Size memory requests from two weeks of p95 working sets

2026-11-04 22:36:50 +01:00
1 parent 92eebd06f7
commit a25d4f90bf
@@ -34,6 +34,9 @@ notifications:
    secret:
      create: false

+    resources:
+      requests:
+        memory: 256Mi
 redisSecretInit:
    enabled: false

@@ -42,3 +45,26 @@ server:
      enabled: true
      annotations:
        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    resources:
+      requests:
+        memory: 256Mi
+controller:
+  resources:
+    requests:
+      memory: 1664Mi
+applicationSet:
+  resources:
+    requests:
+      memory: 256Mi
+dex:
+  resources:
+    requests:
+      memory: 256Mi
+repoServer:
+  resources:
+    requests:
+      memory: 320Mi
+redis:
+  resources:
+    requests:
+      memory: 128Mi
@@ -50,7 +50,7 @@ server:
  resources:
    requests:
      cpu: 150m
-      memory: 1Gi
+      memory: 1344Mi
    limits:
      # Deliberately leave CPU unlimited so login bursts can use idle cores.
      memory: 2Gi
@@ -94,6 +94,7 @@ worker:
  resources:
    requests:
      cpu: 150m
+      memory: 576Mi
  enabled: true
  livenessProbe:
    timeoutSeconds: 10
@@ -20,3 +20,6 @@ ingress:
  - hosts:
    - brgkepler.com
    secretName: brgkepler-com-tls
+resources:
+  requests:
+    memory: 192Mi
@@ -24,3 +24,4 @@ ingress:
 resources:
  requests:
    cpu: 175m
+    memory: 384Mi
@@ -4,3 +4,14 @@ crds:
 extraArgs:
  - --dns01-recursive-nameservers-only
  - --dns01-recursive-nameservers=1.1.1.1:53,8.8.8.8:53
+resources:
+  requests:
+    memory: 192Mi
+cainjector:
+  resources:
+    requests:
+      memory: 128Mi
+webhook:
+  resources:
+    requests:
+      memory: 128Mi
@@ -10,3 +10,6 @@ ingress:
      - path: /
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+resources:
+  requests:
+    memory: 128Mi
@@ -8,7 +8,7 @@ image:
 resources:
  requests:
    cpu: 25m
-    memory: 384Mi
+    memory: 640Mi
  limits:
    cpu: "1"
    memory: 1Gi
@@ -44,6 +44,9 @@ sidecar:
    provider:
      allowUiUpdates: true

+  resources:
+    requests:
+      memory: 128Mi
 grafana.ini:
  server:
    domain: grafana.brunner.ninja
@@ -86,3 +89,4 @@ grafana.ini:
 resources:
  requests:
    cpu: 75m
+    memory: 1280Mi
@@ -20,3 +20,6 @@ ingress:
  - hosts:
    - gschissenes.equipment
    secretName: gschissenes-equipment-tls
+resources:
+  requests:
+    memory: 192Mi
@@ -24,3 +24,4 @@ ingress:
 resources:
  requests:
    cpu: 175m
+    memory: 1472Mi
@@ -69,6 +69,9 @@ server:
                secretKeyRef:
                  name: immich-postgresql-app
                  key: password
+          resources:
+            requests:
+              memory: 7744Mi
  ingress:
    main:
      enabled: false
@@ -101,6 +104,9 @@ machine-learning:
            runAsNonRoot: true
            runAsUser: 1000
            runAsGroup: 1000
+          resources:
+            requests:
+              memory: 1408Mi
      initContainers:
        check-bcachefs-library:
          image:
@@ -15,7 +15,7 @@ publishedServerUrl: https://jellyfin.brunner.ninja
 resources:
  requests:
    cpu: 500m
-    memory: 2Gi
+    memory: 3520Mi
    ephemeral-storage: 1Gi
 ingress:
  enabled: true
@@ -50,7 +50,7 @@ mastodon:
    resources:
      requests:
        cpu: 50m
-        memory: 768Mi
+        memory: 1280Mi
      limits:
        cpu: "2"
        memory: 2Gi
@@ -71,7 +71,7 @@ mastodon:
        resources:
          requests:
            cpu: 50m
-            memory: 768Mi
+            memory: 1920Mi
          limits:
            cpu: "2"
            memory: 2Gi
@@ -7,5 +7,6 @@ serviceMonitor:
 resources:
  requests:
    cpu: 175m
+    memory: 256Mi
  limits:
    cpu:
@@ -12,7 +12,7 @@ initResources:
 resources:
  requests:
    cpu: 100m
-    memory: 1Gi
+    memory: 1280Mi
  limits:
    cpu: 2
    memory: 3Gi
@@ -239,8 +239,15 @@ collabora:
      paths:
      - path: /
        pathType: ImplementationSpecific
+  resources:
+    requests:
+      memory: 1344Mi
 cronjob:
  enabled: true
+  sidecar:
+    resources:
+      requests:
+        memory: 192Mi
 persistence:
  enabled: true
  storageClass: rook-ceph-block
@@ -257,3 +264,6 @@ prometheus:
    enabled: false
  rules:
    enabled: true
+resources:
+  requests:
+    memory: 512Mi
@@ -5,7 +5,7 @@ jwtSecret:
 resources:
  requests:
    cpu: 50m
-    memory: 128Mi
+    memory: 192Mi
  limits:
    cpu: 1
    memory: 1Gi
@@ -16,3 +16,6 @@ networkPolicy:
          app.kubernetes.io/name: traefik
          app.kubernetes.io/instance: traefik-default
  # Cilium policy supplies external egress with explicit cluster exclusions.
+resources:
+  requests:
+    memory: 896Mi
@@ -24,3 +24,6 @@ persistence:
    storageClass: rook-ceph-block
    accessMode: ReadWriteOnce
    retain: true
+resources:
+  requests:
+    memory: 448Mi
@@ -45,4 +45,4 @@ affinity:
 resources:
  requests:
    cpu: 50m
-    memory: 1Gi
+    memory: 5440Mi
@@ -11,3 +11,6 @@ persistence:
  existingClaim: pfostendynamics-com
 ingress:
  enabled: false
+resources:
+  requests:
+    memory: 192Mi
@@ -20,3 +20,6 @@ servers:
    host: postgresql.gramps.svc.cluster.local
  - description: postgresql.matrix.svc.cluster.local
    host: postgresql.matrix.svc.cluster.local
+resources:
+  requests:
+    memory: 128Mi
@@ -16,6 +16,9 @@ prometheus-node-exporter:
          regex: 'node_filesystem_.+;bcachefs;(/komposthaufen|/var/www|/var/lib/(lidarr|prowlarr|radarr|readarr|sonarr|whisparr)|/home/feedc0de/(\.steam/steamapps|mcserver/plugins/dynmap/web/tiles))'
          action: drop

+  resources:
+    requests:
+      memory: 64Mi
 alertmanager:
  ingress:
    enabled: true
@@ -91,6 +94,7 @@ prometheus:
    resources:
      requests:
        cpu: 200m
+        memory: 3776Mi
    retention: "15d"
    storageSpec:
      volumeClaimTemplate:
@@ -104,3 +108,15 @@ prometheus:
    serviceMonitorSelector: {}
    ruleSelectorNilUsesHelmValues: false
    ruleSelector: {}
+prometheusOperator:
+  resources:
+    requests:
+      memory: 192Mi
+  prometheusConfigReloader:
+    resources:
+      requests:
+        memory: 64Mi
+kube-state-metrics:
+  resources:
+    requests:
+      memory: 256Mi
@@ -30,3 +30,9 @@ valkey:
    persistence:
      storageClass: rook-ceph-block-ec
      size: 2Gi
+resources:
+  requests:
+    memory: 11904Mi
+repomirrorResources:
+  requests:
+    memory: 384Mi
@@ -30,3 +30,6 @@ persistence:
    size: 60Gi
    storageClass: rook-ceph-block
    accessMode: ReadWriteOnce
+resources:
+  requests:
+    memory: 192Mi
@@ -12,7 +12,7 @@ podDisruptionBudget:
 resources:
  requests:
    cpu: 700m
-    memory: 1Gi
+    memory: 3072Mi
 affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
@@ -21,7 +21,7 @@ readinessProbe:
 resources:
  requests:
    cpu: 75m
-    memory: 256Mi
+    memory: 512Mi
    ephemeral-storage: 128Mi
  limits:
    memory: 1Gi
@@ -25,3 +25,6 @@ ingress:
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.middlewares: default-authentik@kubernetescrd
+resources:
+  requests:
+    memory: 192Mi
@@ -24,3 +24,6 @@ externalPostgresql:
  existingSecret: wiki-js
  existingSecretKey: postgresql-password
  ssl: false
+resources:
+  requests:
+    memory: 256Mi