From a6af69dca0100c916d2b67e3cf8de968d09fcf84 Mon Sep 17 00:00:00 2001 From: mr-forust Date: Mon, 28 Sep 2026 22:36:46 +0200 Subject: [PATCH] fix(k8s): Recreate singletons and trim requests for scheduler headroom RollingUpdate with default maxSurge needs a spare pod the single node does not have (99% CPU requested), so multi-workload restarts end Pending and verify times out. Recreate on all replicas:1 Deployments (immich-server and bentopdf keep RollingUpdate at replicas 2). Also trims CPU/memory requests toward measured use (adguard, authentik, gitea, netbox, uptime-kuma, netbird-server) and gives traefik requests/limits so it is no longer BestEffort. --- adguardhome/k8s/adguard.yaml | 4 +++- authentik/k8s/authentik.yaml | 8 ++++++-- cfddns/k8s/deployment.yaml | 2 ++ checkmk/k8s/checkmk.yaml | 2 ++ cloudflared/k8s/deployment.yaml | 2 ++ converters/k8s/convertx.yaml | 2 ++ downtify/k8s/downtify.yaml | 2 ++ edu_master/k8s/playwright.yaml | 2 ++ edu_master/k8s/session-keeper.yaml | 2 ++ edu_master/k8s/webinar-checker.yaml | 2 ++ errorpages/k8s/error-pages.yaml | 2 ++ gitea/k8s/gitea.yaml | 4 +++- glance/k8s/glance.yaml | 2 ++ homepages/k8s/homepages.yaml | 4 ++++ immich/k8s/machine-learning.yaml | 2 ++ kener/k8s/kener.yaml | 2 ++ metube/k8s/metube.yaml | 2 ++ n8n/k8s/n8n.yaml | 2 ++ netbird/k8s/netbird.yaml | 6 +++++- netbox/k8s/netbox.yaml | 2 +- netronome/k8s/netronome.yaml | 2 ++ portainer/k8s/portainer.yaml | 2 ++ searxng/k8s/searxng.yaml | 2 ++ termix/k8s/termix.yaml | 2 ++ traefik/k8s/traefik-values.yaml | 10 ++++++++++ uptime-kuma/k8s/uptime-kuma.yaml | 4 +++- userbot/k8s/base/userbots.yaml | 4 ++++ vaultwarden/k8s/vaultwarden.yaml | 2 ++ vpn/xui/k8s/xui.yaml | 2 ++ 29 files changed, 79 insertions(+), 7 deletions(-) diff --git a/adguardhome/k8s/adguard.yaml b/adguardhome/k8s/adguard.yaml index f6aa50a..b074548 100644 --- a/adguardhome/k8s/adguard.yaml +++ b/adguardhome/k8s/adguard.yaml @@ -58,6 +58,8 @@ spec: selector: matchLabels: app: adguard + strategy: + type: Recreate template: metadata: labels: @@ -73,7 +75,7 @@ spec: memory: "1.5Gi" cpu: "300m" requests: - memory: "1Gi" + memory: "512Mi" cpu: "50m" ports: - containerPort: 3000 diff --git a/authentik/k8s/authentik.yaml b/authentik/k8s/authentik.yaml index 4485da4..5cfcbdf 100644 --- a/authentik/k8s/authentik.yaml +++ b/authentik/k8s/authentik.yaml @@ -34,6 +34,8 @@ spec: selector: matchLabels: app: authentik-server + strategy: + type: Recreate template: metadata: labels: @@ -53,7 +55,7 @@ spec: resources: requests: memory: "768Mi" - cpu: "300m" + cpu: "100m" limits: memory: "1.5Gi" cpu: "1000m" @@ -68,6 +70,8 @@ spec: selector: matchLabels: app: authentik-worker + strategy: + type: Recreate template: metadata: labels: @@ -87,7 +91,7 @@ spec: resources: requests: memory: "320Mi" - cpu: "300m" + cpu: "100m" limits: memory: "768Mi" cpu: "700m" diff --git a/cfddns/k8s/deployment.yaml b/cfddns/k8s/deployment.yaml index 705ab3a..a5598ec 100644 --- a/cfddns/k8s/deployment.yaml +++ b/cfddns/k8s/deployment.yaml @@ -9,6 +9,8 @@ spec: selector: matchLabels: app: cfddns + strategy: + type: Recreate template: metadata: labels: diff --git a/checkmk/k8s/checkmk.yaml b/checkmk/k8s/checkmk.yaml index ce0a301..3fb5fc2 100644 --- a/checkmk/k8s/checkmk.yaml +++ b/checkmk/k8s/checkmk.yaml @@ -24,6 +24,8 @@ spec: selector: matchLabels: app: checkmk + strategy: + type: Recreate template: metadata: labels: diff --git a/cloudflared/k8s/deployment.yaml b/cloudflared/k8s/deployment.yaml index 0b93a36..c164c46 100644 --- a/cloudflared/k8s/deployment.yaml +++ b/cloudflared/k8s/deployment.yaml @@ -9,6 +9,8 @@ spec: selector: matchLabels: app: cloudflared + strategy: + type: Recreate template: metadata: labels: diff --git a/converters/k8s/convertx.yaml b/converters/k8s/convertx.yaml index 8f71c27..bc81cc1 100644 --- a/converters/k8s/convertx.yaml +++ b/converters/k8s/convertx.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: convertx + strategy: + type: Recreate template: metadata: labels: diff --git a/downtify/k8s/downtify.yaml b/downtify/k8s/downtify.yaml index 4b4a050..5c804d1 100644 --- a/downtify/k8s/downtify.yaml +++ b/downtify/k8s/downtify.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: downtify + strategy: + type: Recreate template: metadata: labels: diff --git a/edu_master/k8s/playwright.yaml b/edu_master/k8s/playwright.yaml index ebf71d8..c071a05 100644 --- a/edu_master/k8s/playwright.yaml +++ b/edu_master/k8s/playwright.yaml @@ -10,6 +10,8 @@ spec: selector: matchLabels: app: edu-master-playwright + strategy: + type: Recreate template: metadata: labels: diff --git a/edu_master/k8s/session-keeper.yaml b/edu_master/k8s/session-keeper.yaml index e5b5fdd..d9f5cda 100644 --- a/edu_master/k8s/session-keeper.yaml +++ b/edu_master/k8s/session-keeper.yaml @@ -10,6 +10,8 @@ spec: selector: matchLabels: app: edu-master-session-keeper + strategy: + type: Recreate template: metadata: labels: diff --git a/edu_master/k8s/webinar-checker.yaml b/edu_master/k8s/webinar-checker.yaml index 51daf7f..a8f275e 100644 --- a/edu_master/k8s/webinar-checker.yaml +++ b/edu_master/k8s/webinar-checker.yaml @@ -10,6 +10,8 @@ spec: selector: matchLabels: app: edu-master-webinar-checker + strategy: + type: Recreate template: metadata: labels: diff --git a/errorpages/k8s/error-pages.yaml b/errorpages/k8s/error-pages.yaml index 4d1845d..fc16e96 100644 --- a/errorpages/k8s/error-pages.yaml +++ b/errorpages/k8s/error-pages.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: error-pages + strategy: + type: Recreate template: metadata: labels: diff --git a/gitea/k8s/gitea.yaml b/gitea/k8s/gitea.yaml index 815db4c..30f5e61 100644 --- a/gitea/k8s/gitea.yaml +++ b/gitea/k8s/gitea.yaml @@ -24,6 +24,8 @@ spec: selector: matchLabels: app: gitea + strategy: + type: Recreate template: metadata: labels: @@ -48,7 +50,7 @@ spec: resources: requests: memory: "320Mi" - cpu: "300m" + cpu: "100m" limits: memory: "1Gi" cpu: "1300m" diff --git a/glance/k8s/glance.yaml b/glance/k8s/glance.yaml index 20a5330..b9b2707 100644 --- a/glance/k8s/glance.yaml +++ b/glance/k8s/glance.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: glance + strategy: + type: Recreate template: metadata: labels: diff --git a/homepages/k8s/homepages.yaml b/homepages/k8s/homepages.yaml index 92e009a..895a186 100644 --- a/homepages/k8s/homepages.yaml +++ b/homepages/k8s/homepages.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: forust-homepage + strategy: + type: Recreate template: metadata: labels: @@ -67,6 +69,8 @@ spec: selector: matchLabels: app: xdfnx-homepage + strategy: + type: Recreate template: metadata: labels: diff --git a/immich/k8s/machine-learning.yaml b/immich/k8s/machine-learning.yaml index 29eccde..3ff65a2 100644 --- a/immich/k8s/machine-learning.yaml +++ b/immich/k8s/machine-learning.yaml @@ -23,6 +23,8 @@ spec: selector: matchLabels: app: immich-machine-learning + strategy: + type: Recreate template: metadata: labels: diff --git a/kener/k8s/kener.yaml b/kener/k8s/kener.yaml index b551910..61b04d0 100644 --- a/kener/k8s/kener.yaml +++ b/kener/k8s/kener.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: kener + strategy: + type: Recreate template: metadata: labels: diff --git a/metube/k8s/metube.yaml b/metube/k8s/metube.yaml index 48f4ee8..d817a95 100644 --- a/metube/k8s/metube.yaml +++ b/metube/k8s/metube.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: metube + strategy: + type: Recreate template: metadata: labels: diff --git a/n8n/k8s/n8n.yaml b/n8n/k8s/n8n.yaml index fb29dca..c7c8705 100644 --- a/n8n/k8s/n8n.yaml +++ b/n8n/k8s/n8n.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: n8n + strategy: + type: Recreate template: metadata: labels: diff --git a/netbird/k8s/netbird.yaml b/netbird/k8s/netbird.yaml index f72f6cb..9ad3a09 100644 --- a/netbird/k8s/netbird.yaml +++ b/netbird/k8s/netbird.yaml @@ -39,6 +39,8 @@ spec: selector: matchLabels: app: netbird-server + strategy: + type: Recreate template: metadata: labels: @@ -92,7 +94,7 @@ spec: resources: requests: memory: "128Mi" - cpu: "250m" + cpu: "100m" limits: memory: "384Mi" cpu: "1000m" @@ -131,6 +133,8 @@ spec: selector: matchLabels: app: netbird-dashboard + strategy: + type: Recreate template: metadata: labels: diff --git a/netbox/k8s/netbox.yaml b/netbox/k8s/netbox.yaml index 6de0284..e5a3f08 100644 --- a/netbox/k8s/netbox.yaml +++ b/netbox/k8s/netbox.yaml @@ -97,7 +97,7 @@ spec: resources: requests: cpu: "100m" - memory: "1Gi" + memory: "512Mi" limits: cpu: "2" memory: "2Gi" diff --git a/netronome/k8s/netronome.yaml b/netronome/k8s/netronome.yaml index f455891..7ccb62e 100644 --- a/netronome/k8s/netronome.yaml +++ b/netronome/k8s/netronome.yaml @@ -23,6 +23,8 @@ spec: selector: matchLabels: app: netronome + strategy: + type: Recreate template: metadata: labels: diff --git a/portainer/k8s/portainer.yaml b/portainer/k8s/portainer.yaml index 6d4c11d..99660bb 100644 --- a/portainer/k8s/portainer.yaml +++ b/portainer/k8s/portainer.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: portainer + strategy: + type: Recreate template: metadata: labels: diff --git a/searxng/k8s/searxng.yaml b/searxng/k8s/searxng.yaml index 4f5957b..cbea1e5 100644 --- a/searxng/k8s/searxng.yaml +++ b/searxng/k8s/searxng.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: searxng + strategy: + type: Recreate template: metadata: labels: diff --git a/termix/k8s/termix.yaml b/termix/k8s/termix.yaml index 0f6ea1e..30d8011 100644 --- a/termix/k8s/termix.yaml +++ b/termix/k8s/termix.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: termix + strategy: + type: Recreate template: metadata: labels: diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml index fc3c070..d4f02af 100644 --- a/traefik/k8s/traefik-values.yaml +++ b/traefik/k8s/traefik-values.yaml @@ -36,6 +36,16 @@ additionalVolumeMounts: - name: plugins mountPath: /plugins-storage +# BestEffort (no requests) meant kubelet squeezed traefik first under node +# pressure, down to /ping timeouts and liveness restarts. Burstable instead. +resources: + requests: + cpu: "200m" + memory: "256Mi" + limits: + cpu: "1000m" + memory: "1Gi" + providers: kubernetesIngress: enabled: true diff --git a/uptime-kuma/k8s/uptime-kuma.yaml b/uptime-kuma/k8s/uptime-kuma.yaml index 33dfde8..f123635 100644 --- a/uptime-kuma/k8s/uptime-kuma.yaml +++ b/uptime-kuma/k8s/uptime-kuma.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: uptime-kuma + strategy: + type: Recreate template: metadata: labels: @@ -34,7 +36,7 @@ spec: memory: "1Gi" cpu: "1" requests: - memory: "512Mi" + memory: "320Mi" cpu: "100m" ports: - containerPort: 3001 diff --git a/userbot/k8s/base/userbots.yaml b/userbot/k8s/base/userbots.yaml index 1ab7792..2f9d3f7 100644 --- a/userbot/k8s/base/userbots.yaml +++ b/userbot/k8s/base/userbots.yaml @@ -15,6 +15,8 @@ spec: selector: matchLabels: app: forust-userbot + strategy: + type: Recreate template: metadata: labels: @@ -86,6 +88,8 @@ spec: selector: matchLabels: app: anna-userbot + strategy: + type: Recreate template: metadata: labels: diff --git a/vaultwarden/k8s/vaultwarden.yaml b/vaultwarden/k8s/vaultwarden.yaml index 775a729..f0968f3 100644 --- a/vaultwarden/k8s/vaultwarden.yaml +++ b/vaultwarden/k8s/vaultwarden.yaml @@ -20,6 +20,8 @@ spec: selector: matchLabels: app: vaultwarden + strategy: + type: Recreate template: metadata: labels: diff --git a/vpn/xui/k8s/xui.yaml b/vpn/xui/k8s/xui.yaml index 93f597b..69f02de 100644 --- a/vpn/xui/k8s/xui.yaml +++ b/vpn/xui/k8s/xui.yaml @@ -27,6 +27,8 @@ spec: selector: matchLabels: app: xui + strategy: + type: Recreate template: metadata: labels: