From 610a21f7808b46f3eb5a0cd689e26016f97764e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20G=C3=B3recki?= Date: Wed, 19 Aug 2026 04:17:52 +0200 Subject: [PATCH 1/2] Ship default resource requests/limits for cron and consumers Cron and consumer pods inherited the legacy package's missing requests/limits and ran as BestEffort, distorting scheduling and autoscaling decisions. Both run the same PHP application image as the webserver, so conservative defaults are safe: cron requests 100m/300Mi, consumers 50m/300Mi, both capped at 1Gi memory. Overridable per component, per consumer instance and per environment overlay like every other component. Co-Authored-By: Claude Fable 5 --- .../tests/component_schema_test.yaml | 28 +++++++++++++++++++ charts/shopsys-app/tests/cron_test.yaml | 27 ++++++++++++++++++ charts/shopsys-app/values.yaml | 18 ++++++++++-- docs/migrating-from-shopsys-deployment.md | 5 ++++ docs/values.md | 6 ++-- .../basic-production/expected/continuous.yaml | 12 ++++++++ .../expected/first-deploy-with-demo-data.yaml | 12 ++++++++ .../expected/first-deploy.yaml | 12 ++++++++ .../expected/continuous.yaml | 6 ++++ .../expected/first-deploy-with-demo-data.yaml | 6 ++++ .../expected/first-deploy.yaml | 6 ++++ .../expected/continuous.yaml | 6 ++++ .../expected/first-deploy-with-demo-data.yaml | 6 ++++ .../expected/first-deploy.yaml | 6 ++++ .../escaping-env/expected/continuous.yaml | 12 ++++++++ .../expected/first-deploy-with-demo-data.yaml | 12 ++++++++ .../escaping-env/expected/first-deploy.yaml | 12 ++++++++ .../expected/continuous.yaml | 18 ++++++++++++ .../expected/first-deploy-with-demo-data.yaml | 18 ++++++++++++ .../expected/first-deploy.yaml | 18 ++++++++++++ 20 files changed, 242 insertions(+), 4 deletions(-) diff --git a/charts/shopsys-app/tests/component_schema_test.yaml b/charts/shopsys-app/tests/component_schema_test.yaml index e92cb21..f3378a7 100644 --- a/charts/shopsys-app/tests/component_schema_test.yaml +++ b/charts/shopsys-app/tests/component_schema_test.yaml @@ -4,6 +4,7 @@ values: templates: - templates/deployment-storefront.yaml - templates/deployment-webserver-php-fpm.yaml + - templates/deployment-consumer.yaml tests: - it: propagates scheduling and volume keys into the pod spec template: templates/deployment-storefront.yaml @@ -107,6 +108,33 @@ tests: - name: my-pull-secret - name: other-secret + - it: ships default consumer resources and lets an instance override them + template: templates/deployment-consumer.yaml + set: + consumers: + instances: + - name: email + transports: email_transport + - name: heavy + transports: heavy_transport + resources: + requests: + cpu: "500m" + asserts: + - equal: + path: spec.template.spec.containers[0].resources + value: + limits: + memory: 1Gi + requests: + cpu: "50m" + memory: 300Mi + documentIndex: 0 + - equal: + path: spec.template.spec.containers[0].resources.requests.cpu + value: "500m" + documentIndex: 1 + - it: propagates pod annotations and labels template: templates/deployment-webserver-php-fpm.yaml set: diff --git a/charts/shopsys-app/tests/cron_test.yaml b/charts/shopsys-app/tests/cron_test.yaml index 0973dc5..024b170 100644 --- a/charts/shopsys-app/tests/cron_test.yaml +++ b/charts/shopsys-app/tests/cron_test.yaml @@ -93,3 +93,30 @@ tests: - notMatchRegex: path: data.cron pattern: 'project_secret_env' + + - it: ships default resource requests and limits + template: templates/deployment-cron.yaml + asserts: + - equal: + path: spec.template.spec.containers[0].resources + value: + limits: + memory: 1Gi + requests: + cpu: "100m" + memory: 300Mi + + - it: deep-merges resource overrides with the defaults + template: templates/deployment-cron.yaml + set: + cron: + resources: + requests: + cpu: "10m" + asserts: + - equal: + path: spec.template.spec.containers[0].resources.requests.cpu + value: "10m" + - equal: + path: spec.template.spec.containers[0].resources.limits.memory + value: 1Gi diff --git a/charts/shopsys-app/values.yaml b/charts/shopsys-app/values.yaml index 583efa2..2fc9f40 100644 --- a/charts/shopsys-app/values.yaml +++ b/charts/shopsys-app/values.yaml @@ -274,7 +274,14 @@ cron: maxSurge: 1 maxUnavailable: 0 type: RollingUpdate - resources: {} + # Conservative defaults (same PHP application image as the webserver); tune per project + # from real metrics. The legacy package shipped no requests/limits (BestEffort pods). + resources: + limits: + memory: 1Gi + requests: + cpu: "100m" + memory: 300Mi securityContext: runAsUser: 0 podAnnotations: {} @@ -308,7 +315,14 @@ consumers: timeLimit: 300 terminationGracePeriodSeconds: 300 progressDeadlineSeconds: 600 - resources: {} + # Conservative defaults (same PHP application image as the webserver); override per + # instance or per environment. The legacy package shipped no requests/limits. + resources: + limits: + memory: 1Gi + requests: + cpu: "50m" + memory: 300Mi podAnnotations: {} podLabels: {} nodeSelector: {} diff --git a/docs/migrating-from-shopsys-deployment.md b/docs/migrating-from-shopsys-deployment.md index c2e2d1f..c1fae78 100644 --- a/docs/migrating-from-shopsys-deployment.md +++ b/docs/migrating-from-shopsys-deployment.md @@ -124,3 +124,8 @@ Intentional differences of the phase-1 rewrite; everything else is a 1:1 port. env vars (works with any registry — GCR/GAR via username `_json_key` and the service account JSON as the password); the GitLab-flavored `CI_REGISTRY`/`DEPLOY_REGISTER_*` variables keep working as a fallback. +21. **Default resources for cron and consumers**: the legacy package shipped cron and + consumer pods with no requests/limits (`BestEffort` QoS). The chart now defaults to + conservative values (cron: requests `100m`/`300Mi`, consumers: requests `50m`/`300Mi`; + both limited to `1Gi` memory) — tune them per project/environment via + `cron.resources` and `consumers.defaults.resources` (or per instance). diff --git a/docs/values.md b/docs/values.md index fd69463..5bdd7f4 100644 --- a/docs/values.md +++ b/docs/values.md @@ -76,8 +76,10 @@ app: # shared backend configuration webserver: # component (see standard keys) + phpFpm/nginx sub-containers storefront: # component + its own `env` / `secretEnv` (storefront-secret-env Secret) -cron: # component + `instances: [{name, schedule}]` -consumers: # `defaults` + `instances: [{name, transports, replicas, ...}]` +cron: # component + `instances: [{name, schedule}]`; + # default resources: requests 100m/300Mi, limits 1Gi memory +consumers: # `defaults` + `instances: [{name, transports, replicas, ...}]`; + # default resources: requests 50m/300Mi, limits 1Gi memory redis: # infra component + `config` (redis.conf) rabbitmq: # infra component + auth/persistence/management diff --git a/tests/golden/scenarios/basic-production/expected/continuous.yaml b/tests/golden/scenarios/basic-production/expected/continuous.yaml index fda309d..1ef7d67 100644 --- a/tests/golden/scenarios/basic-production/expected/continuous.yaml +++ b/tests/golden/scenarios/basic-production/expected/continuous.yaml @@ -1020,6 +1020,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1154,6 +1160,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml index 4fa723f..23c5333 100644 --- a/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml @@ -1020,6 +1020,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1154,6 +1160,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/basic-production/expected/first-deploy.yaml b/tests/golden/scenarios/basic-production/expected/first-deploy.yaml index 6e59144..51ba23d 100644 --- a/tests/golden/scenarios/basic-production/expected/first-deploy.yaml +++ b/tests/golden/scenarios/basic-production/expected/first-deploy.yaml @@ -1020,6 +1020,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1154,6 +1160,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-single-domain/expected/continuous.yaml b/tests/golden/scenarios/development-single-domain/expected/continuous.yaml index d7a06fd..dc8bd8b 100644 --- a/tests/golden/scenarios/development-single-domain/expected/continuous.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/continuous.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml index f24e535..5d8a075 100644 --- a/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml b/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml index c742794..a7b7f04 100644 --- a/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml index 49a4eb4..4bf78ea 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml index 2fe4f09..8796d71 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml index ebcc1ea..95c04cd 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml @@ -1022,6 +1022,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/escaping-env/expected/continuous.yaml b/tests/golden/scenarios/escaping-env/expected/continuous.yaml index f7d5168..74f043c 100644 --- a/tests/golden/scenarios/escaping-env/expected/continuous.yaml +++ b/tests/golden/scenarios/escaping-env/expected/continuous.yaml @@ -1038,6 +1038,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1174,6 +1180,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml index 10aa7d7..9e5fb09 100644 --- a/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml @@ -1038,6 +1038,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1174,6 +1180,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml b/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml index 050be36..821b5cb 100644 --- a/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml +++ b/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml @@ -1038,6 +1038,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1174,6 +1180,12 @@ spec: value: "479411e7" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml index e15485e..c4ad252 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml @@ -1021,6 +1021,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1151,6 +1157,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1285,6 +1297,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml index ba649cd..91bdb74 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml @@ -1021,6 +1021,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1151,6 +1157,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1285,6 +1297,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml index 370b55e..c7fae9e 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml @@ -1021,6 +1021,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1151,6 +1157,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 50m + memory: 300Mi volumeMounts: - name: domains-urls @@ -1285,6 +1297,12 @@ spec: value: "https://s3.example.com" - name: TRUSTED_PROXY value: "10.0.0.0/8" + resources: + limits: + memory: 1Gi + requests: + cpu: 100m + memory: 300Mi volumeMounts: - name: domains-urls mountPath: /var/www/html/config/domains_urls.yaml From d74fdc4c52ab0bacfac63eabcfd07a3a1e5ff1f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20G=C3=B3recki?= Date: Thu, 20 Aug 2026 12:19:26 +0200 Subject: [PATCH 2/2] Address review: document QoS trade-off and null opt-out, test opt-out paths MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review of PR #47 flagged three actionable gaps around the new default resources for cron and consumers: - Deviation entry 21 listed the numbers but not the operational implication: QoS moves from BestEffort to Burstable, nodes can overcommit (request 300Mi << limit 1Gi), and bursts past 1Gi are now OOMKilled instead of merely evictable. The entry now tells upgraders to check peak memory before relying on the defaults. - docs/values.md now documents the opt-out escape hatch (`resources: null`) and the per-instance footgun: a nested null such as `resources: {limits: {memory: null}}` survives the per-instance mergeOverwrite and renders a literal `memory: null`, which the Kubernetes API rejects — null/replace the whole map instead (verified by rendering). - Unit tests now pin both opt-out paths: `cron.resources: null` and a consumer instance with `resources: null` render no resources block. Docs and tests only — no template or rendered-output change, so golden snapshots are untouched (suite passes unchanged). Co-Authored-By: Claude Fable 5 --- charts/shopsys-app/tests/component_schema_test.yaml | 12 ++++++++++++ charts/shopsys-app/tests/cron_test.yaml | 9 +++++++++ docs/migrating-from-shopsys-deployment.md | 6 +++++- docs/values.md | 7 +++++++ 4 files changed, 33 insertions(+), 1 deletion(-) diff --git a/charts/shopsys-app/tests/component_schema_test.yaml b/charts/shopsys-app/tests/component_schema_test.yaml index f3378a7..4680fe8 100644 --- a/charts/shopsys-app/tests/component_schema_test.yaml +++ b/charts/shopsys-app/tests/component_schema_test.yaml @@ -135,6 +135,18 @@ tests: value: "500m" documentIndex: 1 + - it: lets an instance opt out of resources entirely (legacy BestEffort) + template: templates/deployment-consumer.yaml + set: + consumers: + instances: + - name: besteffort + transports: besteffort_transport + resources: null + asserts: + - notExists: + path: spec.template.spec.containers[0].resources + - it: propagates pod annotations and labels template: templates/deployment-webserver-php-fpm.yaml set: diff --git a/charts/shopsys-app/tests/cron_test.yaml b/charts/shopsys-app/tests/cron_test.yaml index 024b170..56fb245 100644 --- a/charts/shopsys-app/tests/cron_test.yaml +++ b/charts/shopsys-app/tests/cron_test.yaml @@ -120,3 +120,12 @@ tests: - equal: path: spec.template.spec.containers[0].resources.limits.memory value: 1Gi + + - it: drops the resources block entirely when set to null (legacy BestEffort opt-out) + template: templates/deployment-cron.yaml + set: + cron: + resources: null + asserts: + - notExists: + path: spec.template.spec.containers[0].resources diff --git a/docs/migrating-from-shopsys-deployment.md b/docs/migrating-from-shopsys-deployment.md index c1fae78..ea4e5ff 100644 --- a/docs/migrating-from-shopsys-deployment.md +++ b/docs/migrating-from-shopsys-deployment.md @@ -128,4 +128,8 @@ Intentional differences of the phase-1 rewrite; everything else is a 1:1 port. consumer pods with no requests/limits (`BestEffort` QoS). The chart now defaults to conservative values (cron: requests `100m`/`300Mi`, consumers: requests `50m`/`300Mi`; both limited to `1Gi` memory) — tune them per project/environment via - `cron.resources` and `consumers.defaults.resources` (or per instance). + `cron.resources` and `consumers.defaults.resources` (or per instance). QoS changes + from `BestEffort` to `Burstable`: with the request far below the limit nodes can + overcommit, and anything bursting past `1Gi` is now OOMKilled instead of merely + evictable — check your crons'/consumers' peak memory usage before relying on the + defaults, and set `resources: null` on a component to restore the legacy behavior. diff --git a/docs/values.md b/docs/values.md index 5bdd7f4..3f814a6 100644 --- a/docs/values.md +++ b/docs/values.md @@ -102,6 +102,13 @@ entries take precedence over `envFrom` in Kubernetes — never define the same k Lists (e.g. `security.whitelistIps`, `domains`) **replace** the base value when overridden by an environment file — they are not merged. Maps merge deeply. +To restore the legacy BestEffort behavior (no requests/limits), set the component's +`resources: null` — for cron via `cron.resources: null`, for a single consumer instance via +`resources: null` on that instance. **Per consumer instance, null the whole `resources` map +(or replace it), never a nested key**: a nested null such as +`resources: {limits: {memory: null}}` survives the per-instance merge and renders a literal +`memory: null`, which is rejected by the Kubernetes API. + ## Legacy env var → values mapping | Legacy env var | New location |