unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Add vpa-system: VPA CRDs + recommender (advise mode) #281

Merged
benvin merged 1 commits from benvin/vpa into main 2026-07-25 18:26:16 +10:00
Conversation 4 Commits 1 Files Changed 3
+201 -2
unkinben commented 2026-07-25 17:06:53 +10:00
Owner
Copy Link
Copy Source

Why

Rolls out the Vertical Pod Autoscaler control plane so the estate can gather right-sizing recommendations for every workload (advise mode, follow-up PR adds the per-workload VPA objects). Deploys the recommender only: advise mode never mutates pods, so the updater and admission-controller (and its mutating webhook) are intentionally omitted — fewer moving parts, no webhook in the admission path.

Changes

  • Add apps/base/vpa-system/: namespace, VPA CRDs (verticalpodautoscalers + verticalpodautoscalercheckpoints) pulled from the kubernetes/autoscaler repo at the pinned tag (same upstream-raw pattern node-feature-discovery uses), recommender-scoped RBAC (SA + metrics-reader/actor/status-actor/checkpoint-actor/target-reader), and the recommender Deployment.
  • Add apps/overlays/au-syd1/vpa-system/ referencing the base.
  • Register apps/overlays/*/vpa-system in the platform ApplicationSet.

Notes

  • Pins upstream vertical-pod-autoscaler-1.7.0 (latest stable, 2026-05-29) for both CRDs and the registry.k8s.io/autoscaling/vpa-recommender:1.7.0 image.
  • No platform AppProject change needed: *-system namespace destination plus CustomResourceDefinition/ClusterRole/ClusterRoleBinding are already whitelisted.
  • The recommender image is pull-through-cached via terraform-artifactapi PR #13 (merge gate below).

Merge gate

  • Requires terraform-artifactapi PR #13 (adds the autoscaling/vpa- pattern to the k8s-registry docker remote) to land first so the recommender image is served through the cache.
## Why Rolls out the Vertical Pod Autoscaler control plane so the estate can gather right-sizing recommendations for every workload (advise mode, follow-up PR adds the per-workload VPA objects). Deploys the **recommender only**: advise mode never mutates pods, so the updater and admission-controller (and its mutating webhook) are intentionally omitted — fewer moving parts, no webhook in the admission path. ## Changes - Add `apps/base/vpa-system/`: namespace, VPA CRDs (verticalpodautoscalers + verticalpodautoscalercheckpoints) pulled from the kubernetes/autoscaler repo at the pinned tag (same upstream-raw pattern node-feature-discovery uses), recommender-scoped RBAC (SA + metrics-reader/actor/status-actor/checkpoint-actor/target-reader), and the recommender Deployment. - Add `apps/overlays/au-syd1/vpa-system/` referencing the base. - Register `apps/overlays/*/vpa-system` in the platform ApplicationSet. ## Notes - Pins upstream **vertical-pod-autoscaler-1.7.0** (latest stable, 2026-05-29) for both CRDs and the `registry.k8s.io/autoscaling/vpa-recommender:1.7.0` image. - No platform AppProject change needed: `*-system` namespace destination plus CustomResourceDefinition/ClusterRole/ClusterRoleBinding are already whitelisted. - The recommender image is pull-through-cached via terraform-artifactapi PR #13 (merge gate below). ## Merge gate - Requires terraform-artifactapi PR #13 (adds the `autoscaling/vpa-` pattern to the k8s-registry docker remote) to land first so the recommender image is served through the cache.
benvin reviewed 2026-07-25 17:28:25 +10:00
apps/base/vpa-system/kustomization.yaml Outdated
@@ -0,0 +8,4 @@
# directly from the kubernetes/autoscaler repo at the pinned release tag, the
# same upstream-raw pattern node-feature-discovery uses for its CRDs. Keeps the
# CRDs from drifting away from the recommender image version below.
- https://raw.githubusercontent.com/kubernetes/autoscaler/vertical-pod-autoscaler-1.7.0/vertical-pod-autoscaler/deploy/vpa-v1-crd-gen.yaml
benvin commented 2026-07-25 17:28:25 +10:00
Owner
Copy Link
Copy Source

this should come from artifactapi

this should come from artifactapi
benvin marked this conversation as resolved
benvin reviewed 2026-07-25 17:28:52 +10:00
apps/base/vpa-system/deployment.yaml Outdated
@@ -0,0 +25,4 @@
runAsUser: 65534
containers:
- name: recommender
image: registry.k8s.io/autoscaling/vpa-recommender:1.7.0
benvin commented 2026-07-25 17:28:52 +10:00
Owner
Copy Link
Copy Source

confirm we are redirecting this to artifactapi in the rancher config in puppet

confirm we are redirecting this to artifactapi in the rancher config in puppet
benvin marked this conversation as resolved
unkinben commented 2026-07-25 17:33:41 +10:00
Author
Owner
Copy Link
Copy Source

Both review comments addressed:

  1. CRDs now come from artifactapi: the github generic remote already proxies /raw/ paths, so terraform-artifactapi#14 allowlists the pinned autoscaler CRD file and this branch now fetches it at /api/v1/remote/github/kubernetes/autoscaler/raw/vertical-pod-autoscaler-1.7.0/.... Merge #14 (auto-applies) before this PR so the kustomize fetch resolves.

  2. Image redirect confirmed: puppet-prod hieradata/roles/infra/k8s.yaml rke2::registries mirrors registry.k8s.io -> artifactapi.k8s.syd1.au.unkin.net with rewrite k8s-registry/$1 and disable-default-registry-endpoint: true, and terraform-artifactapi#13 (merged) allowlisted autoscaling/vpa- in the k8s-registry remote — so the recommender image pull is cache-served by artifactapi on every node.

Both review comments addressed: 1. **CRDs now come from artifactapi**: the `github` generic remote already proxies `/raw/` paths, so terraform-artifactapi#14 allowlists the pinned autoscaler CRD file and this branch now fetches it at `/api/v1/remote/github/kubernetes/autoscaler/raw/vertical-pod-autoscaler-1.7.0/...`. Merge #14 (auto-applies) before this PR so the kustomize fetch resolves. 2. **Image redirect confirmed**: `puppet-prod hieradata/roles/infra/k8s.yaml` `rke2::registries` mirrors `registry.k8s.io` -> `artifactapi.k8s.syd1.au.unkin.net` with rewrite `k8s-registry/$1` and `disable-default-registry-endpoint: true`, and terraform-artifactapi#13 (merged) allowlisted `autoscaling/vpa-` in the k8s-registry remote — so the recommender image pull is cache-served by artifactapi on every node.
unkinben commented 2026-07-25 18:16:06 +10:00
Author
Owner
Copy Link
Copy Source

CRDs split out per review: #284 now carries the VPA CRDs plus generated kubeconform schemas (schemas/autoscaling.k8s.io/, both kinds, v1 + v1beta2, produced with the same transform as ci/generate-schemas.sh). This PR is now recommender-only.

New merge order: #284 (CRDs+schemas) -> this PR (#281, recommender) -> #283 (per-workload VPAs). A sample updateMode Off VPA validates against the new schemas with kubeconform.

CRDs split out per review: #284 now carries the VPA CRDs **plus generated kubeconform schemas** (schemas/autoscaling.k8s.io/, both kinds, v1 + v1beta2, produced with the same transform as ci/generate-schemas.sh). This PR is now recommender-only. New merge order: **#284 (CRDs+schemas) -> this PR (#281, recommender) -> #283 (per-workload VPAs)**. A sample updateMode Off VPA validates against the new schemas with kubeconform.
unkinben added 1 commit 2026-07-25 18:18:45 +10:00
Add VPA recommender (advise mode) to vpa-system
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
5d30d42735
unkinben force-pushed benvin/vpa from 368ecf1e33 to 5d30d42735 2026-07-25 18:18:45 +10:00 Compare
benvin merged commit 4d877531b0 into main 2026-07-25 18:26:16 +10:00
benvin deleted branch benvin/vpa 2026-07-25 18:26:16 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
benvin
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#281
Delete Branch "benvin/vpa"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?