diff --git a/charts/shopsys-app/tests/component_schema_test.yaml b/charts/shopsys-app/tests/component_schema_test.yaml index e92cb21..4680fe8 100644 --- a/charts/shopsys-app/tests/component_schema_test.yaml +++ b/charts/shopsys-app/tests/component_schema_test.yaml @@ -4,6 +4,7 @@ values: templates: - templates/deployment-storefront.yaml - templates/deployment-webserver-php-fpm.yaml + - templates/deployment-consumer.yaml tests: - it: propagates scheduling and volume keys into the pod spec template: templates/deployment-storefront.yaml @@ -107,6 +108,45 @@ tests: - name: my-pull-secret - name: other-secret + - it: ships default consumer resources and lets an instance override them + template: templates/deployment-consumer.yaml + set: + consumers: + instances: + - name: email + transports: email_transport + - name: heavy + transports: heavy_transport + resources: + requests: + cpu: "500m" + asserts: + - equal: + path: spec.template.spec.containers[0].resources + value: + limits: + memory: 1Gi + requests: + cpu: "50m" + memory: 300Mi + documentIndex: 0 + - equal: + path: spec.template.spec.containers[0].resources.requests.cpu + value: "500m" + documentIndex: 1 + + - it: lets an instance opt out of resources entirely (legacy BestEffort) + template: templates/deployment-consumer.yaml + set: + consumers: + instances: + - name: besteffort + transports: besteffort_transport + resources: null + asserts: + - notExists: + path: spec.template.spec.containers[0].resources + - it: propagates pod annotations and labels template: templates/deployment-webserver-php-fpm.yaml set: diff --git a/charts/shopsys-app/tests/cron_test.yaml b/charts/shopsys-app/tests/cron_test.yaml index 0973dc5..56fb245 100644 --- a/charts/shopsys-app/tests/cron_test.yaml +++ b/charts/shopsys-app/tests/cron_test.yaml @@ -93,3 +93,39 @@ tests: - notMatchRegex: path: data.cron pattern: 'project_secret_env' + + - it: ships default resource requests and limits + template: templates/deployment-cron.yaml + asserts: + - equal: + path: spec.template.spec.containers[0].resources + value: + limits: + memory: 1Gi + requests: + cpu: "100m" + memory: 300Mi + + - it: deep-merges resource overrides with the defaults + template: templates/deployment-cron.yaml + set: + cron: + resources: + requests: + cpu: "10m" + asserts: + - equal: + path: spec.template.spec.containers[0].resources.requests.cpu + value: "10m" + - equal: + path: spec.template.spec.containers[0].resources.limits.memory + value: 1Gi + + - it: drops the resources block entirely when set to null (legacy BestEffort opt-out) + template: templates/deployment-cron.yaml + set: + cron: + resources: null + asserts: + - notExists: + path: spec.template.spec.containers[0].resources diff --git a/charts/shopsys-app/values.yaml b/charts/shopsys-app/values.yaml index 583efa2..2fc9f40 100644 --- a/charts/shopsys-app/values.yaml +++ b/charts/shopsys-app/values.yaml @@ -274,7 +274,14 @@ cron: maxSurge: 1 maxUnavailable: 0 type: RollingUpdate - resources: {} + # Conservative defaults (same PHP application image as the webserver); tune per project + # from real metrics. The legacy package shipped no requests/limits (BestEffort pods). + resources: + limits: + memory: 1Gi + requests: + cpu: "100m" + memory: 300Mi securityContext: runAsUser: 0 podAnnotations: {} @@ -308,7 +315,14 @@ consumers: timeLimit: 300 terminationGracePeriodSeconds: 300 progressDeadlineSeconds: 600 - resources: {} + # Conservative defaults (same PHP application image as the webserver); override per + # instance or per environment. The legacy package shipped no requests/limits. + resources: + limits: + memory: 1Gi + requests: + cpu: "50m" + memory: 300Mi podAnnotations: {} podLabels: {} nodeSelector: {} diff --git a/docs/migrating-from-shopsys-deployment.md b/docs/migrating-from-shopsys-deployment.md index c2e2d1f..ea4e5ff 100644 --- a/docs/migrating-from-shopsys-deployment.md +++ b/docs/migrating-from-shopsys-deployment.md @@ -124,3 +124,12 @@ Intentional differences of the phase-1 rewrite; everything else is a 1:1 port. env vars (works with any registry — GCR/GAR via username `_json_key` and the service account JSON as the password); the GitLab-flavored `CI_REGISTRY`/`DEPLOY_REGISTER_*` variables keep working as a fallback. +21. **Default resources for cron and consumers**: the legacy package shipped cron and + consumer pods with no requests/limits (`BestEffort` QoS). The chart now defaults to + conservative values (cron: requests `100m`/`300Mi`, consumers: requests `50m`/`300Mi`; + both limited to `1Gi` memory) — tune them per project/environment via + `cron.resources` and `consumers.defaults.resources` (or per instance). QoS changes + from `BestEffort` to `Burstable`: with the request far below the limit nodes can + overcommit, and anything bursting past `1Gi` is now OOMKilled instead of merely + evictable — check your crons'/consumers' peak memory usage before relying on the + defaults, and set `resources: null` on a component to restore the legacy behavior. diff --git a/docs/values.md b/docs/values.md index fd69463..3f814a6 100644 --- a/docs/values.md +++ b/docs/values.md @@ -76,8 +76,10 @@ app: # shared backend configuration webserver: # component (see standard keys) + phpFpm/nginx sub-containers storefront: # component + its own `env` / `secretEnv` (storefront-secret-env Secret) -cron: # component + `instances: [{name, schedule}]` -consumers: # `defaults` + `instances: [{name, transports, replicas, ...}]` +cron: # component + `instances: [{name, schedule}]`; + # default resources: requests 100m/300Mi, limits 1Gi memory +consumers: # `defaults` + `instances: [{name, transports, replicas, ...}]`; + # default resources: requests 50m/300Mi, limits 1Gi memory redis: # infra component + `config` (redis.conf) rabbitmq: # infra component + auth/persistence/management @@ -100,6 +102,13 @@ entries take precedence over `envFrom` in Kubernetes — never define the same k Lists (e.g. `security.whitelistIps`, `domains`) **replace** the base value when overridden by an environment file — they are not merged. Maps merge deeply. +To restore the legacy BestEffort behavior (no requests/limits), set the component's +`resources: null` — for cron via `cron.resources: null`, for a single consumer instance via +`resources: null` on that instance. **Per consumer instance, null the whole `resources` map +(or replace it), never a nested key**: a nested null such as +`resources: {limits: {memory: null}}` survives the per-instance merge and renders a literal +`memory: null`, which is rejected by the Kubernetes API. + ## Legacy env var → values mapping | Legacy env var | New location | diff --git a/tests/golden/scenarios/basic-production/expected/continuous.yaml b/tests/golden/scenarios/basic-production/expected/continuous.yaml index fda309d..1ef7d67 100644 --- a/tests/golden/scenarios/basic-production/expected/continuous.yaml +++ b/tests/golden/scenarios/basic-production/expected/continuous.yaml @@ -1020,6 +1020,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1154,6 +1160,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml index 4fa723f..23c5333 100644 --- a/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml @@ -1020,6 +1020,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1154,6 +1160,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/basic-production/expected/first-deploy.yaml b/tests/golden/scenarios/basic-production/expected/first-deploy.yaml index 6e59144..51ba23d 100644 --- a/tests/golden/scenarios/basic-production/expected/first-deploy.yaml +++ b/tests/golden/scenarios/basic-production/expected/first-deploy.yaml @@ -1020,6 +1020,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1154,6 +1160,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-single-domain/expected/continuous.yaml b/tests/golden/scenarios/development-single-domain/expected/continuous.yaml index d7a06fd..dc8bd8b 100644 --- a/tests/golden/scenarios/development-single-domain/expected/continuous.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/continuous.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml index f24e535..5d8a075 100644 --- a/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml b/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml index c742794..a7b7f04 100644 --- a/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml index 49a4eb4..4bf78ea 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml index 2fe4f09..8796d71 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml index ebcc1ea..95c04cd 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/escaping-env/expected/continuous.yaml b/tests/golden/scenarios/escaping-env/expected/continuous.yaml index f7d5168..74f043c 100644 --- a/tests/golden/scenarios/escaping-env/expected/continuous.yaml +++ b/tests/golden/scenarios/escaping-env/expected/continuous.yaml @@ -1038,6 +1038,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1174,6 +1180,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml index 10aa7d7..9e5fb09 100644 --- a/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml @@ -1038,6 +1038,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1174,6 +1180,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml b/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml index 050be36..821b5cb 100644 --- a/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml +++ b/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml @@ -1038,6 +1038,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1174,6 +1180,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml index e15485e..c4ad252 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml @@ -1021,6 +1021,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1151,6 +1157,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1285,6 +1297,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml index ba649cd..91bdb74 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml @@ -1021,6 +1021,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1151,6 +1157,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1285,6 +1297,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml index 370b55e..c7fae9e 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml @@ -1021,6 +1021,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1151,6 +1157,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1285,6 +1297,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml