nik/homelab
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: add resource requests/limits and probes to workloads that had none

Browse Source 
Stage 7 of REFACTOR_PLAN.md (findings #16). Covers dashy, glances,
ca-installer, authentik-proxy-outpost, jellyfin, qbittorrent/jdownloader main
containers (their gluetun sidecars already had probes), and all 4 Immich
Deployments -- previously none of these had any protection against one
workload starving another on this fixed-capacity cluster, nor automatic
restart on hang.

Values are sized from live `kubectl top pod` baselines gathered this session
(not guessed): e.g. Jellyfin/Immich-server were observed at ~3.1-3.3Gi
resident, so their limits give headroom above that (4Gi) rather than an
arbitrary round number. Used tcpSocket probes instead of httpGet wherever I
wasn't certain of an app's exact health-check path (Immich, Postgres/Redis),
to avoid a wrong path causing false probe failures on a live service.

This is Kubernetes-native and takes effect on next pod restart, but should
still be rolled out watching `kubectl top`/restart counts rather than pushed
and forgotten -- limits set too low can OOMKill under real load.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Nik Afiq 2026-07-23 18:21:03 +09:00
parent d0887ac648
commit d44295f569
8 changed files with 211 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
manifests/authentik/authentik-proxy-outpost.yaml
View File

@ -41,6 +41,23 @@ spec:
name: http
- containerPort: 9443
name: https
readinessProbe:
tcpSocket:
port: 9000
initialDelaySeconds: 10
periodSeconds: 15
livenessProbe:
tcpSocket:
port: 9000
initialDelaySeconds: 20
periodSeconds: 30
resources:
requests:
cpu: 20m
memory: 64Mi
limits:
cpu: 200m
memory: 256Mi
---
apiVersion: v1
kind: Service

19
manifests/core/ca-installer/ca-installer.yaml
View File

@ -63,6 +63,25 @@ spec:
image: nginx:alpine
ports:
- containerPort: 80
readinessProbe:
httpGet:
path: /
port: 80
initialDelaySeconds: 5
periodSeconds: 10
livenessProbe:
httpGet:
path: /
port: 80
initialDelaySeconds: 10
periodSeconds: 30
resources:
requests:
cpu: 10m
memory: 32Mi
limits:
cpu: 100m
memory: 64Mi
volumeMounts:
- name: web-files
mountPath: /usr/share/nginx/html/index.html

19
manifests/core/dashy.yaml
View File

@ -43,6 +43,25 @@ spec:
image: lissy93/dashy:latest
ports:
- containerPort: 8080
readinessProbe:
httpGet:
path: /
port: 8080
initialDelaySeconds: 10
periodSeconds: 10
livenessProbe:
httpGet:
path: /
port: 8080
initialDelaySeconds: 20
periodSeconds: 30
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 200m
memory: 256Mi
volumeMounts:
- name: config
mountPath: /app/user-data/conf.yml

17
manifests/core/glances.yaml
View File

@ -34,6 +34,23 @@ spec:
value: "-w"
securityContext:
privileged: true
readinessProbe:
tcpSocket:
port: 61208
initialDelaySeconds: 10
periodSeconds: 15
livenessProbe:
tcpSocket:
port: 61208
initialDelaySeconds: 20
periodSeconds: 30
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 300m
memory: 256Mi
volumeMounts:
- name: host-proc
mountPath: /proc

68
manifests/media/immich.yaml
View File

@ -88,6 +88,23 @@ spec:
value: "--data-checksums"
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
readinessProbe:
tcpSocket:
port: 5432
initialDelaySeconds: 10
periodSeconds: 15
livenessProbe:
tcpSocket:
port: 5432
initialDelaySeconds: 20
periodSeconds: 30
resources:
requests:
cpu: 100m
memory: 512Mi
limits:
cpu: 1000m
memory: 1Gi
volumeMounts:
- name: data
mountPath: /var/lib/postgresql/data
@ -129,6 +146,23 @@ spec:
image: docker.io/redis:6.2-alpine
ports:
- containerPort: 6379
readinessProbe:
tcpSocket:
port: 6379
initialDelaySeconds: 5
periodSeconds: 10
livenessProbe:
tcpSocket:
port: 6379
initialDelaySeconds: 10
periodSeconds: 30
resources:
requests:
cpu: 10m
memory: 32Mi
limits:
cpu: 200m
memory: 128Mi
volumeMounts:
- name: data
mountPath: /data
@ -189,6 +223,23 @@ spec:
value: http://immich-machine-learning:3003
- name: TZ
value: Asia/Tokyo
readinessProbe:
tcpSocket:
port: 2283
initialDelaySeconds: 15
periodSeconds: 15
livenessProbe:
tcpSocket:
port: 2283
initialDelaySeconds: 30
periodSeconds: 30
resources:
requests:
cpu: 200m
memory: 2Gi
limits:
cpu: 2000m
memory: 4Gi
volumeMounts:
- name: library
mountPath: /usr/src/app/upload
@ -244,6 +295,23 @@ spec:
image: ghcr.io/immich-app/immich-machine-learning:v2.7.5
ports:
- containerPort: 3003
readinessProbe:
tcpSocket:
port: 3003
initialDelaySeconds: 15
periodSeconds: 15
livenessProbe:
tcpSocket:
port: 3003
initialDelaySeconds: 30
periodSeconds: 30
resources:
requests:
cpu: 200m
memory: 512Mi
limits:
cpu: 2000m
memory: 2Gi
volumeMounts:
- name: cache
mountPath: /cache

26
manifests/media/jdownloader.yaml
View File

@ -82,6 +82,25 @@ spec:
value: "1000"
- name: TZ
value: "Asia/Tokyo"
readinessProbe:
httpGet:
path: /
port: 5800
initialDelaySeconds: 15
periodSeconds: 15
livenessProbe:
httpGet:
path: /
port: 5800
initialDelaySeconds: 30
periodSeconds: 30
resources:
requests:
cpu: 200m
memory: 512Mi
limits:
cpu: 1000m
memory: 1Gi
volumeMounts:
- name: config
mountPath: /config
@ -91,6 +110,13 @@ spec:
image: python:3.12-alpine
ports:
- containerPort: 9666
resources:
requests:
cpu: 5m
memory: 16Mi
limits:
cpu: 50m
memory: 64Mi
volumeMounts:
- name: config
mountPath: /config

19
manifests/media/jellyfin.yaml
View File

@ -93,6 +93,25 @@ spec:
value: https://jellyfin.home.arpa
- name: LIBVA_DRIVER_NAME
value: radeonsi
readinessProbe:
httpGet:
path: /health
port: 8096
initialDelaySeconds: 15
periodSeconds: 15
livenessProbe:
httpGet:
path: /health
port: 8096
initialDelaySeconds: 30
periodSeconds: 30
resources:
requests:
cpu: 200m
memory: 1Gi
limits:
cpu: 2000m
memory: 4Gi
volumeMounts:
- name: config
mountPath: /config

26
manifests/media/qbittorrent.yaml
View File

@ -103,6 +103,25 @@ spec:
value: "Asia/Tokyo"
- name: WEBUI_PORT
value: "8080"
readinessProbe:
httpGet:
path: /
port: 8080
initialDelaySeconds: 15
periodSeconds: 15
livenessProbe:
httpGet:
path: /
port: 8080
initialDelaySeconds: 30
periodSeconds: 30
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
volumeMounts:
- name: config
mountPath: /config
@ -112,6 +131,13 @@ spec:
image: python:3-alpine
ports:
- containerPort: 8888
resources:
requests:
cpu: 5m
memory: 16Mi
limits:
cpu: 50m
memory: 64Mi
command:
- python3
- -c