diff --git a/apps/argocd/values.yaml b/apps/argocd/values.yaml index 1057a5f..a2d91e5 100644 --- a/apps/argocd/values.yaml +++ b/apps/argocd/values.yaml @@ -34,6 +34,9 @@ notifications: secret: create: false + resources: + requests: + memory: 256Mi redisSecretInit: enabled: false @@ -42,3 +45,26 @@ server: enabled: true annotations: traefik.ingress.kubernetes.io/router.entrypoints: websecure + resources: + requests: + memory: 256Mi +controller: + resources: + requests: + memory: 1664Mi +applicationSet: + resources: + requests: + memory: 256Mi +dex: + resources: + requests: + memory: 256Mi +repoServer: + resources: + requests: + memory: 320Mi +redis: + resources: + requests: + memory: 128Mi diff --git a/apps/authentik/values.yaml b/apps/authentik/values.yaml index 9434a68..0a0d18f 100644 --- a/apps/authentik/values.yaml +++ b/apps/authentik/values.yaml @@ -50,7 +50,7 @@ server: resources: requests: cpu: 150m - memory: 1Gi + memory: 1344Mi limits: # Deliberately leave CPU unlimited so login bursts can use idle cores. memory: 2Gi @@ -94,6 +94,7 @@ worker: resources: requests: cpu: 150m + memory: 576Mi enabled: true livenessProbe: timeoutSeconds: 10 diff --git a/apps/brgkepler-com/values.yaml b/apps/brgkepler-com/values.yaml index b0238e9..e50c508 100644 --- a/apps/brgkepler-com/values.yaml +++ b/apps/brgkepler-com/values.yaml @@ -20,3 +20,6 @@ ingress: - hosts: - brgkepler.com secretName: brgkepler-com-tls +resources: + requests: + memory: 192Mi diff --git a/apps/brunner-ninja/values.yaml b/apps/brunner-ninja/values.yaml index 94c85a9..90775ea 100644 --- a/apps/brunner-ninja/values.yaml +++ b/apps/brunner-ninja/values.yaml @@ -24,3 +24,4 @@ ingress: resources: requests: cpu: 175m + memory: 384Mi diff --git a/apps/cert-manager/values.yaml b/apps/cert-manager/values.yaml index f5c537f..8e82d4b 100644 --- a/apps/cert-manager/values.yaml +++ b/apps/cert-manager/values.yaml @@ -4,3 +4,14 @@ crds: extraArgs: - --dns01-recursive-nameservers-only - --dns01-recursive-nameservers=1.1.1.1:53,8.8.8.8:53 +resources: + requests: + memory: 192Mi +cainjector: + resources: + requests: + memory: 128Mi +webhook: + resources: + requests: + memory: 128Mi diff --git a/apps/flaresolverr/values.yaml b/apps/flaresolverr/values.yaml index 04b6e06..b274ef5 100644 --- a/apps/flaresolverr/values.yaml +++ b/apps/flaresolverr/values.yaml @@ -10,3 +10,6 @@ ingress: - path: / annotations: traefik.ingress.kubernetes.io/router.entrypoints: websecure +resources: + requests: + memory: 128Mi diff --git a/apps/ghostfolio/values.yaml b/apps/ghostfolio/values.yaml index 8744556..f45a511 100644 --- a/apps/ghostfolio/values.yaml +++ b/apps/ghostfolio/values.yaml @@ -8,7 +8,7 @@ image: resources: requests: cpu: 25m - memory: 384Mi + memory: 640Mi limits: cpu: "1" memory: 1Gi diff --git a/apps/grafana/values.yaml b/apps/grafana/values.yaml index 57c246a..cd3a72c 100644 --- a/apps/grafana/values.yaml +++ b/apps/grafana/values.yaml @@ -44,6 +44,9 @@ sidecar: provider: allowUiUpdates: true + resources: + requests: + memory: 128Mi grafana.ini: server: domain: grafana.brunner.ninja @@ -86,3 +89,4 @@ grafana.ini: resources: requests: cpu: 75m + memory: 1280Mi diff --git a/apps/gschissenes-equipment/values.yaml b/apps/gschissenes-equipment/values.yaml index 3651350..85a55ef 100644 --- a/apps/gschissenes-equipment/values.yaml +++ b/apps/gschissenes-equipment/values.yaml @@ -20,3 +20,6 @@ ingress: - hosts: - gschissenes.equipment secretName: gschissenes-equipment-tls +resources: + requests: + memory: 192Mi diff --git a/apps/home-assistant/values.yaml b/apps/home-assistant/values.yaml index b22ba0a..2163b68 100644 --- a/apps/home-assistant/values.yaml +++ b/apps/home-assistant/values.yaml @@ -24,3 +24,4 @@ ingress: resources: requests: cpu: 175m + memory: 1472Mi diff --git a/apps/immich/values.yaml b/apps/immich/values.yaml index c2b38a2..1b6814a 100644 --- a/apps/immich/values.yaml +++ b/apps/immich/values.yaml @@ -69,6 +69,9 @@ server: secretKeyRef: name: immich-postgresql-app key: password + resources: + requests: + memory: 7744Mi ingress: main: enabled: false @@ -101,6 +104,9 @@ machine-learning: runAsNonRoot: true runAsUser: 1000 runAsGroup: 1000 + resources: + requests: + memory: 1408Mi initContainers: check-bcachefs-library: image: diff --git a/apps/jellyfin/values.yaml b/apps/jellyfin/values.yaml index 020b804..2ccae2d 100644 --- a/apps/jellyfin/values.yaml +++ b/apps/jellyfin/values.yaml @@ -15,7 +15,7 @@ publishedServerUrl: https://jellyfin.brunner.ninja resources: requests: cpu: 500m - memory: 2Gi + memory: 3520Mi ephemeral-storage: 1Gi ingress: enabled: true diff --git a/apps/mastodon/values.yaml b/apps/mastodon/values.yaml index 72a650c..7782e9f 100644 --- a/apps/mastodon/values.yaml +++ b/apps/mastodon/values.yaml @@ -50,7 +50,7 @@ mastodon: resources: requests: cpu: 50m - memory: 768Mi + memory: 1280Mi limits: cpu: "2" memory: 2Gi @@ -71,7 +71,7 @@ mastodon: resources: requests: cpu: 50m - memory: 768Mi + memory: 1920Mi limits: cpu: "2" memory: 2Gi diff --git a/apps/mktxp/values.yaml b/apps/mktxp/values.yaml index 11bc926..504616f 100644 --- a/apps/mktxp/values.yaml +++ b/apps/mktxp/values.yaml @@ -7,5 +7,6 @@ serviceMonitor: resources: requests: cpu: 175m + memory: 256Mi limits: cpu: diff --git a/apps/nextcloud/clamav-values.yaml b/apps/nextcloud/clamav-values.yaml index c61afe2..1eb43cc 100644 --- a/apps/nextcloud/clamav-values.yaml +++ b/apps/nextcloud/clamav-values.yaml @@ -12,7 +12,7 @@ initResources: resources: