From 99880ab29180317194a9b7fa62cc6e7c660814e1 Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Wed, 9 Sep 2026 18:47:12 +0200 Subject: [PATCH] gitea,longhorn: update CPU limits, tolerations, replicas --- kubernetes/dev/gitea/values-actions.yaml | 6 +- kubernetes/dev/gitea/values.yaml | 109 ++++++----------------- kubernetes/system/longhorn/values.yaml | 27 +++--- 3 files changed, 38 insertions(+), 104 deletions(-) diff --git a/kubernetes/dev/gitea/values-actions.yaml b/kubernetes/dev/gitea/values-actions.yaml index 8cf1092..fedf324 100644 --- a/kubernetes/dev/gitea/values-actions.yaml +++ b/kubernetes/dev/gitea/values-actions.yaml @@ -44,17 +44,15 @@ statefulset: docker_timeout: 300s # Hard per-job caps (docker create args). Slightly below the # dind limits so the daemon and image cache keep headroom. - options: --memory=7g --cpus=3 + options: --memory=7g --cpus=1 dind: resources: requests: cpu: 250m memory: 512Mi limits: - cpu: 4 + cpu: 1500m memory: 8Gi - # Same failover tolerations/affinity as the gitea release, so runners can - # be scheduled wherever Gitea itself runs (p330 during r740 outage). tolerations: - key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str] operator: Equal diff --git a/kubernetes/dev/gitea/values.yaml b/kubernetes/dev/gitea/values.yaml index 0e9b459..594f430 100644 --- a/kubernetes/dev/gitea/values.yaml +++ b/kubernetes/dev/gitea/values.yaml @@ -25,61 +25,25 @@ valkey: limits: cpu: 500m memory: 512Mi - tolerations: - - key: ENC[AES256_GCM,data:fXEKv6sROAEz,iv:ausWhm1zJdx+Mu26pauhi5G+ODZqLZ27SmfkAuMUtYY=,tag:cNYyeG09Hk++uED5M0TBKw==,type:str] - operator: Equal - value: ENC[AES256_GCM,data:7CfH8Lrr7S0=,iv:dv5f/cN1VI2NLQsAYqF2hGEjVjxTnHGXFfNQyCL1KIc=,tag:HTiQN/wZU/mXSHvaz2KqRg==,type:str] - effect: NoSchedule - - key: ENC[AES256_GCM,data:2l4bXqCigZWkqfm6zvba/aOwC6zXYd0lufMUrrHA3YZm1/0IXw==,iv:70oryMEsl0nnZz1q4OHHHgjRswmyvLZI9Y6tk0elM5Q=,tag:2/EHDIcaDTSGWl3qRVW8oQ==,type:str] - operator: Exists - effect: NoSchedule - affinity: - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - preference: - matchExpressions: - - key: ENC[AES256_GCM,data:dc00KQOBXn587h22VlooFY5ZjbE=,iv:kX5utMKu8uoUSeameD2R0iH+DU/3YXuwP8DaZs9mGYs=,tag:PM5xBnYaP84zMZ2SWTYV+A==,type:str] - operator: NotIn - values: - - "true" postgresql: enabled: true global: postgresql: auth: - postgressPassword: ENC[AES256_GCM,data:3aHXAFDqpYsWeg==,iv:qbrm+izSr+PaAa4fHMVw3Yz0qMuisRMpDxVKdeFSvls=,tag:zVUVALdIUTMhxavsSxlUCw==,type:str] - password: ENC[AES256_GCM,data:LCfnttYbxS34WA==,iv:rqU044P/gUmqjhmu+A9B7A64ujnkIhMpKQlYpcmi8MY=,tag:XJws85qfKI+y0BV6S4L1Ig==,type:str] + postgressPassword: ENC[AES256_GCM,data:H0SYcVGHj1l7sw==,iv:g4wFhJYJHaLwjyB8yX0++EHCF8SPhpojV/Ga/EtIC/M=,tag:C/DDVuWWtkQIUZ6iKyae+Q==,type:str] + password: ENC[AES256_GCM,data:fg3kSvc4uoxItQ==,iv:5QpriMTHriIsU9DX5cC88TlBixIJrarE0fjqTHDYeQE=,tag:XdTEkDKnC8q82OYRwtOjVw==,type:str] database: gitea - username: ENC[AES256_GCM,data:QDo83dk=,iv:RvuuDiiY1XLZbrjcJ/ANxb/wHrSdf1gaBSck+cMaWhY=,tag:UCEAkWZ2Dmr93oBATQdf8g==,type:str] + username: ENC[AES256_GCM,data:IefT7eM=,iv:jdQ7avYStp2knOfIZsIgl8/MLlLWhfPjeiIQfFBu2aE=,tag:GkibjMLPyJSDQhvuq7b39g==,type:str] volumePermissions: enabled: true primary: resources: requests: - cpu: 250m + cpu: 100m memory: 256Mi limits: - cpu: 1000m + cpu: 500m memory: 1Gi - tolerations: - - key: ENC[AES256_GCM,data:NplaOmBekcB+,iv:qzQ+QasVZ2JMG87PgdVDJ/7XHDiDXTp+ogxB1w4tws4=,tag:aPyaqwdxVEjct7D3SuKFqw==,type:str] - operator: Equal - value: ENC[AES256_GCM,data:vjsM3Li0p/8=,iv:Y+sjLHWpqwsOJV+vygG2f/3ZXQs2ZQRloPrlcOuzoeM=,tag:t+uR2/uM4NiIq6alJjio9g==,type:str] - effect: NoSchedule - - key: ENC[AES256_GCM,data:LQvczGKAK2x1BbFr7S8jo0G7YUaX4DJvc+1Z2E+bCjys4PsBHg==,iv:m4Ses50zYxTF7jXTgbf9nY0kT1hrtgVEEQruLZFN8cU=,tag:UidEMRbb0IPb5V31FjWzYg==,type:str] - operator: Exists - effect: NoSchedule - affinity: - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - preference: - matchExpressions: - - key: ENC[AES256_GCM,data:D9N+Fd/g24bKikLdx4WE57WvqE4=,iv:+1oYCzAl6kBJliw0woWhhWT7aWcx4rXkGDn7Anho2Pg=,tag:R+cLK75QCIfWeGL8/eqeFA==,type:str] - operator: NotIn - values: - - "true" livenessProbe: enabled: true initialDelaySeconds: 30 @@ -112,8 +76,8 @@ gitea: oauth: - name: Authentik provider: openidConnect - key: ENC[AES256_GCM,data:cYaRMEtrziMJWIRj3dg1fuMpp6F3t5ZDO/H2ONOQCg/fZ8s0ZsLb6Q==,iv:VskJ+5Rwpnys0nH531FYZIj253lJqDz1l6sgwKWhE1s=,tag:F3Wj1ruwSwlC5XbVKt1aCQ==,type:str] - secret: ENC[AES256_GCM,data:Cro9iaXKcv+uP4G6jEX0tPBW9cjxaZUmnLEVyE72j34aeAAmDFgPiTE/VWSbD3WWK8tuErl0RFHMvHiN63f4W5hq38W9VMP31JDCUYcUbkFBmQg2hrt6ePajZZICR1gHB3D7t5av4pl13O490VByGWfr8OxAK8Z/cGojp/Pt4mo=,iv:nRvFSVRSKFvpNjGmJq6uh/JV3acLsipV0nUHAlt+t80=,tag:BZ7eJiSVCM8J+MY+I5Z48g==,type:str] + key: ENC[AES256_GCM,data:xF20IE3CJp0+ONZsHNflB8JB/CcAUMcTvOcGvzWFW5S6PNnlsRyxfA==,iv:vvKzB6F0338YBoGcRrkSE8um7GEw+vpfjN4/q7knSbw=,tag:lZdPbtCZWYjVSMzirZcxOg==,type:str] + secret: ENC[AES256_GCM,data:pFzSaiUjB5OipMJ2jKkGXBxw9pHnjHsvAThm2AfzgBdIrSKhhWkoQkcrq5FcPnuYvEjuwVpPM9VddyocNOqnFuEdNY7RVsLEOzMSnFkNIl42qA2ze6tJhi6eaoODsYQcvyvdUnqCBxLF8qezP0huQQ7hRs26tUhbd+HBmfJnHhU=,iv:Lr05L9kwxqNyDiAswrSR120Qc056qAXu+Ld9nOHNxjM=,tag:NrkT67bNOCm5FL1NRYclvQ==,type:str] autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration config: APP_NAME: Gitea @@ -142,55 +106,34 @@ gitea: # Resource limits for Gitea container resources: requests: - cpu: 250m + cpu: 100m memory: 512Mi limits: - cpu: 1000m + cpu: 500m memory: 1Gi -# Increase replica count is not useful for 1-node cluster replicaCount: 1 -# Failover tolerations + affinity — allow scheduling on p330 during r740 outage -tolerations: - - key: ENC[AES256_GCM,data:1O2rrNCMxkGV,iv:dLwAP4NFVRZ0IUNzARm7hPq+ruIshtpXfUVtuuRP3/o=,tag:EmKs8LItQFLoPov8MMjfgw==,type:str] - operator: Equal - value: ENC[AES256_GCM,data:l0WXlDcRWaY=,iv:F3AxSbB9t/q3L6yOI4NcHlNzZrDwJqiJ/jjfLrQlNAE=,tag:6s/WqyWjNLHHmExGmgl65g==,type:str] - effect: NoSchedule - - key: ENC[AES256_GCM,data:RtKkkyNv0zO/IezcKaBBp5Ir9mCBacgVqjFIGyq13U68sU4z5g==,iv:sFr2v6kFKOm2ID73GpxACTvQttvt7fYwg437N7D2Scg=,tag:aPCpFti/jY/0a1FEWF/g4w==,type:str] - operator: Exists - effect: NoSchedule -affinity: - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - preference: - matchExpressions: - - key: ENC[AES256_GCM,data:jW8/VevqdIAXrBAMj58udice6HM=,iv:+6nTdgB2io+H6S/jyO4Fc/+VfoyGIY+dqphi6ZNIn3c=,tag:JKJveLWX8pjMN3cnO94UwQ==,type:str] - operator: NotIn - values: - - "true" -# (postgresql and valkey tolerations are set in their respective blocks above) sops: - lastmodified: "2026-08-26T19:28:03Z" - mac: ENC[AES256_GCM,data:hb8HlzvsAU+6A2C4MARpF2j+Mv55mQ25SOjJIo6inV822IskVV+0Ml9I6WS8RK6ZNZAdnVcDtQ07JlGx9QRiIwxAE0xxwuhukhSBBjeHGAc39RPhLXhDvwUF5ZeouGixkVrA5lhAvHiu9ILv241G1st0J9qK/ZaIsTazQN4X3iY=,iv:1ehf3avfeV4Ro8rw0rsFQ0qnFXrvF66tUKqqCY+NXSc=,tag:5kXUpLrLGPbwNSBC+aVIwA==,type:str] + lastmodified: "2026-09-09T16:47:12Z" + mac: ENC[AES256_GCM,data:YxAiN7+KTLaKK++Yhl40uoC0KvWkRz5kYzpjcl1Vm3FbRh/lO817/meMdvOZzXGJhwzq2/6BLceJAK73BIFpVaeMueiMQyeGIk1BEfIYtJ6eLXY2cQRVkdPcJVDT4AmLNXDFRx9RvckIQiK2W8fEaEhYPvGp7W+6yZfM0ES1Xug=,iv:K00+4VnkjT6exM4/0KTM/Fm7lzSj1hzhzvnz+x/7DNo=,tag:oJzYz+5knokiBCkSetXllQ==,type:str] pgp: - - created_at: "2026-08-26T19:28:03Z" + - created_at: "2026-09-09T16:47:12Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiAQ/9FF5SJAVg0dLi/+xQreE2yrxMH4GTfdBMHd3GWEVLYger - 6XwXQ7+Qx3mxf+VprmNGOW7NdKSsC5Re/JHJAjs7p+eWohtieOgKtg7DWEcrTwZA - 56Rnhtnh0vv2jqmv/pm/Cj49GCLTjQFY+w5azU7g/7eQZpdPezIdrs1ueiSm6LaU - T9bMdUzm1pb7/JKQMvzYyPcuw0AfKLlg+x7HHRNI3O434yKuTLC5emVxJEmwQvV4 - FD6oUAt4gKLqUHvAUuCVo8O5G36MGHO/roHxlWaLbHqjaDPyWh2TGdX0ICKKq1yc - fJzw9dYgcwIMXpXilbnsL4gQpv6bKj6VniyCoye6ieMZ2HIoZghd+wL0NoPkS7Nj - D+vTcPR8HOEWoZkZ4B01+bFyTmJ5NA8Z0V3peHkuTy+HCTgwxA0Y8PCrHl3YHsCQ - C3nANhh+cMqtcJdvqdGrM09X8n3edNc4lf+qg2tk0NbcdVSqcFl9y/MeJOWhOOg3 - T/bwBrI5O7aRO6gqaCebKuGIrD1PDNURW3LLiKBSU4OTYbMWWXGpdEMCkoSQS56B - 6Uo9N8KcWhBChCMJG8hbzYRVwYgWGsHsQbfbujkcIiSaoHGy8fklflxBjtLiitLO - voawf0zSqyBKbf1YFAmYnrdR0jiasKC5iqtK7c8uc/HyCSvxjK0ygPloWFI8aSPS - XgFJiWHT/5gOG64XmDm0VoKdflpojJeTGIC5JU8RAlJgD/oq+uWt23ayJxkjbkMd - H7UsqcuzWfbp44MYtmEWbxvI/+Iaui5/7hW7kEzWI60Mh4tVZGIJ64A3WNRL/Xw= - =U5nI + hQIMA7uy4qQr71wiAQ//REJaQmN8Ue05KiM2nNc4/vwHudjHu6HuYgZEIPW7EEcR + XxjGRO+H4EW8h8ydkDW1sHK2k8Bh7wfD96sIML4cxGal23abBndy2jvnkpj99/NG + vQaobfedmgCnMRe323612D+JsZdA2LFEnppr8WHZpQVZV1M0IJjdow9p8uXo3omJ + arKXlTyOa7r1JdiFZ6Alj6aDMSAQ1vSqoZn3rclekjI7G1HUmupATWGDSi6KyrAc + sjQOXFkl7YdfF608oBcv/HwVvRRgV2ktNVDcLcDfNRJl1uTyG9PKwUSPAaDErUk4 + 2kvO6W+TV3PpEJTVEGwqwwfOlPPBo0Z31kooxmHNEWJ7TFLTgF4FJRe9tQlKAuXg + vOuLSHvk+0J/dmmimccxDCDpA/Uq1ZuGpPh0Lv+YnaMnVhp0kq/pZNJOsh48kqEd + xDGoh8ouPqrVfBQC/EQwegM3UinAiM62dGhBqfI9GUdCmw4wb8kj2X4LOLhGWg6F + lCop1MLJfefNmMEX6e8av0BZ98TMW2tGLOk+cydg73tqLIJBwPZLYIbCjhi7tpaM + xvJhcvbbky5n440EEP68LZj0cH2hG2uHjw/iZLrKp88LfMUReQl2mU/ourrgtEhT + yG4imwWZITF6utPyPUA361NK/VuNEmIeBsPRlf21Q/6422gh3BLYs+gPQSdyw9bS + XAEkFh1WpqpB272OZLrBHSmTuWR8EdaTDXS/BaKErF98PTULBafM3K/YgZhjIWuK + iBnN00zEJj5ZWmeIuOhLnqJe/UvpqHeb42oXppE4+dzBso10XIwVJOYAHxQn + =gM4+ -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ diff --git a/kubernetes/system/longhorn/values.yaml b/kubernetes/system/longhorn/values.yaml index cbcb040..b2f4ccf 100644 --- a/kubernetes/system/longhorn/values.yaml +++ b/kubernetes/system/longhorn/values.yaml @@ -1,7 +1,8 @@ # Longhorn Helm Values defaultSettings: - # 2 replicas so volumes survive single-node loss - defaultReplicaCount: 2 + # ReplicaCount below is to be updated when cluster node count change. + # Single-node clusters can only have 1 replica, multi-node should have 2 or ideally 3 when possible. + defaultReplicaCount: 1 # Allow full disk usage on single-node storageOverProvisioningPercentage: 100 storageMinimalAvailablePercentage: 10 @@ -15,35 +16,28 @@ defaultSettings: # set here via the `taintToleration` setting (semicolon-separated `kubectl # taint` syntax), not via per-component `tolerations` blocks. # - # The P330 node is tainted `dedicated=failover:NoSchedule` (see - # infra/p330/kube/variables.tf). Tolerating it lets Longhorn schedule - # engine/replica pods there so a volume can be failed over to the P330. - # The control-plane taint is also tolerated defensively, although with - # allowSchedulingOnControlPlanes=true on the R740 it is not actually applied. - taintToleration: dedicated=failover:NoSchedule;node-role.kubernetes.io/control-plane:NoSchedule + taintToleration: node-role.kubernetes.io/control-plane:NoSchedule persistence: defaultClass: true - defaultClassReplicaCount: 2 + defaultClassReplicaCount: 1 # Retain volumes on PVC delete — safer during migration reclaimPolicy: Retain # Mount options for ext4 fstype: ext4 -# longhorn-manager is a DaemonSet — it must run on every storage node, -# including the P330 failover node. The control-plane toleration is defensive -# (allowSchedulingOnControlPlanes=true means it is not actually applied on the -# R740, but keeps things correct if that ever changes). +# longhorn-manager is a DaemonSet — it must run on every storage node. longhornManager: tolerations: - key: ENC[AES256_GCM,data:/lEcTm3XFvlmSSJwYhG0CeYXmDHOfUa+yHXfQFxt9WgHN/EBGQ==,iv:h2ZUX6s/lrhjp6yC+PFYACR10uxH7D86vAESbQ9H/9s=,tag:F5xBv+YpjHeErRKTRzNM6g==,type:str] operator: Exists effect: NoSchedule - # Tolerate the failover taint so longhorn-manager runs on the P330 + # Was the failover taint toleration (now a no-op; see note above) - key: ENC[AES256_GCM,data:dBRTGlRjjGCR,iv:AcPEXMinsw6ow0izpIXFntwZUMAvMOA1P65mJDBwhmw=,tag:0w24kf8BfryNs07RpWme9w==,type:str] value: ENC[AES256_GCM,data:7XvkPrpko5A=,iv:J8qgVcveMb17rgzYN6WgmE5NpsaKDKMU/2EEctaQL5I=,tag:T9ofKbtlEiVPBqX/xEpnFA==,type:str] operator: Equal effect: NoSchedule # longhorn-driver (CSI provisioner/attacher deployer) — tolerate the same -# taints so CSI operations work from the failover node. +# taints so CSI operations work. The second toleration was for the removed +# failover taint and is now a harmless encrypted no-op. longhornDriver: tolerations: - key: ENC[AES256_GCM,data:LuvHfPv9JRofL9cOJe/kvfs01+9F3d1hiCjr+WCTzMrxlneCBw==,iv:aC8TMpygwEio0Y6zau5QGTRNMDoxajuBLwVrFF+7fjg=,tag:nSJB+PBouekJkX23ar46kA==,type:str] @@ -53,8 +47,7 @@ longhornDriver: value: ENC[AES256_GCM,data:A7XxyClHSCQ=,iv:cw9fzGcxDcSrELJlWmqxGuzTvZy5aYe/y43Xq0a1xdc=,tag:sj0ZQPBXJQURZ6A3QPJENg==,type:str] operator: Equal effect: NoSchedule -# longhorn-ui — tolerate the same taints so the UI is reachable even if it -# lands on the failover node. +# longhorn-ui — tolerate the same taints so the UI is reachable. longhornUI: replicas: 1 tolerations: