fix(k8s): Recreate singletons and trim requests for scheduler headroom

RollingUpdate with default maxSurge needs a spare pod the single node does not have (99% CPU requested), so multi-workload restarts end Pending and verify times out. Recreate on all replicas:1 Deployments (immich-server and bentopdf keep RollingUpdate at replicas 2). Also trims CPU/memory requests toward measured use (adguard, authentik, gitea, netbox, uptime-kuma, netbird-server) and gives traefik requests/limits so it is no longer BestEffort.

adguardhome/k8s/adguard.yaml

@@ -58,6 +58,8 @@ spec:
   selector:
     matchLabels:
       app: adguard
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
@@ -73,7 +75,7 @@ spec:
               memory: "1.5Gi"
               cpu: "300m"
             requests:
-              memory: "1Gi"
+              memory: "512Mi"
               cpu: "50m"
           ports:
             - containerPort: 3000

authentik/k8s/authentik.yaml

@@ -34,6 +34,8 @@ spec:
   selector:
     matchLabels:
       app: authentik-server
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
@@ -53,7 +55,7 @@ spec:
           resources:
             requests:
               memory: "768Mi"
-              cpu: "300m"
+              cpu: "100m"
             limits:
               memory: "1.5Gi"
               cpu: "1000m"
@@ -68,6 +70,8 @@ spec:
   selector:
     matchLabels:
       app: authentik-worker
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
@@ -87,7 +91,7 @@ spec:
           resources:
             requests:
               memory: "320Mi"
-              cpu: "300m"
+              cpu: "100m"
             limits:
               memory: "768Mi"
               cpu: "700m"

cfddns/k8s/deployment.yaml

@@ -9,6 +9,8 @@ spec:
   selector:
     matchLabels:
       app: cfddns
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

checkmk/k8s/checkmk.yaml

@@ -24,6 +24,8 @@ spec:
   selector:
     matchLabels:
       app: checkmk
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

cloudflared/k8s/deployment.yaml

@@ -9,6 +9,8 @@ spec:
   selector:
     matchLabels:
       app: cloudflared
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

converters/k8s/convertx.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: convertx
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

downtify/k8s/downtify.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: downtify
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

edu_master/k8s/playwright.yaml

@@ -10,6 +10,8 @@ spec:
   selector:
     matchLabels:
       app: edu-master-playwright
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

edu_master/k8s/session-keeper.yaml

@@ -10,6 +10,8 @@ spec:
   selector:
     matchLabels:
       app: edu-master-session-keeper
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

edu_master/k8s/webinar-checker.yaml

@@ -10,6 +10,8 @@ spec:
   selector:
     matchLabels:
       app: edu-master-webinar-checker
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

errorpages/k8s/error-pages.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: error-pages
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

gitea/k8s/gitea.yaml

@@ -24,6 +24,8 @@ spec:
   selector:
     matchLabels:
       app: gitea
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
@@ -48,7 +50,7 @@ spec:
           resources:
             requests:
               memory: "320Mi"
-              cpu: "300m"
+              cpu: "100m"
             limits:
               memory: "1Gi"
               cpu: "1300m"

glance/k8s/glance.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: glance
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

homepages/k8s/homepages.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: forust-homepage
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
@@ -67,6 +69,8 @@ spec:
   selector:
     matchLabels:
       app: xdfnx-homepage
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

immich/k8s/machine-learning.yaml

@@ -23,6 +23,8 @@ spec:
   selector:
     matchLabels:
       app: immich-machine-learning
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

kener/k8s/kener.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: kener
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

metube/k8s/metube.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: metube
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

n8n/k8s/n8n.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: n8n
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

netbird/k8s/netbird.yaml

@@ -39,6 +39,8 @@ spec:
   selector:
     matchLabels:
       app: netbird-server
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
@@ -92,7 +94,7 @@ spec:
           resources:
             requests:
               memory: "128Mi"
-              cpu: "250m"
+              cpu: "100m"
             limits:
               memory: "384Mi"
               cpu: "1000m"
@@ -131,6 +133,8 @@ spec:
   selector:
     matchLabels:
       app: netbird-dashboard
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

netbox/k8s/netbox.yaml

@@ -97,7 +97,7 @@ spec:
           resources:
             requests:
               cpu: "100m"
-              memory: "1Gi"
+              memory: "512Mi"
             limits:
               cpu: "2"
               memory: "2Gi"

netronome/k8s/netronome.yaml

@@ -23,6 +23,8 @@ spec:
   selector:
     matchLabels:
       app: netronome
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

portainer/k8s/portainer.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: portainer
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

searxng/k8s/searxng.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: searxng
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

termix/k8s/termix.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: termix
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

traefik/k8s/traefik-values.yaml

@@ -36,6 +36,16 @@ additionalVolumeMounts:
   - name: plugins
     mountPath: /plugins-storage
 
+# BestEffort (no requests) meant kubelet squeezed traefik first under node
+# pressure, down to /ping timeouts and liveness restarts. Burstable instead.
+resources:
+  requests:
+    cpu: "200m"
+    memory: "256Mi"
+  limits:
+    cpu: "1000m"
+    memory: "1Gi"
+
 providers:
   kubernetesIngress:
     enabled: true

uptime-kuma/k8s/uptime-kuma.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: uptime-kuma
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
@@ -34,7 +36,7 @@ spec:
               memory: "1Gi"
               cpu: "1"
             requests:
-              memory: "512Mi"
+              memory: "320Mi"
               cpu: "100m"
           ports:
             - containerPort: 3001

userbot/k8s/base/userbots.yaml

@@ -15,6 +15,8 @@ spec:
   selector:
     matchLabels:
       app: forust-userbot
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
@@ -86,6 +88,8 @@ spec:
   selector:
     matchLabels:
       app: anna-userbot
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

vaultwarden/k8s/vaultwarden.yaml

@@ -20,6 +20,8 @@ spec:
   selector:
     matchLabels:
       app: vaultwarden
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:

vpn/xui/k8s/xui.yaml

@@ -27,6 +27,8 @@ spec:
   selector:
     matchLabels:
       app: xui
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels: