chore: Set resource requests and limits on every workload

add-ons/postgres/cluster.yaml

@@ -40,6 +40,7 @@ spec:
       - host all all all reject
   resources:
     limits:
+      cpu: 1000m
       memory: 1Gi
     requests:
       cpu: 100m

apps/qbit/deployment.yaml

@@ -38,6 +38,13 @@ spec:
           ports:
             - containerPort: 8080
               name: http
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 2Gi
+            requests:
+              cpu: 50m
+              memory: 128Mi
           volumeMounts:
             - mountPath: /config
               name: config
@@ -104,6 +111,13 @@ spec:
             periodSeconds: 30
             timeoutSeconds: 10
           name: gluetun
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 96Mi
           restartPolicy: Always
           securityContext:
             capabilities:

apps/wireguard/deployment.yaml

@@ -71,6 +71,13 @@ spec:
               protocol: UDP
             - containerPort: 51821
               name: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 10m
+              memory: 192Mi
           securityContext:
             capabilities:
               add:

argocd-apps/add-ons/authentik.yaml

@@ -39,6 +39,7 @@ spec:
           server:
             resources:
               limits:
+                cpu: 1000m
                 memory: 1Gi
               requests:
                 cpu: 100m
@@ -46,6 +47,7 @@ spec:
           worker:
             resources:
               limits:
+                cpu: 1000m
                 memory: 1Gi
               requests:
                 cpu: 50m

argocd-apps/add-ons/cert-manager.yaml

@@ -22,6 +22,29 @@ spec:
             kind: ControllerConfiguration
             featureGates:
               ExperimentalGatewayAPISupport: true
+          resources:
+            limits:
+              cpu: 200m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 64Mi
+          cainjector:
+            resources:
+              limits:
+                cpu: 200m
+                memory: 256Mi
+              requests:
+                cpu: 10m
+                memory: 64Mi
+          webhook:
+            resources:
+              limits:
+                cpu: 200m
+                memory: 128Mi
+              requests:
+                cpu: 10m
+                memory: 32Mi
       repoURL: https://charts.jetstack.io
       targetRevision: v1.21.2
     - path: add-ons/cert-manager

argocd-apps/add-ons/cnpg.yaml

@@ -18,6 +18,13 @@ spec:
         replicaCount: 1
         config:
           clusterWide: true
+        resources:
+          limits:
+            cpu: 500m
+            memory: 256Mi
+          requests:
+            cpu: 10m
+            memory: 64Mi
     repoURL: https://cloudnative-pg.github.io/charts
     targetRevision: 0.29.1
   syncPolicy:

argocd-apps/add-ons/sealed-secrets.yaml

@@ -16,6 +16,13 @@ spec:
     helm:
       values: |
         keyrenewperiod: "0"
+        resources:
+          limits:
+            cpu: 200m
+            memory: 128Mi
+          requests:
+            cpu: 10m
+            memory: 32Mi
     repoURL: https://bitnami.github.io/sealed-secrets
     targetRevision: 2.20.0
   syncPolicy:

argocd-apps/add-ons/traefik.yaml

@@ -61,6 +61,13 @@ spec:
                   - kind: Secret
                     name: wildcard-whyredfire-dpdns-org
                     group: ""
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 256Mi
+            requests:
+              cpu: 50m
+              memory: 64Mi
       repoURL: https://traefik.github.io/charts
       targetRevision: 41.7.1
     - path: add-ons/traefik

argocd-apps/apps/garage.yaml

@@ -78,6 +78,7 @@ spec:
               cpu: 100m
               memory: 256Mi
             limits:
+              cpu: 1000m
               memory: 1Gi
     - path: apps/garage
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git

argocd-apps/apps/jellyfin.yaml

@@ -30,6 +30,13 @@ spec:
               enabled: true
               type: hostPath
               hostPath: /srv/media
+          resources:
+            limits:
+              cpu: 3000m
+              memory: 2Gi
+            requests:
+              cpu: 50m
+              memory: 512Mi
       repoURL: https://jellyfin.github.io/jellyfin-helm
       targetRevision: 3.2.0
     - path: apps/jellyfin

bootstrap/argocd-resources-patch.yaml

@@ -0,0 +1,120 @@
+# Sized from about five days of usage: requests near the average, limits
+# with headroom over the peak
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: argocd-application-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-application-controller
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 384Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-applicationset-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-applicationset-controller
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: dex
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-notifications-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-notifications-controller
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-redis
+spec:
+  template:
+    spec:
+      containers:
+        - name: redis
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 16Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-repo-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-repo-server
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 512Mi
+            requests:
+              cpu: 10m
+              memory: 128Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-server
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 64Mi

bootstrap/kustomization.yaml

@@ -37,3 +37,4 @@ patches:
       kind: ConfigMap
       name: argocd-cmd-params-cm
     path: argocd-cmd-params-cm-server-insecure-patch.yaml
+  - path: argocd-resources-patch.yaml