Size memory requests from two weeks of p95 working sets

2026-11-04 22:36:50 +01:00
1 parent 92eebd06f7
commit a25d4f90bf
@@ -34,6 +34,9 @@ notifications:
    secret:
      create: false

+    resources:
+      requests:
+        memory: 256Mi
 redisSecretInit:
    enabled: false

@@ -42,3 +45,26 @@ server:
      enabled: true
      annotations:
        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    resources:
+      requests:
+        memory: 256Mi
+controller:
+  resources:
+    requests:
+      memory: 1664Mi
+applicationSet:
+  resources:
+    requests:
+      memory: 256Mi
+dex:
+  resources:
+    requests:
+      memory: 256Mi
+repoServer:
+  resources:
+    requests:
+      memory: 320Mi
+redis:
+  resources:
+    requests:
+      memory: 128Mi
@@ -50,7 +50,7 @@ server:
  resources:
    requests:
      cpu: 150m
-      memory: 1Gi
+      memory: 1344Mi
    limits:
      # Deliberately leave CPU unlimited so login bursts can use idle cores.
      memory: 2Gi
@@ -94,6 +94,7 @@ worker:
  resources:
    requests:
      cpu: 150m
+      memory: 576Mi
  enabled: true
  livenessProbe:
    timeoutSeconds: 10
@@ -20,3 +20,6 @@ ingress:
  - hosts:
    - brgkepler.com
    secretName: brgkepler-com-tls
+resources:
+  requests:
+    memory: 192Mi
@@ -24,3 +24,4 @@ ingress:
 resources:
  requests:
    cpu: 175m
+    memory: 384Mi
@@ -4,3 +4,14 @@ crds:
 extraArgs:
  - --dns01-recursive-nameservers-only
  - --dns01-recursive-nameservers=1.1.1.1:53,8.8.8.8:53
+resources:
+  requests:
+    memory: 192Mi
+cainjector:
+  resources:
+    requests:
+      memory: 128Mi
+webhook:
+  resources:
+    requests:
+      memory: 128Mi
@@ -10,3 +10,6 @@ ingress:
      - path: /
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+resources:
+  requests:
+    memory: 128Mi
@@ -8,7 +8,7 @@ image:
 resources:
  requests:
    cpu: 25m
-    memory: 384Mi
+    memory: 640Mi
  limits:
    cpu: "1"
    memory: 1Gi
@@ -44,6 +44,9 @@ sidecar:
    provider:
      allowUiUpdates: true

+  resources:
+    requests:
+      memory: 128Mi
 grafana.ini:
  server:
    domain: grafana.brunner.ninja
@@ -86,3 +89,4 @@ grafana.ini:
 resources:
  requests:
    cpu: 75m
+    memory: 1280Mi
@@ -20,3 +20,6 @@ ingress:
  - hosts:
    - gschissenes.equipment
    secretName: gschissenes-equipment-tls
+resources:
+  requests:
+    memory: 192Mi
@@ -24,3 +24,4 @@ ingress:
 resources:
  requests:
    cpu: 175m
+    memory: 1472Mi
@@ -69,6 +69,9 @@ server:
                secretKeyRef:
                  name: immich-postgresql-app
                  key: password
+          resources:
+            requests:
+              memory: 7744Mi
  ingress:
    main:
      enabled: false
@@ -101,6 +104,9 @@ machine-learning:
            runAsNonRoot: true
            runAsUser: 1000
            runAsGroup: 1000
+          resources:
+            requests:
+              memory: 1408Mi
      initContainers:
        check-bcachefs-library:
          image:
@@ -15,7 +15,7 @@ publishedServerUrl: https://jellyfin.brunner.ninja
 resources:
  requests:
    cpu: 500m
-    memory: 2Gi
+    memory: 3520Mi
    ephemeral-storage: 1Gi
 ingress:
  enabled: true
@@ -50,7 +50,7 @@ mastodon:
    resources:
      requests:
        cpu: 50m
-        memory: 768Mi
+        memory: 1280Mi
      limits:
        cpu: "2"
        memory: 2Gi
@@ -71,7 +71,7 @@ mastodon:
        resources:
          requests:
            cpu: 50m
-            memory: 768Mi
+            memory: 1920Mi
          limits:
            cpu: "2"
            memory: 2Gi
@@ -7,5 +7,6 @@ serviceMonitor:
 resources:
  requests:
    cpu: 175m
+    memory: 256Mi
  limits:
    cpu:
@@ -12,7 +12,7 @@ initResources:
 resources:
  requests:
    cpu: 100m
-    memory: 1Gi
+    memory: 1280Mi
  limits:
    cpu: 2
    memory: 3Gi
@@ -239,8 +239,15 @@ collabora:
      paths:
      - path: /
        pathType: ImplementationSpecific
+  resources:
+    requests:
+      memory: 1344Mi
 cronjob:
  enabled: true
+  sidecar:
+    resources:
+      requests:
+        memory: 192Mi
 persistence:
  enabled: true
  storageClass: rook-ceph-block
@@ -257,3 +264,6 @@ prometheus:
    enabled: false
  rules:
    enabled: true
+resources:
+  requests:
+    memory: 512Mi
@@ -5,7 +5,7 @@ jwtSecret:
 resources:
  requests:
    cpu: 50m
-    memory: 128Mi
+    memory: 192Mi
  limits:
    cpu: 1
    memory: 1Gi
@@ -16,3 +16,6 @@ networkPolicy:
          app.kubernetes.io/name: traefik
          app.kubernetes.io/instance: traefik-default
  # Cilium policy supplies external egress with explicit cluster exclusions.
+resources:
+  requests:
+    memory: 896Mi
@@ -24,3 +24,6 @@ persistence:
    storageClass: rook-ceph-block
    accessMode: ReadWriteOnce
    retain: true
+resources:
+  requests:
+    memory: 448Mi
@@ -45,4 +45,4 @@ affinity:
 resources:
  requests:
    cpu: 50m
-    memory: 1Gi
+    memory: 5440Mi
@@ -11,3 +11,6 @@ persistence:
  existingClaim: pfostendynamics-com
 ingress:
  enabled: false
+resources:
+  requests:
+    memory: 192Mi
@@ -20,3 +20,6 @@ servers:
    host: postgresql.gramps.svc.cluster.local
  - description: postgresql.matrix.svc.cluster.local
    host: postgresql.matrix.svc.cluster.local
+resources:
+  requests:
+    memory: 128Mi
@@ -16,6 +16,9 @@ prometheus-node-exporter:
          regex: 'node_filesystem_.+;bcachefs;(/komposthaufen|/var/www|/var/lib/(lidarr|prowlarr|radarr|readarr|sonarr|whisparr)|/home/feedc0de/(\.steam/steamapps|mcserver/plugins/dynmap/web/tiles))'
          action: drop

+  resources:
+    requests:
+      memory: 64Mi
 alertmanager:
  ingress:
    enabled: true
@@ -91,6 +94,7 @@ prometheus:
    resources:
      requests:
        cpu: 200m
+        memory: 3776Mi
    retention: "15d"
    storageSpec:
      volumeClaimTemplate:
@@ -104,3 +108,15 @@ prometheus:
    serviceMonitorSelector: {}
    ruleSelectorNilUsesHelmValues: false
    ruleSelector: {}
+prometheusOperator:
+  resources:
+    requests:
+      memory: 192Mi
+  prometheusConfigReloader:
+    resources:
+      requests:
+        memory: 64Mi
+kube-state-metrics:
+  resources:
+    requests:
+      memory: 256Mi
@@ -30,3 +30,9 @@ valkey:
    persistence:
      storageClass: rook-ceph-block-ec
      size: 2Gi
+resources:
+  requests:
+    memory: 11904Mi
+repomirrorResources:
+  requests:
+    memory: 384Mi
@@ -30,3 +30,6 @@ persistence:
    size: 60Gi
    storageClass: rook-ceph-block
    accessMode: ReadWriteOnce
+resources:
+  requests:
+    memory: 192Mi
@@ -12,7 +12,7 @@ podDisruptionBudget:
 resources:
  requests:
    cpu: 700m
-    memory: 1Gi
+    memory: 3072Mi
 affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
@@ -21,7 +21,7 @@ readinessProbe:
 resources:
  requests:
    cpu: 75m
-    memory: 256Mi
+    memory: 512Mi
    ephemeral-storage: 128Mi
  limits:
    memory: 1Gi
@@ -25,3 +25,6 @@ ingress:
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd
+resources:
+  requests:
+    memory: 192Mi
@@ -24,3 +24,6 @@ externalPostgresql:
  existingSecret: wiki-js
  existingSecretKey: postgresql-password
  ssl: false
+resources:
+  requests:
+    memory: 256Mi
@@ -13,6 +13,10 @@ spec:
    targetRevision: 0.29.1
    helm:
      releaseName: cnpg-operator
+      valuesObject:
+        resources:
+          requests:
+            memory: 256Mi
  destination:
    server: https://kubernetes.default.svc
    namespace: cnpg-system
@@ -0,0 +1,282 @@
+namespace,workload,container,observed_p95_MiB,previous_request_MiB,formula_MiB,decision
+argocd,argocd-application-controller,application-controller,1339.0,0,1664,Update in apps/argocd/values.yaml
+argocd,argocd-applicationset-controller,applicationset-controller,179.2,0,256,Update in apps/argocd/values.yaml
+argocd,argocd-dex-server,dex-server,189.3,0,256,Update in apps/argocd/values.yaml
+argocd,argocd-notifications-controller,notifications-controller,175.4,0,256,Update in apps/argocd/values.yaml
+argocd,argocd-redis,redis,58.6,0,128,Update in apps/argocd/values.yaml
+argocd,argocd-repo-server,repo-server,224.0,0,320,Update in apps/argocd/values.yaml
+argocd,argocd-server,server,199.2,0,256,Update in apps/argocd/values.yaml
+artcraft,cadcraft,cadcraft,13.9,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,cadcraft,nginx-exporter,23.5,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,deckcraft,deckcraft,13.8,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,deckcraft,nginx-exporter,28.1,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,designcraft,designcraft,6.6,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,designcraft,nginx-exporter,28.2,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,effectcraft,effectcraft,13.8,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,effectcraft,nginx-exporter,30.8,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,figcraft,figcraft,14.1,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,figcraft,nginx-exporter,20.9,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,filmcraft,filmcraft,6.7,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,filmcraft,nginx-exporter,27.9,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,gridcraft,gridcraft,13.9,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,gridcraft,nginx-exporter,28.2,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,lightcraft,lightcraft,6.6,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,lightcraft,nginx-exporter,26.5,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,pdfcraft,nginx-exporter,21.5,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,pdfcraft,pdfcraft,14.4,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,photocraft,nginx-exporter,26.6,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,photocraft,photocraft,13.8,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,soundcraft,nginx-exporter,29.5,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,soundcraft,soundcraft,13.8,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,vectorcraft,nginx-exporter,27.0,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,vectorcraft,vectorcraft,13.9,32,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,wordcraft,nginx-exporter,25.5,16,64,Retain: small existing reservation / avoid low-value rollout
+artcraft,wordcraft,wordcraft,14.0,32,64,Retain: small existing reservation / avoid low-value rollout
+asciinema,asciinema,asciinema,206.9,256,256,Retain: existing request covers formula / recovery floor
+atm10,atm10,atm10,7653.4,0,9216,Retain: game/GPU/bursty workload needs representative peak review
+atm10,atm10,mc-monitor,35.5,0,64,Retain: game/GPU/bursty workload needs representative peak review
+authentik,ak-outpost-ldap,ldap,79.0,0,128,Defer: legacy/operator owner not included in this GitOps chart rollout
+authentik,ak-outpost-rac,rac,105.8,0,128,Defer: legacy/operator owner not included in this GitOps chart rollout
+authentik,ak-outpost-radius,radius,86.1,0,128,Defer: legacy/operator owner not included in this GitOps chart rollout
+authentik,authentik-server,server,1114.3,1024,1344,Update in apps/authentik/values.yaml
+authentik,authentik-worker,worker,441.1,0,576,Update in apps/authentik/values.yaml
+brave-sync,brave-sync,sync,38.1,96,64,Retain: existing request covers formula / recovery floor
+brave-sync,brave-sync-dynamodb,dynamodb,331.2,512,448,Retain: existing request covers formula / recovery floor
+brave-sync,brave-sync-valkey,valkey,27.5,32,64,Retain: small existing reservation / avoid low-value rollout
+cert-manager,cert-manager,cert-manager-controller,117.4,0,192,Update in apps/cert-manager/values.yaml
+cert-manager,cert-manager-cainjector,cert-manager-cainjector,104.6,0,128,Update in apps/cert-manager/values.yaml
+cert-manager,cert-manager-webhook,cert-manager-webhook,72.0,0,128,Update in apps/cert-manager/values.yaml
+cnpg-system,cnpg-operator-cloudnative-pg,manager,164.1,0,256,Update in bootstrap/cnpg-operator.yaml
+copyparty,copyparty,copyparty,2077.1,256,2496,Defer: short OOM-censored history; recently changed memory limit
+coturn,coturn,coturn,47.1,50,64,Defer: formula exceeds existing limit; investigate before changing limits
+default,30-birthday,30-birthday,72.7,32,128,Retain: small existing reservation / avoid low-value rollout
+default,brgkepler-com,apache-exporter,26.4,0,64,Retain: small existing reservation / avoid low-value rollout
+default,brgkepler-com,brgkepler-com,125.8,0,192,Update in apps/brgkepler-com/values.yaml
+default,brunner-ninja,apache-exporter,26.9,0,64,Retain: small existing reservation / avoid low-value rollout
+default,brunner-ninja,brunner-ninja,298.5,0,384,Update in apps/brunner-ninja/values.yaml
+default,flaresolverr,flaresolverr,58.2,0,128,Update in apps/flaresolverr/values.yaml
+default,gitea-anubis,anubis,97.8,128,128,Retain: existing request covers formula / recovery floor
+default,grafana,grafana,1054.1,0,1280,Update in apps/grafana/values.yaml
+default,grafana,grafana-sc-dashboard,95.4,0,128,Update in apps/grafana/values.yaml
+default,gschissenes-equipment,apache-exporter,27.8,0,64,Retain: small existing reservation / avoid low-value rollout
+default,gschissenes-equipment,gschissenes-equipment,138.6,0,192,Update in apps/gschissenes-equipment/values.yaml
+default,home-assistant,home-assistant,1213.6,0,1472,Update in apps/home-assistant/values.yaml
+default,immich-crack,apache-exporter,26.7,0,64,Retain: small existing reservation / avoid low-value rollout
+default,immich-crack,immich-crack,79.1,0,128,Defer: legacy/operator owner not included in this GitOps chart rollout
+default,immich-sync,immich-sync,38.1,32,64,Retain: small existing reservation / avoid low-value rollout
+default,immichframe,immichframe,86.2,256,128,Retain: existing request covers formula / recovery floor
+default,influxdb2,influxdb2,1508.1,2048,1856,Retain: existing request covers formula / recovery floor
+default,mktxp-exporter,mktxp,195.9,0,256,Update in apps/mktxp/values.yaml
+default,mosquitto,mosquitto,6.6,0,64,Retain: small existing reservation / avoid low-value rollout
+default,pfostendynamics-com,apache-exporter,27.1,0,64,Retain: small existing reservation / avoid low-value rollout
+default,pfostendynamics-com,pfostendynamics-com,122.6,0,192,Update in apps/pfostendynamics-com/values.yaml
+default,phppgadmin,phppgadmin,96.7,0,128,Update in apps/phppgadmin/values.yaml
+default,postgresql,postgresql,287.4,1024,384,Retain: existing request covers formula / recovery floor
+default,routeros-wifi-vlan,reconciler,32.2,64,64,Retain: existing request covers formula / recovery floor
+default,tautulli,tautulli,111.9,0,192,Update in apps/tautulli/values.yaml
+default,traefik,traefik,2548.1,1024,3072,Update in apps/traefik/values.yaml
+default,traefik-error-pages,nginx,13.7,16,64,Retain: small existing reservation / avoid low-value rollout
+default,uptime-kuma,uptime-kuma,398.2,256,512,Update in apps/uptime-kuma/values.yaml
+default,valkey-primary,valkey,97.8,512,128,Retain: existing request covers formula / recovery floor
+default,valkey-replicas,valkey,98.0,512,128,Retain: existing request covers formula / recovery floor
+default,visual-studio-code,visual-studio-code,129.1,0,192,Update in apps/visual-studio-code/values.yaml
+default,watschn-studio,apache-exporter,27.3,0,64,Retain: small existing reservation / avoid low-value rollout
+default,watschn-studio,watschn-studio,41.2,0,64,Retain: small existing reservation / avoid low-value rollout
+default,wiki-js,wiki,194.8,0,256,Update in apps/wiki-js/values.yaml
+diun,diun,diun,91.0,0,128,Defer: published chart does not expose effective resource settings
+elastic,elastic-operator,manager,126.4,256,192,Retain: existing request covers formula / recovery floor
+elastic,elasticsearch-es-data,elasticsearch,7888.5,12288,9472,Retain: existing request covers formula / recovery floor
+elastic,kibana-kb,kibana,1296.0,4096,1600,Retain: existing request covers formula / recovery floor
+elastic,netflow-beat-filebeat,filebeat,359.8,1024,448,Retain: existing request covers formula / recovery floor
+elastic,traefik-access-agent,agent,965.2,256,1216,Defer: formula exceeds existing limit; investigate before changing limits
+factorio,factorio,exporter,30.2,24,64,Retain: game/GPU/bursty workload needs representative peak review
+factorio,factorio,factorio,294.2,2048,384,Retain: existing request covers formula / recovery floor
+factorio,factorio,player-collector,4.2,16,64,Retain: game/GPU/bursty workload needs representative peak review
+garrysmod,garrysmod,loading-screen,40.6,32,64,Retain: game/GPU/bursty workload needs representative peak review
+garrysmod,garrysmod,server,355.2,768,448,Retain: existing request covers formula / recovery floor
+garrysmod,garrysmod,srcds-exporter,32.0,24,64,Retain: game/GPU/bursty workload needs representative peak review
+ghostfolio,ghostfolio,ghostfolio,500.3,384,640,Update in apps/ghostfolio/values.yaml
+ghostfolio,ghostfolio-valkey,ghostfolio-valkey,18.4,64,64,Retain: existing request covers formula / recovery floor
+gramps,grampsweb,gramps-web,1579.8,512,1920,Defer: legacy/operator owner not included in this GitOps chart rollout
+gramps,grampsweb-celery,worker,321.4,256,448,Defer: legacy/operator owner not included in this GitOps chart rollout
+gramps,valkey-primary,valkey,33.1,64,64,Retain: existing request covers formula / recovery floor
+gramps,valkey-replicas,valkey,35.2,64,64,Retain: existing request covers formula / recovery floor
+immich,immich-machine-learning,main,1137.6,0,1408,Update in apps/immich/values.yaml
+immich,immich-server,main,6432.0,0,7744,Update in apps/immich/values.yaml
+immich,immich-valkey,main,38.1,0,64,Retain: small existing reservation / avoid low-value rollout
+jellyfin,jellyfin,jellyfin,2924.5,2048,3520,Update in apps/jellyfin/values.yaml
+kube-system,cilium,cilium-agent,888.5,0,1088,Defer: network/control-plane resources need coordinated rollout
+kube-system,cilium-envoy,cilium-envoy,85.7,0,128,Defer: network/control-plane resources need coordinated rollout
+kube-system,cilium-operator,cilium-operator,250.7,0,320,Defer: network/control-plane resources need coordinated rollout
+kube-system,coredns,coredns,141.4,70,192,Defer: formula exceeds existing limit; investigate before changing limits
+kube-system,hubble-relay,hubble-relay,60.2,0,128,Defer: network/control-plane resources need coordinated rollout
+kube-system,hubble-ui,backend,37.4,0,64,Defer: network/control-plane resources need coordinated rollout
+kube-system,hubble-ui,frontend,13.7,0,64,Defer: network/control-plane resources need coordinated rollout
+kube-system,metrics-server,metrics-server,87.3,200,128,Retain: existing request covers formula / recovery floor
+kubernetes-dashboard,kubernetes-dashboard-api,kubernetes-dashboard-api,60.3,200,128,Retain: existing request covers formula / recovery floor
+kubernetes-dashboard,kubernetes-dashboard-auth,kubernetes-dashboard-auth,53.6,200,128,Retain: existing request covers formula / recovery floor
+kubernetes-dashboard,kubernetes-dashboard-auth-proxy,proxy,7.3,32,64,Retain: small existing reservation / avoid low-value rollout
+kubernetes-dashboard,kubernetes-dashboard-kong,proxy,145.7,256,192,Retain: existing request covers formula / recovery floor
+kubernetes-dashboard,kubernetes-dashboard-metrics-scraper,kubernetes-dashboard-metrics-scraper,36.3,200,64,Retain: existing request covers formula / recovery floor
+kubernetes-dashboard,kubernetes-dashboard-web,kubernetes-dashboard-web,31.5,200,64,Retain: existing request covers formula / recovery floor
+logging,alloy,alloy,238.9,0,320,Defer: legacy/operator owner not included in this GitOps chart rollout
+logging,alloy,config-reloader,30.9,50,64,Retain: small existing reservation / avoid low-value rollout
+logging,loki,loki,230.6,256,320,Retain: small existing reservation / avoid low-value rollout
+loops,loops-horizon,horizon,224.6,512,320,Retain: existing request covers formula / recovery floor
+loops,loops-scheduler,scheduler,219.6,256,320,Defer: published chart does not expose effective resource settings
+loops,loops-transcoder,local-media,205.5,2048,256,Retain: existing request covers formula / recovery floor
+loops,loops-transcoder,remote-video,207.9,2048,256,Retain: existing request covers formula / recovery floor
+loops,loops-web,loops,331.4,768,448,Retain: existing request covers formula / recovery floor
+loops,mysql,mysql,569.3,768,704,Retain: existing request covers formula / recovery floor
+loops,valkey,valkey,39.7,256,64,Retain: existing request covers formula / recovery floor
+mastodon,mastodon-sidekiq-all-queues,mastodon,1587.8,768,1920,Update in apps/mastodon/values.yaml
+mastodon,mastodon-streaming,mastodon-streaming,177.4,256,256,Retain: existing request covers formula / recovery floor
+mastodon,mastodon-web,mastodon-web,1037.6,768,1280,Update in apps/mastodon/values.yaml
+mastodon,postgresql,postgresql,160.4,512,256,Retain: existing request covers formula / recovery floor
+mastodon,valkey,valkey,32.8,256,64,Retain: existing request covers formula / recovery floor
+matrix,element-web,element-web,14.6,32,64,Retain: small existing reservation / avoid low-value rollout
+matrix,matrix-authentication-haproxy,haproxy,91.9,100,128,Retain: small existing reservation / avoid low-value rollout
+matrix,matrix-authentication-matrix-authentication-service,matrix-authentication-service,,50,,Retain: no matching usable history
+matrix,matrix-authentication-matrix-rtc-authorisation-service,matrix-rtc-authorisation-service,,50,,Retain: no matching usable history
+matrix,matrix-authentication-matrix-rtc-sfu,sfu,78.3,150,128,Retain: existing request covers formula / recovery floor
+matrix,matrix-authentication-synapse-background,synapse,449.5,512,576,Update legacy matrix/authentication/values.yaml; requires separate Helm rollout
+matrix,matrix-authentication-synapse-client-reader,synapse,367.4,512,448,Retain: existing request covers formula / recovery floor
+matrix,matrix-authentication-synapse-event-creator,synapse,244.1,512,320,Retain: existing request covers formula / recovery floor
+matrix,matrix-authentication-synapse-fed-inbound,synapse,1249.4,512,1536,Update legacy matrix/authentication/values.yaml; requires separate Helm rollout
+matrix,matrix-authentication-synapse-fed-sender,synapse,582.9,512,704,Update legacy matrix/authentication/values.yaml; requires separate Helm rollout
+matrix,matrix-authentication-synapse-main,synapse,1905.2,512,2304,Update legacy matrix/authentication/values.yaml; requires separate Helm rollout
+matrix,matrix-authentication-synapse-media-repo,synapse,371.9,512,448,Retain: existing request covers formula / recovery floor
+matrix,matrix-authentication-synapse-sliding-sync,synapse,281.0,512,384,Retain: existing request covers formula / recovery floor
+matrix,matrix-authentication-valkey,valkey,29.6,50,64,Defer: formula exceeds existing limit; investigate before changing limits
+matrix,matrix-authentication-valkey,valkey-exporter,19.7,10,64,Defer: formula exceeds existing limit; investigate before changing limits
+matrix,mautrix-gmessages,blackbox-exporter,39.5,32,64,Retain: small existing reservation / avoid low-value rollout
+matrix,mautrix-gmessages,mautrix-gmessages,48.3,32,64,Retain: small existing reservation / avoid low-value rollout
+matrix,mautrix-meta,blackbox-exporter,38.2,32,64,Retain: small existing reservation / avoid low-value rollout
+matrix,mautrix-meta,mautrix-meta,50.5,64,64,Retain: existing request covers formula / recovery floor
+matrix,mautrix-signal,blackbox-exporter,40.8,32,64,Retain: small existing reservation / avoid low-value rollout
+matrix,mautrix-signal,mautrix-signal,208.3,128,256,Defer: legacy/operator owner not included in this GitOps chart rollout
+matrix,mautrix-slack,blackbox-exporter,38.9,32,64,Retain: small existing reservation / avoid low-value rollout
+matrix,mautrix-slack,mautrix-slack,37.1,32,64,Retain: small existing reservation / avoid low-value rollout
+matrix,mautrix-telegram,blackbox-exporter,40.6,32,64,Retain: small existing reservation / avoid low-value rollout
+matrix,mautrix-telegram,mautrix-telegram,85.9,128,128,Retain: existing request covers formula / recovery floor
+matrix,mautrix-whatsapp,blackbox-exporter,22.8,32,64,Retain: small existing reservation / avoid low-value rollout
+matrix,mautrix-whatsapp,mautrix-whatsapp,50.9,64,64,Retain: existing request covers formula / recovery floor
+matrix,postgresql,postgresql,421.5,1024,512,Retain: existing request covers formula / recovery floor
+matrix,synapse,synapse,2979.9,3072,3584,Defer: legacy/operator owner not included in this GitOps chart rollout
+mcserver,paper,mc-monitor,35.5,0,64,Retain: game/GPU/bursty workload needs representative peak review
+mcserver,paper,paper,4893.9,0,5888,Retain: game/GPU/bursty workload needs representative peak review
+metallb-system,metallb-controller,controller,207.4,0,256,Defer: network/control-plane resources need coordinated rollout
+metallb-system,metallb-frr-k8s,controller,64.0,0,128,Defer: network/control-plane resources need coordinated rollout
+metallb-system,metallb-frr-k8s,frr,69.5,0,128,Defer: network/control-plane resources need coordinated rollout
+metallb-system,metallb-frr-k8s,frr-metrics,45.4,0,64,Defer: network/control-plane resources need coordinated rollout
+metallb-system,metallb-frr-k8s,frr-status,61.4,0,128,Defer: network/control-plane resources need coordinated rollout
+metallb-system,metallb-frr-k8s,reloader,21.1,0,64,Defer: network/control-plane resources need coordinated rollout
+metallb-system,metallb-frr-k8s-statuscleaner,frr-k8s-statuscleaner,38.6,0,64,Defer: network/control-plane resources need coordinated rollout
+metallb-system,metallb-speaker,speaker,109.9,0,192,Defer: network/control-plane resources need coordinated rollout
+mikrotik-operator-system,mikrotik-operator,manager,54.9,48,128,Retain: small existing reservation / avoid low-value rollout
+mumble,mumble,certificate-reloader,4.6,2,64,Defer: formula exceeds existing limit; investigate before changing limits
+mumble,mumble,mumble,65.4,64,128,Retain: small existing reservation / avoid low-value rollout
+nextcloud,nextcloud,nextcloud,380.5,0,512,Update in apps/nextcloud/values.yaml
+nextcloud,nextcloud,nextcloud-cron,153.4,0,192,Update in apps/nextcloud/values.yaml
+nextcloud,nextcloud,notify-push,16.3,32,64,Retain: small existing reservation / avoid low-value rollout
+nextcloud,nextcloud-clamav,clamav,1022.8,1024,1280,Update in apps/nextcloud/clamav-values.yaml
+nextcloud,nextcloud-collabora,collabora,1076.3,0,1344,Update in apps/nextcloud/values.yaml
+nextcloud,nextcloud-imaginary,imaginary,16.2,0,64,Retain: small existing reservation / avoid low-value rollout
+nextcloud,nextcloud-metrics,metrics-exporter,27.8,0,64,Retain: small existing reservation / avoid low-value rollout
+nextcloud,nextcloud-redis-master,redis,19.6,128,64,Retain: existing request covers formula / recovery floor
+nextcloud,nextcloud-redis-replicas,redis,32.4,128,64,Retain: existing request covers formula / recovery floor
+nextcloud,nextcloud-talk-hpb,talk-hpb,144.9,256,192,Retain: existing request covers formula / recovery floor
+nextcloud,nextcloud-whiteboard,whiteboard,114.6,128,192,Update in apps/nextcloud/whiteboard-values.yaml
+oldimpi,oldipmi,browser,695.0,256,896,Update in apps/oldipmi/values.yaml
+ollama,comfyui,comfyui,893.6,49152,1088,Retain: existing request covers formula / recovery floor
+ollama,ollama,ollama,49.8,8192,64,Retain: existing request covers formula / recovery floor
+ollama,open-webui,open-webui,701.7,1024,896,Retain: existing request covers formula / recovery floor
+ombi,ombi,ombi,349.9,0,448,Update in apps/ombi/values.yaml
+paperless-ngx,paperless,paperless,4513.3,1024,5440,Update in apps/paperless/values.yaml
+paperless-ngx,pdf-editor,pdf-editor,398.7,512,512,Retain: existing request covers formula / recovery floor
+paperless-ngx,scanner,scanner,156.0,256,192,Retain: existing request covers formula / recovery floor
+paperless-ngx,valkey,valkey,19.4,64,64,Retain: existing request covers formula / recovery floor
+pixelfed,mysql,mysql,654.4,768,832,Defer: published chart does not expose effective resource settings
+pixelfed,pixelfed-horizon,horizon,1797.9,384,2176,Defer: formula exceeds existing limit; investigate before changing limits
+pixelfed,pixelfed-web,pixelfed,253.6,512,320,Retain: existing request covers formula / recovery floor
+pixelfed,valkey,valkey,30.5,256,64,Retain: existing request covers formula / recovery floor
+plex,plex,plex,901.4,2048,1088,Retain: existing request covers formula / recovery floor
+plex,plex,plex-exporter,40.7,32,64,Retain: small existing reservation / avoid low-value rollout
+prometheus,alertmanager-prometheus-kube-prometheus-alertmanager,alertmanager,93.3,200,128,Retain: existing request covers formula / recovery floor
+prometheus,alertmanager-prometheus-kube-prometheus-alertmanager,config-reloader,42.7,0,64,Retain: small existing reservation / avoid low-value rollout
+prometheus,matrix-alertmanager-receiver,receiver,33.9,0,64,Retain: small existing reservation / avoid low-value rollout
+prometheus,prometheus-kube-prometheus-operator,kube-prometheus-stack,115.1,0,192,Update in apps/prometheus/values.yaml
+prometheus,prometheus-kube-state-metrics,kube-state-metrics,170.0,0,256,Update in apps/prometheus/values.yaml
+prometheus,prometheus-prometheus-kube-prometheus-prometheus,config-reloader,46.7,0,64,Update in apps/prometheus/values.yaml
+prometheus,prometheus-prometheus-kube-prometheus-prometheus,prometheus,3117.3,0,3776,Update in apps/prometheus/values.yaml
+prometheus,prometheus-prometheus-node-exporter,node-exporter,41.0,0,64,Update in apps/prometheus/values.yaml
+quay,quay,quay,9916.9,0,11904,Update in apps/quay/values.yaml
+quay,quay-repomirror,quay-repomirror,273.1,0,384,Update in apps/quay/values.yaml
+quay,quay-valkey-primary,valkey,19.4,128,64,Retain: existing request covers formula / recovery floor
+rook-ceph,ceph-csi-controller-manager,manager,74.2,64,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-crashcollector-odroid-h3-00,ceph-crash,7.8,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-crashcollector-odroid-h3-01,ceph-crash,44.9,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-crashcollector-odroid-h3-02,ceph-crash,45.3,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-crashcollector-odroid-h3-03,ceph-crash,7.9,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-crashcollector-odroid-h3-04,ceph-crash,45.0,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-crashcollector-odroid-h3-05,ceph-crash,45.1,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-00,ceph-exporter,28.4,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-00,log-collector,5.9,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-01,ceph-exporter,49.1,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-01,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-02,ceph-exporter,49.3,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-02,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-03,ceph-exporter,24.1,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-03,log-collector,3.8,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-04,ceph-exporter,40.6,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-04,log-collector,8.0,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-05,ceph-exporter,48.7,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-exporter-odroid-h3-05,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mds-myfs-a,log-collector,7.2,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mds-myfs-a,mds,445.9,0,576,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mds-myfs-b,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mds-myfs-b,mds,238.0,0,320,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mgr-a,log-collector,8.6,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mgr-a,mgr,3553.2,0,4288,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mgr-a,watch-active,123.2,0,192,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mgr-b,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mgr-b,mgr,15914.5,0,19136,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mgr-b,watch-active,95.4,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mon-a,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mon-a,mon,519.3,0,640,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mon-c,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mon-c,mon,1320.4,0,1600,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mon-d,log-collector,3.7,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-mon-d,mon,145.3,0,192,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-nvmeof-nvmeof-a,nvmeof-gateway,691.7,0,832,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-operator,rook-ceph-operator,388.5,0,512,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-0,log-collector,6.3,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-0,osd,23866.9,0,28672,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-1,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-1,osd,24546.1,0,29504,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-2,log-collector,8.0,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-2,osd,22890.3,0,27520,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-3,log-collector,11.7,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-3,osd,22558.3,0,27072,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-4,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-4,osd,23918.8,0,28736,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-5,log-collector,11.7,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-osd-5,osd,26115.6,0,31360,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-rgw-my-store-a,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-rgw-my-store-a,rgw,625.3,0,768,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph-tools,rook-ceph-tools,37.2,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.cephfs.csi.ceph.com-ctrlplugin,csi-attacher,71.9,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.cephfs.csi.ceph.com-ctrlplugin,csi-cephfsplugin,106.1,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.cephfs.csi.ceph.com-ctrlplugin,csi-provisioner,67.5,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.cephfs.csi.ceph.com-ctrlplugin,csi-resizer,74.0,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.cephfs.csi.ceph.com-ctrlplugin,csi-snapshotter,66.8,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.cephfs.csi.ceph.com-nodeplugin,csi-cephfsplugin,122.2,0,192,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.cephfs.csi.ceph.com-nodeplugin,driver-registrar,30.0,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.rbd.csi.ceph.com-ctrlplugin,csi-attacher,67.9,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.rbd.csi.ceph.com-ctrlplugin,csi-provisioner,68.3,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.rbd.csi.ceph.com-ctrlplugin,csi-rbdplugin,120.3,0,192,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.rbd.csi.ceph.com-ctrlplugin,csi-resizer,72.0,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.rbd.csi.ceph.com-ctrlplugin,csi-snapshotter,67.5,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.rbd.csi.ceph.com-nodeplugin,csi-rbdplugin,141.4,0,192,Defer: storage daemon/CSI sizing needs separate coordinated review
+rook-ceph,rook-ceph.rbd.csi.ceph.com-nodeplugin,driver-registrar,27.6,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review
+sealed-secrets,sealed-secrets-controller,controller,115.7,32,192,Defer: formula exceeds existing limit; investigate before changing limits
@@ -0,0 +1,73 @@
+# Memory request review
+
+## Review on 2026-11-04
+
+This uses the CPU review's p95 plus 20% headroom method for memory requests.
+Prometheus was queried over the previous 14 days, sampled every 15 minutes:
+
+```promql
+quantile_over_time(0.95,
+  (max by(namespace,pod,container)
+    (container_memory_working_set_bytes{container!="",container!="POD"})
+  )[14d:15m])
+```
+
+The largest matching replica/pod-history p95 is used for each current workload
+container, including previous ReplicaSets. The inner max deduplicates scrape
+series; it does not add replicas together. History coverage was checked using
+`count_over_time` on the same subquery. The longest series covers about 13.8 days;
+individual replacement pods have shorter histories. Working set is a practical
+scheduling estimate, not a guaranteed upper bound on allocation or peak demand.
+
+Requests are rounded upward to a 64 MiB boundary after multiplying by 1.2.
+Existing higher requests and startup/recovery floors are retained. CPU values,
+memory limits, images, replicas, storage and placement rules are unchanged.
+Requests account for scheduling capacity; they do not cap memory consumption.
+The scheduler considers init-container requirements as well as normal containers.
+
+The accompanying `memory-sizing-2026-11-04.csv` is a dated measurement and decision
+record, not an install-time configuration source. Owning values files remain
+canonical. It records both changes and exclusions rather than claiming every
+container was automatically resized.
+
+## Scope and exclusions
+
+The GitOps changes cover 49 measured container settings across 30 chart
+applications. Some chart settings also affect init containers; the Prometheus
+operator's config-reloader request applies to both Prometheus and Alertmanager.
+The main gaps include Quay, Immich, Paperless, Prometheus, Argo CD, and services
+with no previous memory reservation. InfluxDB retains its existing request,
+which is above the history-based recommendation.
+
+The legacy Matrix authentication Helm release has four corresponding request
+increases in `matrix/authentication/values.yaml` in the homelab workspace. It
+requires its existing Helm installation path; it is not managed by this repo.
+Unchanged workers retain their shared resource anchor and existing floors.
+
+- Ceph daemons and CSI are excluded to avoid an unreviewed storage-wide rollout.
+- Network/control-plane components require a coordinated capacity review.
+- Operator-owned databases, game/GPU servers and bursty jobs retain their
+  reservations; idle measurements are not sufficient peak-demand evidence.
+- Copyparty has very short history dominated by OOM failures under its former
+  limit. Review again after representative operation with the new limit.
+- Recommendations above existing memory limits are recorded for investigation,
+  not silently capped or paired with unsolicited limit changes.
+- Diun's published chart declares a resources value but does not render it.
+  Loops/Pixelfed also need chart-interface work for hard-coded resources.
+  Unsupported values have not been added.
+- Small existing reservations and unrelated legacy deployments are retained.
+
+## Validation and rollout
+
+Render and lint the exact pinned charts using the same values as Argo CD.
+Compare resources before/after and assert intended requests are actually rendered;
+check the Prometheus operator's config-reloader argument separately. Validate
+changed workloads with server-side dry-run. Do not delete PVCs or force-delete
+stateful pods to make a new reservation fit.
+
+At preparation time `intel-xeon` was unreachable and its Argo application
+controller pod was terminating. Helm rendering does not establish successful
+deployment. After controller recovery, verify Argo sync/health, pending pods,
+node memory and request totals, application responses and unchanged PVC volumes.
+If a workload cannot fit, review capacity/placement rather than reducing its
+request merely to hide the scheduling failure.