requests: cpu: 100m - memory: 1Gi + memory: 1280Mi limits: cpu: 2 memory: 3Gi diff --git a/apps/nextcloud/values.yaml b/apps/nextcloud/values.yaml index fc711ef..73b0d56 100644 --- a/apps/nextcloud/values.yaml +++ b/apps/nextcloud/values.yaml @@ -239,8 +239,15 @@ collabora: paths: - path: / pathType: ImplementationSpecific + resources: + requests: + memory: 1344Mi cronjob: enabled: true + sidecar: + resources: + requests: + memory: 192Mi persistence: enabled: true storageClass: rook-ceph-block @@ -257,3 +264,6 @@ prometheus: enabled: false rules: enabled: true +resources: + requests: + memory: 512Mi diff --git a/apps/nextcloud/whiteboard-values.yaml b/apps/nextcloud/whiteboard-values.yaml index c31d9c7..900690b 100644 --- a/apps/nextcloud/whiteboard-values.yaml +++ b/apps/nextcloud/whiteboard-values.yaml @@ -5,7 +5,7 @@ jwtSecret: resources: requests: cpu: 50m - memory: 128Mi + memory: 192Mi limits: cpu: 1 memory: 1Gi diff --git a/apps/oldipmi/values.yaml b/apps/oldipmi/values.yaml index 8e17f0b..548e82e 100644 --- a/apps/oldipmi/values.yaml +++ b/apps/oldipmi/values.yaml @@ -16,3 +16,6 @@ networkPolicy: app.kubernetes.io/name: traefik app.kubernetes.io/instance: traefik-default # Cilium policy supplies external egress with explicit cluster exclusions. +resources: + requests: + memory: 896Mi diff --git a/apps/ombi/values.yaml b/apps/ombi/values.yaml index 5bd4fc1..f8045dd 100644 --- a/apps/ombi/values.yaml +++ b/apps/ombi/values.yaml @@ -24,3 +24,6 @@ persistence: storageClass: rook-ceph-block accessMode: ReadWriteOnce retain: true +resources: + requests: + memory: 448Mi diff --git a/apps/paperless/values.yaml b/apps/paperless/values.yaml index 63f7d11..6745a66 100644 --- a/apps/paperless/values.yaml +++ b/apps/paperless/values.yaml @@ -45,4 +45,4 @@ affinity: resources: requests: cpu: 50m - memory: 1Gi + memory: 5440Mi diff --git a/apps/pfostendynamics-com/values.yaml b/apps/pfostendynamics-com/values.yaml index e998f85..4af2914 100644 --- a/apps/pfostendynamics-com/values.yaml +++ b/apps/pfostendynamics-com/values.yaml @@ -11,3 +11,6 @@ persistence: existingClaim: pfostendynamics-com ingress: enabled: false +resources: + requests: + memory: 192Mi diff --git a/apps/phppgadmin/values.yaml b/apps/phppgadmin/values.yaml index 7bebe90..a4f4e0f 100644 --- a/apps/phppgadmin/values.yaml +++ b/apps/phppgadmin/values.yaml @@ -20,3 +20,6 @@ servers: host: postgresql.gramps.svc.cluster.local - description: postgresql.matrix.svc.cluster.local host: postgresql.matrix.svc.cluster.local +resources: + requests: + memory: 128Mi diff --git a/apps/prometheus/values.yaml b/apps/prometheus/values.yaml index 2ab8ba2..a650704 100644 --- a/apps/prometheus/values.yaml +++ b/apps/prometheus/values.yaml @@ -16,6 +16,9 @@ prometheus-node-exporter: regex: 'node_filesystem_.+;bcachefs;(/komposthaufen|/var/www|/var/lib/(lidarr|prowlarr|radarr|readarr|sonarr|whisparr)|/home/feedc0de/(\.steam/steamapps|mcserver/plugins/dynmap/web/tiles))' action: drop + resources: + requests: + memory: 64Mi alertmanager: ingress: enabled: true @@ -91,6 +94,7 @@ prometheus: resources: requests: cpu: 200m + memory: 3776Mi retention: "15d" storageSpec: volumeClaimTemplate: @@ -104,3 +108,15 @@ prometheus: serviceMonitorSelector: {} ruleSelectorNilUsesHelmValues: false ruleSelector: {} +prometheusOperator: + resources: + requests: + memory: 192Mi + prometheusConfigReloader: + resources: + requests: + memory: 64Mi +kube-state-metrics: + resources: + requests: + memory: 256Mi diff --git a/apps/quay/values.yaml b/apps/quay/values.yaml index e21a485..650bc65 100644 --- a/apps/quay/values.yaml +++ b/apps/quay/values.yaml @@ -30,3 +30,9 @@ valkey: persistence: storageClass: rook-ceph-block-ec size: 2Gi +resources: + requests: + memory: 11904Mi +repomirrorResources: + requests: + memory: 384Mi diff --git a/apps/tautulli/values.yaml b/apps/tautulli/values.yaml index 8e44606..a1142f2 100644 --- a/apps/tautulli/values.yaml +++ b/apps/tautulli/values.yaml @@ -30,3 +30,6 @@ persistence: size: 60Gi storageClass: rook-ceph-block accessMode: ReadWriteOnce +resources: + requests: + memory: 192Mi diff --git a/apps/traefik/values.yaml b/apps/traefik/values.yaml index 1b9c6f3..977f6f8 100644 --- a/apps/traefik/values.yaml +++ b/apps/traefik/values.yaml @@ -12,7 +12,7 @@ podDisruptionBudget: resources: requests: cpu: 700m - memory: 1Gi + memory: 3072Mi affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: diff --git a/apps/uptime-kuma/values.yaml b/apps/uptime-kuma/values.yaml index 82fddf1..23edd84 100644 --- a/apps/uptime-kuma/values.yaml +++ b/apps/uptime-kuma/values.yaml @@ -21,7 +21,7 @@ readinessProbe: resources: requests: cpu: 75m - memory: 256Mi + memory: 512Mi ephemeral-storage: 128Mi limits: memory: 1Gi diff --git a/apps/visual-studio-code/values.yaml b/apps/visual-studio-code/values.yaml index b5a85b5..343cfa8 100644 --- a/apps/visual-studio-code/values.yaml +++ b/apps/visual-studio-code/values.yaml @@ -25,3 +25,6 @@ ingress: annotations: traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd +resources: + requests: + memory: 192Mi diff --git a/apps/wiki-js/values.yaml b/apps/wiki-js/values.yaml index 84f3280..74a30aa 100644 --- a/apps/wiki-js/values.yaml +++ b/apps/wiki-js/values.yaml @@ -24,3 +24,6 @@ externalPostgresql: existingSecret: wiki-js existingSecretKey: postgresql-password ssl: false +resources: + requests: + memory: 256Mi diff --git a/bootstrap/cnpg-operator.yaml b/bootstrap/cnpg-operator.yaml index 99e4525..a3522fb 100644 --- a/bootstrap/cnpg-operator.yaml +++ b/bootstrap/cnpg-operator.yaml @@ -13,6 +13,10 @@ spec: targetRevision: 0.29.1 helm: releaseName: cnpg-operator + valuesObject: + resources: + requests: + memory: 256Mi destination: server: https://kubernetes.default.svc namespace: cnpg-system diff --git a/docs/memory-sizing-2026-11-04.csv b/docs/memory-sizing-2026-11-04.csv new file mode 100644 index 0000000..f214de7 --- /dev/null +++ b/docs/memory-sizing-2026-11-04.csv @@ -0,0 +1,282 @@ +namespace,workload,container,observed_p95_MiB,previous_request_MiB,formula_MiB,decision +argocd,argocd-application-controller,application-controller,1339.0,0,1664,Update in apps/argocd/values.yaml +argocd,argocd-applicationset-controller,applicationset-controller,179.2,0,256,Update in apps/argocd/values.yaml +argocd,argocd-dex-server,dex-server,189.3,0,256,Update in apps/argocd/values.yaml +argocd,argocd-notifications-controller,notifications-controller,175.4,0,256,Update in apps/argocd/values.yaml +argocd,argocd-redis,redis,58.6,0,128,Update in apps/argocd/values.yaml +argocd,argocd-repo-server,repo-server,224.0,0,320,Update in apps/argocd/values.yaml +argocd,argocd-server,server,199.2,0,256,Update in apps/argocd/values.yaml +artcraft,cadcraft,cadcraft,13.9,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,cadcraft,nginx-exporter,23.5,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,deckcraft,deckcraft,13.8,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,deckcraft,nginx-exporter,28.1,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,designcraft,designcraft,6.6,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,designcraft,nginx-exporter,28.2,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,effectcraft,effectcraft,13.8,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,effectcraft,nginx-exporter,30.8,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,figcraft,figcraft,14.1,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,figcraft,nginx-exporter,20.9,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,filmcraft,filmcraft,6.7,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,filmcraft,nginx-exporter,27.9,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,gridcraft,gridcraft,13.9,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,gridcraft,nginx-exporter,28.2,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,lightcraft,lightcraft,6.6,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,lightcraft,nginx-exporter,26.5,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,pdfcraft,nginx-exporter,21.5,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,pdfcraft,pdfcraft,14.4,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,photocraft,nginx-exporter,26.6,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,photocraft,photocraft,13.8,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,soundcraft,nginx-exporter,29.5,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,soundcraft,soundcraft,13.8,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,vectorcraft,nginx-exporter,27.0,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,vectorcraft,vectorcraft,13.9,32,64,Retain: small existing reservation / avoid low-value rollout +artcraft,wordcraft,nginx-exporter,25.5,16,64,Retain: small existing reservation / avoid low-value rollout +artcraft,wordcraft,wordcraft,14.0,32,64,Retain: small existing reservation / avoid low-value rollout +asciinema,asciinema,asciinema,206.9,256,256,Retain: existing request covers formula / recovery floor +atm10,atm10,atm10,7653.4,0,9216,Retain: game/GPU/bursty workload needs representative peak review +atm10,atm10,mc-monitor,35.5,0,64,Retain: game/GPU/bursty workload needs representative peak review +authentik,ak-outpost-ldap,ldap,79.0,0,128,Defer: legacy/operator owner not included in this GitOps chart rollout +authentik,ak-outpost-rac,rac,105.8,0,128,Defer: legacy/operator owner not included in this GitOps chart rollout +authentik,ak-outpost-radius,radius,86.1,0,128,Defer: legacy/operator owner not included in this GitOps chart rollout +authentik,authentik-server,server,1114.3,1024,1344,Update in apps/authentik/values.yaml +authentik,authentik-worker,worker,441.1,0,576,Update in apps/authentik/values.yaml +brave-sync,brave-sync,sync,38.1,96,64,Retain: existing request covers formula / recovery floor +brave-sync,brave-sync-dynamodb,dynamodb,331.2,512,448,Retain: existing request covers formula / recovery floor +brave-sync,brave-sync-valkey,valkey,27.5,32,64,Retain: small existing reservation / avoid low-value rollout +cert-manager,cert-manager,cert-manager-controller,117.4,0,192,Update in apps/cert-manager/values.yaml +cert-manager,cert-manager-cainjector,cert-manager-cainjector,104.6,0,128,Update in apps/cert-manager/values.yaml +cert-manager,cert-manager-webhook,cert-manager-webhook,72.0,0,128,Update in apps/cert-manager/values.yaml +cnpg-system,cnpg-operator-cloudnative-pg,manager,164.1,0,256,Update in bootstrap/cnpg-operator.yaml +copyparty,copyparty,copyparty,2077.1,256,2496,Defer: short OOM-censored history; recently changed memory limit +coturn,coturn,coturn,47.1,50,64,Defer: formula exceeds existing limit; investigate before changing limits +default,30-birthday,30-birthday,72.7,32,128,Retain: small existing reservation / avoid low-value rollout +default,brgkepler-com,apache-exporter,26.4,0,64,Retain: small existing reservation / avoid low-value rollout +default,brgkepler-com,brgkepler-com,125.8,0,192,Update in