gitea,longhorn: update CPU limits, tolerations, replicas

2026-09-12 04:01:14 +00:00 · 2026-09-09 18:47:12 +02:00
parent f813170b86
commit 99880ab291
3 changed files with 38 additions and 104 deletions
@@ -44,17 +44,15 @@ statefulset:
                docker_timeout: 300s
                # Hard per-job caps (docker create args). Slightly below the
                # dind limits so the daemon and image cache keep headroom.
-                options: --memory=7g --cpus=3
+                options: --memory=7g --cpus=1
    dind:
        resources:
            requests:
                cpu: 250m
                memory: 512Mi
            limits:
-                cpu: 4
+                cpu: 1500m
                memory: 8Gi
-    # Same failover tolerations/affinity as the gitea release, so runners can
-    # be scheduled wherever Gitea itself runs (p330 during r740 outage).
    tolerations:
        - key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str]
          operator: Equal
@@ -25,61 +25,25 @@ valkey:
            limits:
                cpu: 500m
                memory: 512Mi
-        tolerations:
-            - key: ENC[AES256_GCM,data:fXEKv6sROAEz,iv:ausWhm1zJdx+Mu26pauhi5G+ODZqLZ27SmfkAuMUtYY=,tag:cNYyeG09Hk++uED5M0TBKw==,type:str]
-              operator: Equal
-              value: ENC[AES256_GCM,data:7CfH8Lrr7S0=,iv:dv5f/cN1VI2NLQsAYqF2hGEjVjxTnHGXFfNQyCL1KIc=,tag:HTiQN/wZU/mXSHvaz2KqRg==,type:str]
-              effect: NoSchedule
-            - key: ENC[AES256_GCM,data:2l4bXqCigZWkqfm6zvba/aOwC6zXYd0lufMUrrHA3YZm1/0IXw==,iv:70oryMEsl0nnZz1q4OHHHgjRswmyvLZI9Y6tk0elM5Q=,tag:2/EHDIcaDTSGWl3qRVW8oQ==,type:str]
-              operator: Exists
-              effect: NoSchedule
-        affinity:
-            nodeAffinity:
-                preferredDuringSchedulingIgnoredDuringExecution:
-                    - weight: 100
-                      preference:
-                        matchExpressions:
-                            - key: ENC[AES256_GCM,data:dc00KQOBXn587h22VlooFY5ZjbE=,iv:kX5utMKu8uoUSeameD2R0iH+DU/3YXuwP8DaZs9mGYs=,tag:PM5xBnYaP84zMZ2SWTYV+A==,type:str]
-                              operator: NotIn
-                              values:
-                                - "true"
 postgresql:
    enabled: true
    global:
        postgresql:
            auth:
-                postgressPassword: ENC[AES256_GCM,data:3aHXAFDqpYsWeg==,iv:qbrm+izSr+PaAa4fHMVw3Yz0qMuisRMpDxVKdeFSvls=,tag:zVUVALdIUTMhxavsSxlUCw==,type:str]
-                password: ENC[AES256_GCM,data:LCfnttYbxS34WA==,iv:rqU044P/gUmqjhmu+A9B7A64ujnkIhMpKQlYpcmi8MY=,tag:XJws85qfKI+y0BV6S4L1Ig==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:H0SYcVGHj1l7sw==,iv:g4wFhJYJHaLwjyB8yX0++EHCF8SPhpojV/Ga/EtIC/M=,tag:C/DDVuWWtkQIUZ6iKyae+Q==,type:str]
+                password: ENC[AES256_GCM,data:fg3kSvc4uoxItQ==,iv:5QpriMTHriIsU9DX5cC88TlBixIJrarE0fjqTHDYeQE=,tag:XdTEkDKnC8q82OYRwtOjVw==,type:str]
                database: gitea
-                username: ENC[AES256_GCM,data:QDo83dk=,iv:RvuuDiiY1XLZbrjcJ/ANxb/wHrSdf1gaBSck+cMaWhY=,tag:UCEAkWZ2Dmr93oBATQdf8g==,type:str]
+                username: ENC[AES256_GCM,data:IefT7eM=,iv:jdQ7avYStp2knOfIZsIgl8/MLlLWhfPjeiIQfFBu2aE=,tag:GkibjMLPyJSDQhvuq7b39g==,type:str]
    volumePermissions:
        enabled: true
    primary:
        resources:
            requests:
-                cpu: 250m
+                cpu: 100m
                memory: 256Mi
            limits:
-                cpu: 1000m
+                cpu: 500m
                memory: 1Gi
-        tolerations:
-            - key: ENC[AES256_GCM,data:NplaOmBekcB+,iv:qzQ+QasVZ2JMG87PgdVDJ/7XHDiDXTp+ogxB1w4tws4=,tag:aPyaqwdxVEjct7D3SuKFqw==,type:str]
-              operator: Equal
-              value: ENC[AES256_GCM,data:vjsM3Li0p/8=,iv:Y+sjLHWpqwsOJV+vygG2f/3ZXQs2ZQRloPrlcOuzoeM=,tag:t+uR2/uM4NiIq6alJjio9g==,type:str]
-              effect: NoSchedule
-            - key: ENC[AES256_GCM,data:LQvczGKAK2x1BbFr7S8jo0G7YUaX4DJvc+1Z2E+bCjys4PsBHg==,iv:m4Ses50zYxTF7jXTgbf9nY0kT1hrtgVEEQruLZFN8cU=,tag:UidEMRbb0IPb5V31FjWzYg==,type:str]
-              operator: Exists
-              effect: NoSchedule
-        affinity:
-            nodeAffinity:
-                preferredDuringSchedulingIgnoredDuringExecution:
-                    - weight: 100
-                      preference:
-                        matchExpressions:
-                            - key: ENC[AES256_GCM,data:D9N+Fd/g24bKikLdx4WE57WvqE4=,iv:+1oYCzAl6kBJliw0woWhhWT7aWcx4rXkGDn7Anho2Pg=,tag:R+cLK75QCIfWeGL8/eqeFA==,type:str]
-                              operator: NotIn
-                              values:
-                                - "true"
        livenessProbe:
            enabled: true
            initialDelaySeconds: 30
@@ -112,8 +76,8 @@ gitea:
    oauth:
        - name: Authentik
          provider: openidConnect
-          key: ENC[AES256_GCM,data:cYaRMEtrziMJWIRj3dg1fuMpp6F3t5ZDO/H2ONOQCg/fZ8s0ZsLb6Q==,iv:VskJ+5Rwpnys0nH531FYZIj253lJqDz1l6sgwKWhE1s=,tag:F3Wj1ruwSwlC5XbVKt1aCQ==,type:str]
-          secret: ENC[AES256_GCM,data:Cro9iaXKcv+uP4G6jEX0tPBW9cjxaZUmnLEVyE72j34aeAAmDFgPiTE/VWSbD3WWK8tuErl0RFHMvHiN63f4W5hq38W9VMP31JDCUYcUbkFBmQg2hrt6ePajZZICR1gHB3D7t5av4pl13O490VByGWfr8OxAK8Z/cGojp/Pt4mo=,iv:nRvFSVRSKFvpNjGmJq6uh/JV3acLsipV0nUHAlt+t80=,tag:BZ7eJiSVCM8J+MY+I5Z48g==,type:str]
+          key: ENC[AES256_GCM,data:xF20IE3CJp0+ONZsHNflB8JB/CcAUMcTvOcGvzWFW5S6PNnlsRyxfA==,iv:vvKzB6F0338YBoGcRrkSE8um7GEw+vpfjN4/q7knSbw=,tag:lZdPbtCZWYjVSMzirZcxOg==,type:str]
+          secret: ENC[AES256_GCM,data:pFzSaiUjB5OipMJ2jKkGXBxw9pHnjHsvAThm2AfzgBdIrSKhhWkoQkcrq5FcPnuYvEjuwVpPM9VddyocNOqnFuEdNY7RVsLEOzMSnFkNIl42qA2ze6tJhi6eaoODsYQcvyvdUnqCBxLF8qezP0huQQ7hRs26tUhbd+HBmfJnHhU=,iv:Lr05L9kwxqNyDiAswrSR120Qc056qAXu+Ld9nOHNxjM=,tag:NrkT67bNOCm5FL1NRYclvQ==,type:str]
          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
    config:
        APP_NAME: Gitea
@@ -142,55 +106,34 @@ gitea:
 # Resource limits for Gitea container
 resources:
    requests:
-        cpu: 250m
+        cpu: 100m
        memory: 512Mi
    limits:
-        cpu: 1000m
+        cpu: 500m
        memory: 1Gi
-# Increase replica count is not useful for 1-node cluster
 replicaCount: 1
-# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
-tolerations:
-    - key: ENC[AES256_GCM,data:1O2rrNCMxkGV,iv:dLwAP4NFVRZ0IUNzARm7hPq+ruIshtpXfUVtuuRP3/o=,tag:EmKs8LItQFLoPov8MMjfgw==,type:str]
-      operator: Equal
-      value: ENC[AES256_GCM,data:l0WXlDcRWaY=,iv:F3AxSbB9t/q3L6yOI4NcHlNzZrDwJqiJ/jjfLrQlNAE=,tag:6s/WqyWjNLHHmExGmgl65g==,type:str]
-      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:RtKkkyNv0zO/IezcKaBBp5Ir9mCBacgVqjFIGyq13U68sU4z5g==,iv:sFr2v6kFKOm2ID73GpxACTvQttvt7fYwg437N7D2Scg=,tag:aPCpFti/jY/0a1FEWF/g4w==,type:str]
-      operator: Exists
-      effect: NoSchedule
-affinity:
-    nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                    - key: ENC[AES256_GCM,data:jW8/VevqdIAXrBAMj58udice6HM=,iv:+6nTdgB2io+H6S/jyO4Fc/+VfoyGIY+dqphi6ZNIn3c=,tag:JKJveLWX8pjMN3cnO94UwQ==,type:str]
-                      operator: NotIn
-                      values:
-                        - "true"
-# (postgresql and valkey tolerations are set in their respective blocks above)
 sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:hb8HlzvsAU+6A2C4MARpF2j+Mv55mQ25SOjJIo6inV822IskVV+0Ml9I6WS8RK6ZNZAdnVcDtQ07JlGx9QRiIwxAE0xxwuhukhSBBjeHGAc39RPhLXhDvwUF5ZeouGixkVrA5lhAvHiu9ILv241G1st0J9qK/ZaIsTazQN4X3iY=,iv:1ehf3avfeV4Ro8rw0rsFQ0qnFXrvF66tUKqqCY+NXSc=,tag:5kXUpLrLGPbwNSBC+aVIwA==,type:str]
+    lastmodified: "2026-09-09T16:47:12Z"
+    mac: ENC[AES256_GCM,data:YxAiN7+KTLaKK++Yhl40uoC0KvWkRz5kYzpjcl1Vm3FbRh/lO817/meMdvOZzXGJhwzq2/6BLceJAK73BIFpVaeMueiMQyeGIk1BEfIYtJ6eLXY2cQRVkdPcJVDT4AmLNXDFRx9RvckIQiK2W8fEaEhYPvGp7W+6yZfM0ES1Xug=,iv:K00+4VnkjT6exM4/0KTM/Fm7lzSj1hzhzvnz+x/7DNo=,tag:oJzYz+5knokiBCkSetXllQ==,type:str]
    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
+        - created_at: "2026-09-09T16:47:12Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/9FF5SJAVg0dLi/+xQreE2yrxMH4GTfdBMHd3GWEVLYger
-            6XwXQ7+Qx3mxf+VprmNGOW7NdKSsC5Re/JHJAjs7p+eWohtieOgKtg7DWEcrTwZA
-            56Rnhtnh0vv2jqmv/pm/Cj49GCLTjQFY+w5azU7g/7eQZpdPezIdrs1ueiSm6LaU
-            T9bMdUzm1pb7/JKQMvzYyPcuw0AfKLlg+x7HHRNI3O434yKuTLC5emVxJEmwQvV4
-            FD6oUAt4gKLqUHvAUuCVo8O5G36MGHO/roHxlWaLbHqjaDPyWh2TGdX0ICKKq1yc
-            fJzw9dYgcwIMXpXilbnsL4gQpv6bKj6VniyCoye6ieMZ2HIoZghd+wL0NoPkS7Nj
-            D+vTcPR8HOEWoZkZ4B01+bFyTmJ5NA8Z0V3peHkuTy+HCTgwxA0Y8PCrHl3YHsCQ
-            C3nANhh+cMqtcJdvqdGrM09X8n3edNc4lf+qg2tk0NbcdVSqcFl9y/MeJOWhOOg3
-            T/bwBrI5O7aRO6gqaCebKuGIrD1PDNURW3LLiKBSU4OTYbMWWXGpdEMCkoSQS56B
-            6Uo9N8KcWhBChCMJG8hbzYRVwYgWGsHsQbfbujkcIiSaoHGy8fklflxBjtLiitLO
-            voawf0zSqyBKbf1YFAmYnrdR0jiasKC5iqtK7c8uc/HyCSvxjK0ygPloWFI8aSPS
-            XgFJiWHT/5gOG64XmDm0VoKdflpojJeTGIC5JU8RAlJgD/oq+uWt23ayJxkjbkMd
-            H7UsqcuzWfbp44MYtmEWbxvI/+Iaui5/7hW7kEzWI60Mh4tVZGIJ64A3WNRL/Xw=
-            =U5nI
+            hQIMA7uy4qQr71wiAQ//REJaQmN8Ue05KiM2nNc4/vwHudjHu6HuYgZEIPW7EEcR
+            XxjGRO+H4EW8h8ydkDW1sHK2k8Bh7wfD96sIML4cxGal23abBndy2jvnkpj99/NG
+            vQaobfedmgCnMRe323612D+JsZdA2LFEnppr8WHZpQVZV1M0IJjdow9p8uXo3omJ
+            arKXlTyOa7r1JdiFZ6Alj6aDMSAQ1vSqoZn3rclekjI7G1HUmupATWGDSi6KyrAc
+            sjQOXFkl7YdfF608oBcv/HwVvRRgV2ktNVDcLcDfNRJl1uTyG9PKwUSPAaDErUk4
+            2kvO6W+TV3PpEJTVEGwqwwfOlPPBo0Z31kooxmHNEWJ7TFLTgF4FJRe9tQlKAuXg
+            vOuLSHvk+0J/dmmimccxDCDpA/Uq1ZuGpPh0Lv+YnaMnVhp0kq/pZNJOsh48kqEd
+            xDGoh8ouPqrVfBQC/EQwegM3UinAiM62dGhBqfI9GUdCmw4wb8kj2X4LOLhGWg6F
+            lCop1MLJfefNmMEX6e8av0BZ98TMW2tGLOk+cydg73tqLIJBwPZLYIbCjhi7tpaM
+            xvJhcvbbky5n440EEP68LZj0cH2hG2uHjw/iZLrKp88LfMUReQl2mU/ourrgtEhT
+            yG4imwWZITF6utPyPUA361NK/VuNEmIeBsPRlf21Q/6422gh3BLYs+gPQSdyw9bS
+            XAEkFh1WpqpB272OZLrBHSmTuWR8EdaTDXS/BaKErF98PTULBafM3K/YgZhjIWuK
+            iBnN00zEJj5ZWmeIuOhLnqJe/UvpqHeb42oXppE4+dzBso10XIwVJOYAHxQn
+            =gM4+
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
@@ -1,7 +1,8 @@
 # Longhorn Helm Values
 defaultSettings:
-    # 2 replicas so volumes survive single-node loss
-    defaultReplicaCount: 2
+    # ReplicaCount below is to be updated when cluster node count change.
+    # Single-node clusters can only have 1 replica, multi-node should have 2 or ideally 3 when possible.
+    defaultReplicaCount: 1
    # Allow full disk usage on single-node
    storageOverProvisioningPercentage: 100
    storageMinimalAvailablePercentage: 10
@@ -15,35 +16,28 @@ defaultSettings:
    # set here via the `taintToleration` setting (semicolon-separated `kubectl
    # taint` syntax), not via per-component `tolerations` blocks.
    #
-    # The P330 node is tainted `dedicated=failover:NoSchedule` (see
-    # infra/p330/kube/variables.tf). Tolerating it lets Longhorn schedule
-    # engine/replica pods there so a volume can be failed over to the P330.
-    # The control-plane taint is also tolerated defensively, although with
-    # allowSchedulingOnControlPlanes=true on the R740 it is not actually applied.
-    taintToleration: dedicated=failover:NoSchedule;node-role.kubernetes.io/control-plane:NoSchedule
+    taintToleration: node-role.kubernetes.io/control-plane:NoSchedule
 persistence:
    defaultClass: true
-    defaultClassReplicaCount: 2
+    defaultClassReplicaCount: 1
    # Retain volumes on PVC delete — safer during migration
    reclaimPolicy: Retain
    # Mount options for ext4
    fstype: ext4
-# longhorn-manager is a DaemonSet — it must run on every storage node,
-# including the P330 failover node. The control-plane toleration is defensive
-# (allowSchedulingOnControlPlanes=true means it is not actually applied on the
-# R740, but keeps things correct if that ever changes).
+# longhorn-manager is a DaemonSet — it must run on every storage node.
 longhornManager:
    tolerations:
        - key: ENC[AES256_GCM,data:/lEcTm3XFvlmSSJwYhG0CeYXmDHOfUa+yHXfQFxt9WgHN/EBGQ==,iv:h2ZUX6s/lrhjp6yC+PFYACR10uxH7D86vAESbQ9H/9s=,tag:F5xBv+YpjHeErRKTRzNM6g==,type:str]
          operator: Exists
          effect: NoSchedule
-        # Tolerate the failover taint so longhorn-manager runs on the P330
+        # Was the failover taint toleration (now a no-op; see note above)
        - key: ENC[AES256_GCM,data:dBRTGlRjjGCR,iv:AcPEXMinsw6ow0izpIXFntwZUMAvMOA1P65mJDBwhmw=,tag:0w24kf8BfryNs07RpWme9w==,type:str]
          value: ENC[AES256_GCM,data:7XvkPrpko5A=,iv:J8qgVcveMb17rgzYN6WgmE5NpsaKDKMU/2EEctaQL5I=,tag:T9ofKbtlEiVPBqX/xEpnFA==,type:str]
          operator: Equal
          effect: NoSchedule
 # longhorn-driver (CSI provisioner/attacher deployer) — tolerate the same
-# taints so CSI operations work from the failover node.
+# taints so CSI operations work. The second toleration was for the removed
+# failover taint and is now a harmless encrypted no-op.
 longhornDriver:
    tolerations:
        - key: ENC[AES256_GCM,data:LuvHfPv9JRofL9cOJe/kvfs01+9F3d1hiCjr+WCTzMrxlneCBw==,iv:aC8TMpygwEio0Y6zau5QGTRNMDoxajuBLwVrFF+7fjg=,tag:nSJB+PBouekJkX23ar46kA==,type:str]
@@ -53,8 +47,7 @@ longhornDriver:
          value: ENC[AES256_GCM,data:A7XxyClHSCQ=,iv:cw9fzGcxDcSrELJlWmqxGuzTvZy5aYe/y43Xq0a1xdc=,tag:sj0ZQPBXJQURZ6A3QPJENg==,type:str]
          operator: Equal
          effect: NoSchedule
-# longhorn-ui — tolerate the same taints so the UI is reachable even if it
-# lands on the failover node.
+# longhorn-ui — tolerate the same taints so the UI is reachable.
 longhornUI:
    replicas: 1
    tolerations: