # kubeconform schemas under schemas/autoscaling.k8s.io/) are in.
+  # Their kubeconform schemas live under schemas/autoscaling.k8s.io/.
   - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/kubernetes/autoscaler/raw/vertical-pod-autoscaler-1.7.0/vertical-pod-autoscaler/deploy/vpa-v1-crd-gen.yaml
+  - rbac.yaml
+  - deployment.yaml
diff --git a/apps/base/vpa-system/rbac.yaml b/apps/base/vpa-system/rbac.yaml
new file mode 100644
index 0000000..b79fa6c
--- /dev/null
+++ b/apps/base/vpa-system/rbac.yaml
@@ -0,0 +1,139 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vpa-recommender
+  namespace: vpa-system
+---
+# Read pods from the metrics API (metrics-server) to build recommendations.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vpa-system:metrics-reader
+rules:
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+---
+# Watch pods/nodes/limitranges and VPA objects; emit events.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vpa-system:actor
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "limitranges"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["", "events.k8s.io"]
+    resources: ["events"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: ["autoscaling.k8s.io"]
+    resources: ["verticalpodautoscalers"]
+    verbs: ["get", "list", "watch"]
+---
+# Write recommendations back to the VPA object's status subresource.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vpa-system:status-actor
+rules:
+  - apiGroups: ["autoscaling.k8s.io"]
+    resources: ["verticalpodautoscalers/status"]
+    verbs: ["get", "patch"]
+---
+# Manage recommender checkpoints (recovery of history after restart).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vpa-system:checkpoint-actor
+rules:
+  - apiGroups: ["autoscaling.k8s.io"]
+    resources: ["verticalpodautoscalercheckpoints"]
+    verbs: ["get", "list", "watch", "create", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "list"]
+---
+# Resolve VPA targetRef workloads and their scale subresource.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vpa-system:target-reader
+rules:
+  - apiGroups: ["*"]
+    resources: ["*/scale"]
+    verbs: ["get", "watch"]
+  - apiGroups: [""]
+    resources: ["replicationcontrollers"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["jobs", "cronjobs"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vpa-system:metrics-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vpa-system:metrics-reader
+subjects:
+  - kind: ServiceAccount
+    name: vpa-recommender
+    namespace: vpa-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vpa-system:actor
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vpa-system:actor
+subjects:
+  - kind: ServiceAccount
+    name: vpa-recommender
+    namespace: vpa-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vpa-system:status-actor
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vpa-system:status-actor
+subjects:
+  - kind: ServiceAccount
+    name: vpa-recommender
+    namespace: vpa-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vpa-system:checkpoint-actor
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vpa-system:checkpoint-actor
+subjects:
+  - kind: ServiceAccount
+    name: vpa-recommender
+    namespace: vpa-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vpa-system:target-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vpa-system:target-reader
+subjects:
+  - kind: ServiceAccount
+    name: vpa-recommender
+    namespace: vpa-system