apps/brgkepler-com/values.yaml +default,brunner-ninja,apache-exporter,26.9,0,64,Retain: small existing reservation / avoid low-value rollout +default,brunner-ninja,brunner-ninja,298.5,0,384,Update in apps/brunner-ninja/values.yaml +default,flaresolverr,flaresolverr,58.2,0,128,Update in apps/flaresolverr/values.yaml +default,gitea-anubis,anubis,97.8,128,128,Retain: existing request covers formula / recovery floor +default,grafana,grafana,1054.1,0,1280,Update in apps/grafana/values.yaml +default,grafana,grafana-sc-dashboard,95.4,0,128,Update in apps/grafana/values.yaml +default,gschissenes-equipment,apache-exporter,27.8,0,64,Retain: small existing reservation / avoid low-value rollout +default,gschissenes-equipment,gschissenes-equipment,138.6,0,192,Update in apps/gschissenes-equipment/values.yaml +default,home-assistant,home-assistant,1213.6,0,1472,Update in apps/home-assistant/values.yaml +default,immich-crack,apache-exporter,26.7,0,64,Retain: small existing reservation / avoid low-value rollout +default,immich-crack,immich-crack,79.1,0,128,Defer: legacy/operator owner not included in this GitOps chart rollout +default,immich-sync,immich-sync,38.1,32,64,Retain: small existing reservation / avoid low-value rollout +default,immichframe,immichframe,86.2,256,128,Retain: existing request covers formula / recovery floor +default,influxdb2,influxdb2,1508.1,2048,1856,Retain: existing request covers formula / recovery floor +default,mktxp-exporter,mktxp,195.9,0,256,Update in apps/mktxp/values.yaml +default,mosquitto,mosquitto,6.6,0,64,Retain: small existing reservation / avoid low-value rollout +default,pfostendynamics-com,apache-exporter,27.1,0,64,Retain: small existing reservation / avoid low-value rollout +default,pfostendynamics-com,pfostendynamics-com,122.6,0,192,Update in apps/pfostendynamics-com/values.yaml +default,phppgadmin,phppgadmin,96.7,0,128,Update in apps/phppgadmin/values.yaml +default,postgresql,postgresql,287.4,1024,384,Retain: existing request covers formula / recovery floor +default,routeros-wifi-vlan,reconciler,32.2,64,64,Retain: existing request covers formula / recovery floor +default,tautulli,tautulli,111.9,0,192,Update in apps/tautulli/values.yaml +default,traefik,traefik,2548.1,1024,3072,Update in apps/traefik/values.yaml +default,traefik-error-pages,nginx,13.7,16,64,Retain: small existing reservation / avoid low-value rollout +default,uptime-kuma,uptime-kuma,398.2,256,512,Update in apps/uptime-kuma/values.yaml +default,valkey-primary,valkey,97.8,512,128,Retain: existing request covers formula / recovery floor +default,valkey-replicas,valkey,98.0,512,128,Retain: existing request covers formula / recovery floor +default,visual-studio-code,visual-studio-code,129.1,0,192,Update in apps/visual-studio-code/values.yaml +default,watschn-studio,apache-exporter,27.3,0,64,Retain: small existing reservation / avoid low-value rollout +default,watschn-studio,watschn-studio,41.2,0,64,Retain: small existing reservation / avoid low-value rollout +default,wiki-js,wiki,194.8,0,256,Update in apps/wiki-js/values.yaml +diun,diun,diun,91.0,0,128,Defer: published chart does not expose effective resource settings +elastic,elastic-operator,manager,126.4,256,192,Retain: existing request covers formula / recovery floor +elastic,elasticsearch-es-data,elasticsearch,7888.5,12288,9472,Retain: existing request covers formula / recovery floor +elastic,kibana-kb,kibana,1296.0,4096,1600,Retain: existing request covers formula / recovery floor +elastic,netflow-beat-filebeat,filebeat,359.8,1024,448,Retain: existing request covers formula / recovery floor +elastic,traefik-access-agent,agent,965.2,256,1216,Defer: formula exceeds existing limit; investigate before changing limits +factorio,factorio,exporter,30.2,24,64,Retain: game/GPU/bursty workload needs representative peak review +factorio,factorio,factorio,294.2,2048,384,Retain: existing request covers formula / recovery floor +factorio,factorio,player-collector,4.2,16,64,Retain: game/GPU/bursty workload needs representative peak review +garrysmod,garrysmod,loading-screen,40.6,32,64,Retain: game/GPU/bursty workload needs representative peak review +garrysmod,garrysmod,server,355.2,768,448,Retain: existing request covers formula / recovery floor +garrysmod,garrysmod,srcds-exporter,32.0,24,64,Retain: game/GPU/bursty workload needs representative peak review +ghostfolio,ghostfolio,ghostfolio,500.3,384,640,Update in apps/ghostfolio/values.yaml +ghostfolio,ghostfolio-valkey,ghostfolio-valkey,18.4,64,64,Retain: existing request covers formula / recovery floor +gramps,grampsweb,gramps-web,1579.8,512,1920,Defer: legacy/operator owner not included in this GitOps chart rollout +gramps,grampsweb-celery,worker,321.4,256,448,Defer: legacy/operator owner not included in this GitOps chart rollout +gramps,valkey-primary,valkey,33.1,64,64,Retain: existing request covers formula / recovery floor +gramps,valkey-replicas,valkey,35.2,64,64,Retain: existing request covers formula / recovery floor +immich,immich-machine-learning,main,1137.6,0,1408,Update in apps/immich/values.yaml +immich,immich-server,main,6432.0,0,7744,Update in apps/immich/values.yaml +immich,immich-valkey,main,38.1,0,64,Retain: small existing reservation / avoid low-value rollout +jellyfin,jellyfin,jellyfin,2924.5,2048,3520,Update in apps/jellyfin/values.yaml +kube-system,cilium,cilium-agent,888.5,0,1088,Defer: network/control-plane resources need coordinated rollout +kube-system,cilium-envoy,cilium-envoy,85.7,0,128,Defer: network/control-plane resources need coordinated rollout +kube-system,cilium-operator,cilium-operator,250.7,0,320,Defer: network/control-plane resources need coordinated rollout +kube-system,coredns,coredns,141.4,70,192,Defer: formula exceeds existing limit; investigate before changing limits +kube-system,hubble-relay,hubble-relay,60.2,0,128,Defer: network/control-plane resources need coordinated rollout +kube-system,hubble-ui,backend,37.4,0,64,Defer: network/control-plane resources need coordinated rollout +kube-system,hubble-ui,frontend,13.7,0,64,Defer: network/control-plane resources need coordinated rollout +kube-system,metrics-server,metrics-server,87.3,200,128,Retain: existing request covers formula / recovery floor +kubernetes-dashboard,kubernetes-dashboard-api,kubernetes-dashboard-api,60.3,200,128,Retain: existing request covers formula / recovery floor +kubernetes-dashboard,kubernetes-dashboard-auth,kubernetes-dashboard-auth,53.6,200,128,Retain: existing request covers formula / recovery floor +kubernetes-dashboard,kubernetes-dashboard-auth-proxy,proxy,7.3,32,64,Retain: small existing reservation / avoid low-value rollout +kubernetes-dashboard,kubernetes-dashboard-kong,proxy,145.7,256,192,Retain: existing request covers formula / recovery floor +kubernetes-dashboard,kubernetes-dashboard-metrics-scraper,kubernetes-dashboard-metrics-scraper,36.3,200,64,Retain: existing request covers formula / recovery floor +kubernetes-dashboard,kubernetes-dashboard-web,kubernetes-dashboard-web,31.5,200,64,Retain: existing request covers formula / recovery floor +logging,alloy,alloy,238.9,0,320,Defer: legacy/operator owner not included in this GitOps chart rollout +logging,alloy,config-reloader,30.9,50,64,Retain: small existing reservation / avoid low-value rollout +logging,loki,loki,230.6,256,320,Retain: small existing reservation / avoid low-value rollout +loops,loops-horizon,horizon,224.6,512,320,Retain: existing request covers formula / recovery floor +loops,loops-scheduler,scheduler,219.6,256,320,Defer: published chart does not expose effective resource settings +loops,loops-transcoder,local-media,205.5,2048,256,Retain: existing request covers formula / recovery floor +loops,loops-transcoder,remote-video,207.9,2048,256,Retain: existing request covers formula / recovery floor +loops,loops-web,loops,331.4,768,448,Retain: existing request covers formula / recovery floor +loops,mysql,mysql,569.3,768,704,Retain: existing request covers formula / recovery floor +loops,valkey,valkey,39.7,256,64,Retain: existing request covers formula / recovery floor +mastodon,mastodon-sidekiq-all-queues,mastodon,1587.8,768,1920,Update in apps/mastodon/values.yaml +mastodon,mastodon-streaming,mastodon-streaming,177.4,256,256,Retain: existing request covers formula / recovery floor +mastodon,mastodon-web,mastodon-web,1037.6,768,1280,Update in apps/mastodon/values.yaml +mastodon,postgresql,postgresql,160.4,512,256,Retain: existing request covers formula / recovery floor +mastodon,valkey,valkey,32.8,256,64,Retain: existing request covers formula / recovery floor +matrix,element-web,element-web,14.6,32,64,Retain: small existing reservation / avoid low-value rollout +matrix,matrix-authentication-haproxy,haproxy,91.9,100,128,Retain: small existing reservation / avoid low-value rollout +matrix,matrix-authentication-matrix-authentication-service,matrix-authentication-service,,50,,Retain: no matching usable history +matrix,matrix-authentication-matrix-rtc-authorisation-service,matrix-rtc-authorisation-service,,50,,Retain: no matching usable history +matrix,matrix-authentication-matrix-rtc-sfu,sfu,78.3,150,128,Retain: existing request covers formula / recovery floor +matrix,matrix-authentication-synapse-background,synapse,449.5,512,576,Update legacy matrix/authentication/values.yaml; requires separate Helm rollout +matrix,matrix-authentication-synapse-client-reader,synapse,367.4,512,448,Retain: existing request covers formula / recovery floor +matrix,matrix-authentication-synapse-event-creator,synapse,244.1,512,320,Retain: existing request covers formula / recovery floor +matrix,matrix-authentication-synapse-fed-inbound,synapse,1249.4,512,1536,Update legacy matrix/authentication/values.yaml; requires separate Helm rollout +matrix,matrix-authentication-synapse-fed-sender,synapse,582.9,512,704,Update legacy matrix/authentication/values.yaml; requires separate Helm rollout +matrix,matrix-authentication-synapse-main,synapse,1905.2,512,2304,Update legacy matrix/authentication/values.yaml; requires separate Helm rollout +matrix,matrix-authentication-synapse-media-repo,synapse,371.9,512,448,Retain: existing request covers formula / recovery floor +matrix,matrix-authentication-synapse-sliding-sync,synapse,281.0,512,384,Retain: existing request covers formula / recovery floor +matrix,matrix-authentication-valkey,valkey,29.6,50,64,Defer: formula exceeds existing limit; investigate before changing limits +matrix,matrix-authentication-valkey,valkey-exporter,19.7,10,64,Defer: formula exceeds existing limit; investigate before changing limits +matrix,mautrix-gmessages,blackbox-exporter,39.5,32,64,Retain: small existing reservation / avoid low-value rollout +matrix,mautrix-gmessages,mautrix-gmessages,48.3,32,64,Retain: small existing reservation / avoid low-value rollout +matrix,mautrix-meta,blackbox-exporter,38.2,32,64,Retain: small existing reservation / avoid low-value rollout +matrix,mautrix-meta,mautrix-meta,50.5,64,64,Retain: existing request covers formula / recovery floor +matrix,mautrix-signal,blackbox-exporter,40.8,32,64,Retain: small existing reservation / avoid low-value rollout +matrix,mautrix-signal,mautrix-signal,208.3,128,256,Defer: legacy/operator owner not included in this GitOps chart rollout +matrix,mautrix-slack,blackbox-exporter,38.9,32,64,Retain: small existing reservation / avoid low-value rollout +matrix,mautrix-slack,mautrix-slack,37.1,32,64,Retain: small existing reservation / avoid low-value rollout +matrix,mautrix-telegram,blackbox-exporter,40.6,32,64,Retain: small existing reservation / avoid low-value rollout +matrix,mautrix-telegram,mautrix-telegram,85.9,128,128,Retain: existing request covers formula / recovery floor +matrix,mautrix-whatsapp,blackbox-exporter,22.8,32,64,Retain: small existing reservation / avoid low-value rollout +matrix,mautrix-whatsapp,mautrix-whatsapp,50.9,64,64,Retain: existing request covers formula / recovery floor +matrix,postgresql,postgresql,421.5,1024,512,Retain: existing request covers formula / recovery floor +matrix,synapse,synapse,2979.9,3072,3584,Defer: legacy/operator owner not included in this GitOps chart rollout +mcserver,paper,mc-monitor,35.5,0,64,Retain: game/GPU/bursty workload needs representative peak review +mcserver,paper,paper,4893.9,0,5888,Retain: game/GPU/bursty workload needs representative peak review +metallb-system,metallb-controller,controller,207.4,0,256,Defer: network/control-plane resources need coordinated rollout +metallb-system,metallb-frr-k8s,controller,64.0,0,128,Defer: network/control-plane resources need coordinated rollout +metallb-system,metallb-frr-k8s,frr,69.5,0,128,Defer: network/control-plane resources need coordinated rollout +metallb-system,metallb-frr-k8s,frr-metrics,45.4,0,64,Defer: network/control-plane resources need coordinated rollout +metallb-system,metallb-frr-k8s,frr-status,61.4,0,128,Defer: network/control-plane resources need coordinated rollout +metallb-system,metallb-frr-k8s,reloader,21.1,0,64,Defer: network/control-plane resources need coordinated rollout +metallb-system,metallb-frr-k8s-statuscleaner,frr-k8s-statuscleaner,38.6,0,64,Defer: network/control-plane resources need coordinated rollout +metallb-system,metallb-speaker,speaker,109.9,0,192,Defer: network/control-plane resources need coordinated rollout +mikrotik-operator-system,mikrotik-operator,manager,54.9,48,128,Retain: small existing reservation / avoid low-value rollout +mumble,mumble,certificate-reloader,4.6,2,64,Defer: formula exceeds existing limit; investigate before changing limits +mumble,mumble,mumble,65.4,64,128,Retain: small existing reservation / avoid low-value rollout +nextcloud,nextcloud,nextcloud,380.5,0,512,Update in apps/nextcloud/values.yaml +nextcloud,nextcloud,nextcloud-cron,153.4,0,192,Update in apps/nextcloud/values.yaml +nextcloud,nextcloud,notify-push,16.3,32,64,Retain: small existing reservation / avoid low-value rollout +nextcloud,nextcloud-clamav,clamav,1022.8,1024,1280,Update in apps/nextcloud/clamav-values.yaml +nextcloud,nextcloud-collabora,collabora,1076.3,0,1344,Update in apps/nextcloud/values.yaml +nextcloud,nextcloud-imaginary,imaginary,16.2,0,64,Retain: small existing reservation / avoid low-value rollout +nextcloud,nextcloud-metrics,metrics-exporter,27.8,0,64,Retain: small existing reservation / avoid low-value rollout +nextcloud,nextcloud-redis-master,redis,19.6,128,64,Retain: existing request covers formula / recovery floor +nextcloud,nextcloud-redis-replicas,redis,32.4,128,64,Retain: existing request covers formula / recovery floor +nextcloud,nextcloud-talk-hpb,talk-hpb,144.9,256,192,Retain: existing request covers formula / recovery floor +nextcloud,nextcloud-whiteboard,whiteboard,114.6,128,192,Update in apps/nextcloud/whiteboard-values.yaml +oldimpi,oldipmi,browser,695.0,256,896,Update in apps/oldipmi/values.yaml +ollama,comfyui,comfyui,893.6,49152,1088,Retain: existing request covers formula / recovery floor +ollama,ollama,ollama,49.8,8192,64,Retain: existing request covers formula / recovery floor +ollama,open-webui,open-webui,701.7,1024,896,Retain: existing request covers formula / recovery floor +ombi,ombi,ombi,349.9,0,448,Update in apps/ombi/values.yaml +paperless-ngx,paperless,paperless,4513.3,1024,5440,Update in apps/paperless/values.yaml +paperless-ngx,pdf-editor,pdf-editor,398.7,512,512,Retain: existing request covers formula / recovery floor +paperless-ngx,scanner,scanner,156.0,256,192,Retain: existing request covers formula / recovery floor +paperless-ngx,valkey,valkey,19.4,64,64,Retain: existing request covers formula / recovery floor +pixelfed,mysql,mysql,654.4,768,832,Defer: published chart does not expose effective resource settings +pixelfed,pixelfed-horizon,horizon,1797.9,384,2176,Defer: formula exceeds existing limit; investigate before changing limits +pixelfed,pixelfed-web,pixelfed,253.6,512,320,Retain: existing request covers formula / recovery floor +pixelfed,valkey,valkey,30.5,256,64,Retain: existing request covers formula / recovery floor +plex,plex,plex,901.4,2048,1088,Retain: existing request covers formula / recovery floor +plex,plex,plex-exporter,40.7,32,64,Retain: small existing reservation / avoid low-value rollout +prometheus,alertmanager-prometheus-kube-prometheus-alertmanager,alertmanager,93.3,200,128,Retain: existing request covers formula / recovery floor +prometheus,alertmanager-prometheus-kube-prometheus-alertmanager,config-reloader,42.7,0,64,Retain: small existing reservation / avoid low-value rollout +prometheus,matrix-alertmanager-receiver,receiver,33.9,0,64,Retain: small existing reservation / avoid low-value rollout +prometheus,prometheus-kube-prometheus-operator,kube-prometheus-stack,115.1,0,192,Update in apps/prometheus/values.yaml +prometheus,prometheus-kube-state-metrics,kube-state-metrics,170.0,0,256,Update in apps/prometheus/values.yaml +prometheus,prometheus-prometheus-kube-prometheus-prometheus,config-reloader,46.7,0,64,Update in apps/prometheus/values.yaml +prometheus,prometheus-prometheus-kube-prometheus-prometheus,prometheus,3117.3,0,3776,Update in apps/prometheus/values.yaml +prometheus,prometheus-prometheus-node-exporter,node-exporter,41.0,0,64,Update in apps/prometheus/values.yaml +quay,quay,quay,9916.9,0,11904,Update in apps/quay/values.yaml +quay,quay-repomirror,quay-repomirror,273.1,0,384,Update in apps/quay/values.yaml +quay,quay-valkey-primary,valkey,19.4,128,64,Retain: existing request covers formula / recovery floor +rook-ceph,ceph-csi-controller-manager,manager,74.2,64,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-crashcollector-odroid-h3-00,ceph-crash,7.8,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-crashcollector-odroid-h3-01,ceph-crash,44.9,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-crashcollector-odroid-h3-02,ceph-crash,45.3,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-crashcollector-odroid-h3-03,ceph-crash,7.9,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-crashcollector-odroid-h3-04,ceph-crash,45.0,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-crashcollector-odroid-h3-05,ceph-crash,45.1,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-00,ceph-exporter,28.4,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-00,log-collector,5.9,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-01,ceph-exporter,49.1,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-01,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-02,ceph-exporter,49.3,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-02,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-03,ceph-exporter,24.1,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-03,log-collector,3.8,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-04,ceph-exporter,40.6,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-04,log-collector,8.0,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-05,ceph-exporter,48.7,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-exporter-odroid-h3-05,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mds-myfs-a,log-collector,7.2,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mds-myfs-a,mds,445.9,0,576,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mds-myfs-b,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mds-myfs-b,mds,238.0,0,320,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mgr-a,log-collector,8.6,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mgr-a,mgr,3553.2,0,4288,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mgr-a,watch-active,123.2,0,192,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mgr-b,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mgr-b,mgr,15914.5,0,19136,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mgr-b,watch-active,95.4,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mon-a,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mon-a,mon,519.3,0,640,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mon-c,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mon-c,mon,1320.4,0,1600,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mon-d,log-collector,3.7,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-mon-d,mon,145.3,0,192,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-nvmeof-nvmeof-a,nvmeof-gateway,691.7,0,832,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-operator,rook-ceph-operator,388.5,0,512,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-0,log-collector,6.3,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-0,osd,23866.9,0,28672,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-1,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-1,osd,24546.1,0,29504,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-2,log-collector,8.0,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-2,osd,22890.3,0,27520,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-3,log-collector,11.7,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-3,osd,22558.3,0,27072,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-4,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-4,osd,23918.8,0,28736,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-5,log-collector,11.7,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-osd-5,osd,26115.6,0,31360,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-rgw-my-store-a,log-collector,11.5,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-rgw-my-store-a,rgw,625.3,0,768,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph-tools,rook-ceph-tools,37.2,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.cephfs.csi.ceph.com-ctrlplugin,csi-attacher,71.9,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.cephfs.csi.ceph.com-ctrlplugin,csi-cephfsplugin,106.1,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.cephfs.csi.ceph.com-ctrlplugin,csi-provisioner,67.5,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.cephfs.csi.ceph.com-ctrlplugin,csi-resizer,74.0,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.cephfs.csi.ceph.com-ctrlplugin,csi-snapshotter,66.8,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.cephfs.csi.ceph.com-nodeplugin,csi-cephfsplugin,122.2,0,192,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.cephfs.csi.ceph.com-nodeplugin,driver-registrar,30.0,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.rbd.csi.ceph.com-ctrlplugin,csi-attacher,67.9,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.rbd.csi.ceph.com-ctrlplugin,csi-provisioner,68.3,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.rbd.csi.ceph.com-ctrlplugin,csi-rbdplugin,120.3,0,192,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.rbd.csi.ceph.com-ctrlplugin,csi-resizer,72.0,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.rbd.csi.ceph.com-ctrlplugin,csi-snapshotter,67.5,0,128,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.rbd.csi.ceph.com-nodeplugin,csi-rbdplugin,141.4,0,192,Defer: storage daemon/CSI sizing needs separate coordinated review +rook-ceph,rook-ceph.rbd.csi.ceph.com-nodeplugin,driver-registrar,27.6,0,64,Defer: storage daemon/CSI sizing needs separate coordinated review +sealed-secrets,sealed-secrets-controller,controller,115.7,32,192,Defer: formula exceeds existing limit; investigate before changing limits diff --git a/docs/memory-sizing.md b/docs/memory-sizing.md new file mode 100644 index 0000000..0bceafd --- /dev/null +++ b/docs/memory-sizing.md @@ -0,0 +1,73 @@ +# Memory request review + +## Review on 2026-11-04 + +This uses the CPU review's p95 plus 20% headroom method for memory requests. +Prometheus was queried over the previous 14 days, sampled every 15 minutes: + +```promql +quantile_over_time(0.95, + (max by(namespace,pod,container) + (container_memory_working_set_bytes{container!="",container!="POD"}) + )[14d:15m]) +``` + +The largest matching replica/pod-history p95 is used for each current workload +container, including previous ReplicaSets. The inner max deduplicates scrape +series; it does not add replicas together. History coverage was checked using +`count_over_time` on the same subquery. The longest series covers about 13.8 days; +individual replacement pods have shorter histories. Working set is a practical +scheduling estimate, not a guaranteed upper bound on allocation or peak demand. + +Requests are rounded upward to a 64 MiB boundary after multiplying by 1.2. +Existing higher requests and startup/recovery floors are retained. CPU values, +memory limits, images, replicas, storage and placement rules are unchanged. +Requests account for scheduling capacity; they do not cap memory consumption. +The scheduler considers init-container requirements as well as normal containers. + +The accompanying `memory-sizing-2026-11-04.csv` is a dated measurement and decision +record, not an install-time configuration source. Owning values files remain +canonical. It records both changes and exclusions rather than claiming every +container was automatically resized. + +## Scope and exclusions + +The GitOps changes cover 49 measured container settings across 30 chart +applications. Some chart settings also affect init containers; the Prometheus +operator's config-reloader request applies to both Prometheus and Alertmanager. +The main gaps include Quay, Immich, Paperless, Prometheus, Argo CD, and services +with no previous memory reservation. InfluxDB retains its existing request, +which is above the history-based recommendation. + +The legacy Matrix authentication Helm release has four corresponding request +increases in `matrix/authentication/values.yaml` in the homelab workspace. It +requires its existing Helm installation path; it is not managed by this repo. +Unchanged workers retain their shared resource anchor and existing floors. + +- Ceph daemons and CSI are excluded to avoid an unreviewed storage-wide rollout. +- Network/control-plane components require a coordinated capacity review. +- Operator-owned databases, game/GPU servers and bursty jobs retain their + reservations; idle measurements are not sufficient peak-demand evidence. +- Copyparty has very short history dominated by OOM failures under its former + limit. Review again after representative operation with the new limit. +- Recommendations above existing memory limits are recorded for investigation, + not silently capped or paired with unsolicited limit changes. +- Diun's published chart declares a resources value but does not render it. + Loops/Pixelfed also need chart-interface work for hard-coded resources. + Unsupported values have not been added. +- Small existing reservations and unrelated legacy deployments are retained. + +## Validation and rollout + +Render and lint the exact pinned charts using the same values as Argo CD. +Compare resources before/after and assert intended requests are actually rendered; +check the Prometheus operator's config-reloader argument separately. Validate +changed workloads with server-side dry-run. Do not delete PVCs or force-delete +stateful pods to make a new reservation fit. + +At preparation time `intel-xeon` was unreachable and its Argo application +controller pod was terminating. Helm rendering does not establish successful +deployment. After controller recovery, verify Argo sync/health, pending pods, +node memory and request totals, application responses and unchanged PVC volumes. +If a workload cannot fit, review capacity/placement rather than reducing its +request merely to hide the scheduling failure.