forust
2a4f215546
Six pods reserved far more memory than they have ever touched. uptime-kuma held a 3Gi limit against 469M of measured p95, metube 2Gi against 72M, convertx 1.5Gi against 85M, netbird-server 1Gi against 97M, searxng 700Mi against 134M and bentopdf 700Mi against 4M. Every one of them is a ceiling the scheduler counts against the node while the memory sits unused. Requests move down with the limits but never below the measured p95, so none of these becomes an eviction candidate as a side effect of being right-sized. The limits keep between 2.2x and 11.6x over the observed max, which is the figure that decides whether a pod gets OOM-killed during a burst. Net effect across the six: requests -557M, limits -4.6Gi, all of it ceiling that was never in use. This is the first change that actually gives memory back. CPU limits are left exactly as they were. They were not part of the sizing pass, they are not being hit on a node sitting at 5% CPU, and removing them is a separate decision from moving memory. Verified: each limit is above the container's own observed max and each request is above its p95, and 16/16 local gates pass.
183 lines
4.4 KiB
YAML
183 lines
4.4 KiB
YAML
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: netbird-server-service
|
|
namespace: netbird
|
|
spec:
|
|
selector:
|
|
app: netbird-server
|
|
ports:
|
|
- port: 80
|
|
name: http
|
|
targetPort: 80
|
|
protocol: TCP
|
|
- port: 3478
|
|
name: stun
|
|
targetPort: 3478
|
|
protocol: UDP
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: netbird-dashboard-service
|
|
namespace: netbird
|
|
spec:
|
|
selector:
|
|
app: netbird-dashboard
|
|
ports:
|
|
- port: 80
|
|
name: http
|
|
targetPort: 80
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: netbird-server-deployment
|
|
namespace: netbird
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: netbird-server
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: netbird-server
|
|
spec:
|
|
containers:
|
|
- name: netbird-server
|
|
image: netbirdio/netbird-server:0.79.0
|
|
command: ["/bin/sh", "/opt/netbird/entrypoint.sh", "--config", "/run/netbird/config.yaml"]
|
|
envFrom:
|
|
- configMapRef:
|
|
name: netbird-config
|
|
ports:
|
|
- containerPort: 80
|
|
name: http
|
|
protocol: TCP
|
|
- containerPort: 3478
|
|
name: stun
|
|
protocol: UDP
|
|
volumeMounts:
|
|
- name: netbird-data
|
|
mountPath: /var/lib/netbird
|
|
- name: netbird-files
|
|
mountPath: /opt/netbird
|
|
readOnly: true
|
|
- name: netbird-secrets
|
|
mountPath: /run/secrets/relay_auth_secret
|
|
subPath: relay_auth_secret
|
|
readOnly: true
|
|
- name: netbird-secrets
|
|
mountPath: /run/secrets/datastore_encryption_key
|
|
subPath: datastore_encryption_key
|
|
readOnly: true
|
|
- name: netbird-run
|
|
mountPath: /run/netbird
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 80
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 5
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 80
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 5
|
|
# p95 97M, max 102M over 7 days. Was 256Mi/1Gi.
|
|
resources:
|
|
requests:
|
|
memory: "128Mi"
|
|
cpu: "250m"
|
|
limits:
|
|
memory: "384Mi"
|
|
cpu: "1000m"
|
|
volumes:
|
|
- name: netbird-data
|
|
persistentVolumeClaim:
|
|
claimName: netbird-pvc
|
|
- name: netbird-files
|
|
configMap:
|
|
name: netbird-config
|
|
defaultMode: 0755
|
|
items:
|
|
- key: config.template.yaml
|
|
path: config.template.yaml
|
|
- key: entrypoint.sh
|
|
path: entrypoint.sh
|
|
- name: netbird-secrets
|
|
secret:
|
|
secretName: netbird-secrets
|
|
items:
|
|
- key: relay_auth_secret
|
|
path: relay_auth_secret
|
|
- key: datastore_encryption_key
|
|
path: datastore_encryption_key
|
|
- name: netbird-run
|
|
emptyDir:
|
|
medium: Memory
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: netbird-dashboard-deployment
|
|
namespace: netbird
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: netbird-dashboard
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: netbird-dashboard
|
|
spec:
|
|
containers:
|
|
- name: dashboard
|
|
image: netbirdio/dashboard:v2.93.0
|
|
envFrom:
|
|
- configMapRef:
|
|
name: netbird-config
|
|
ports:
|
|
- containerPort: 80
|
|
name: http
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 80
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 5
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 80
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 5
|
|
resources:
|
|
requests:
|
|
memory: "64Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "256Mi"
|
|
cpu: "300m"
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: netbird-pvc
|
|
namespace: netbird
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 2Gi
|