unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Add advise-mode VPA for every workload #283

Merged
benvin merged 1 commits from benvin/vpa-advise-all into main 2026-07-25 18:30:24 +10:00
Conversation 0 Commits 1 Files Changed 22
+253
unkinben commented 2026-07-25 17:09:49 +10:00
Owner
Copy Link
Copy Source

Why

Turns on right-sizing telemetry for the whole estate. Adds a VerticalPodAutoscaler with updateMode: "Off" (recommendation-only, advise mode) for every Deployment and StatefulSet in apps/base. Off mode never evicts or mutates pods, so this is purely observational: the VPA recommender (added in the vpa-system PR) publishes suggested requests/limits in each VPA's status, and nothing acts on them until someone deliberately flips a mode.

Changes

  • Add one vpa.yaml per app under apps/base/<app>/ containing a <workload>-vpa VerticalPodAutoscaler for each workload, and register it in that app's kustomization.yaml.
  • Coverage: 17 workloads across 11 apps.
    • age-api (age-api), artifactapi (api, redis, ui), authentik (redis), bind-system (bind-operator), cephrgw-system (cephrgw-operator), encapi (encapi), kanidm (kanidm StatefulSet), litellm (litellm, redis), paperclip (paperclip), pdbmux (pdbmux), puppet (puppetboard, puppetdb, puppetserver-compiler, puppetserver-master).

Skipped (intentionally)

  • CNPG Cluster objects (artifactapi, authentik, encapi, grafana, litellm, paperclip, puppet, woodpecker) — Postgres is managed by CloudNativePG, not a VPA target.
  • CronJobs (puppet g10k/generate-types, reposync x4) — not VPA-able.

HPA / VPA caveat

api, ui (artifactapi), litellm, and all four puppet deployments also carry an HPA. With updateMode: "Off" there is no conflict today (VPA only recommends). VPA objects targeting these carry an inline comment: do not flip to Auto/Initial while the HPA still autoscales on CPU/memory, or the two controllers will fight over the same resource. Move the HPA to a custom/non-resource metric first.

Verification

  • kubectl kustomize over every touched overlay: 9/11 overlays PASS rendering all their VPAs; 2 failures are pre-existing and unrelated to this change — authentik fails on a local helm-tooling flag error identically on origin/main, and paperclip has no apps/overlays/au-syd1/paperclip directory yet. Both apps' base kustomizations build clean and render their VPA.

Merge gate

  • Requires the vpa-system CRDs PR (argocd-apps #281) to merge first. These manifests use autoscaling.k8s.io/v1 VerticalPodAutoscaler; without the CRDs installed, ArgoCD sync fails on an unknown kind.
## Why Turns on right-sizing telemetry for the whole estate. Adds a `VerticalPodAutoscaler` with `updateMode: "Off"` (recommendation-only, advise mode) for every Deployment and StatefulSet in `apps/base`. Off mode never evicts or mutates pods, so this is purely observational: the VPA recommender (added in the vpa-system PR) publishes suggested requests/limits in each VPA's status, and nothing acts on them until someone deliberately flips a mode. ## Changes - Add one `vpa.yaml` per app under `apps/base/<app>/` containing a `<workload>-vpa` VerticalPodAutoscaler for each workload, and register it in that app's `kustomization.yaml`. - Coverage: 17 workloads across 11 apps. - age-api (age-api), artifactapi (api, redis, ui), authentik (redis), bind-system (bind-operator), cephrgw-system (cephrgw-operator), encapi (encapi), kanidm (kanidm StatefulSet), litellm (litellm, redis), paperclip (paperclip), pdbmux (pdbmux), puppet (puppetboard, puppetdb, puppetserver-compiler, puppetserver-master). ## Skipped (intentionally) - **CNPG `Cluster` objects** (artifactapi, authentik, encapi, grafana, litellm, paperclip, puppet, woodpecker) — Postgres is managed by CloudNativePG, not a VPA target. - **CronJobs** (puppet g10k/generate-types, reposync x4) — not VPA-able. ## HPA / VPA caveat api, ui (artifactapi), litellm, and all four puppet deployments also carry an HPA. With `updateMode: "Off"` there is no conflict today (VPA only recommends). VPA objects targeting these carry an inline comment: do **not** flip to `Auto`/`Initial` while the HPA still autoscales on CPU/memory, or the two controllers will fight over the same resource. Move the HPA to a custom/non-resource metric first. ## Verification - `kubectl kustomize` over every touched overlay: 9/11 overlays PASS rendering all their VPAs; 2 failures are pre-existing and unrelated to this change — `authentik` fails on a local helm-tooling flag error identically on origin/main, and `paperclip` has no `apps/overlays/au-syd1/paperclip` directory yet. Both apps' base kustomizations build clean and render their VPA. ## Merge gate - **Requires the vpa-system CRDs PR (argocd-apps #281) to merge first.** These manifests use `autoscaling.k8s.io/v1 VerticalPodAutoscaler`; without the CRDs installed, ArgoCD sync fails on an unknown kind.
unkinben added 1 commit 2026-07-25 17:09:49 +10:00
Add advise-mode VerticalPodAutoscaler for every workload
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
657d087ccd 
Adds a VerticalPodAutoscaler (updateMode: Off, recommendation-only) targeting
every Deployment and StatefulSet across apps/base. Off mode never mutates pods,
so this only gathers right-sizing recommendations. CNPG Clusters and CronJobs
are not VPA targets and are skipped.
benvin merged commit 1d87c42fc1 into main 2026-07-25 18:30:24 +10:00
benvin deleted branch benvin/vpa-advise-all 2026-07-25 18:30:24 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#283
Delete Branch "benvin/vpa-advise-all"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?