Reduce CPU load on ifirn.
- gerrit: Raise memory limit to 1536Mi and heap to 768m to end the
OOM crash loop (~14.8k restarts). Sync image (3.8.2-1) and the
reindex init container with the deployed state.
- ingress-nginx: Rate-limit crawlers per bot family (10 r/m, burst
20, 429). Sync proxy-buffer-size with the deployed value (64k).
- renovate: Suspend (failing with "Authentication failure" since
2025-07); disable job retries.
- gitlab: Pin mailroom HPA to one replica.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Change-Id: Iee1ca510fbb80b53d0a1ae424f55d4d1d94c1e38
diff --git a/gerrit/gerrit-k8s.yaml b/gerrit/gerrit-k8s.yaml
index 28341e9..f5822cb 100644
--- a/gerrit/gerrit-k8s.yaml
+++ b/gerrit/gerrit-k8s.yaml
@@ -109,41 +109,41 @@
secret:
secretName: github-secrets
defaultMode: 0444
- #initContainers:
- # - name: reindex
- # image: docker.benkard.de/mulk/gerrit:3.7.1-1
- # command:
- # - java
- # - -jar
- # - /var/gerrit/bin/gerrit.war
- # - reindex
- # - -d
- # - /var/gerrit
- ## - --index
- ## - changes
- # env:
- # - name: _JAVA_OPTIONS
- # value: -Xmx300m -XX:MaxMetaspaceSize=150m -XX:+CMSClassUnloadingEnabled -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -XX:+UnlockExperimentalVMOptions -XX:+UseSerialGC -XX:+UseCompressedOops -XX:+AlwaysPreTouch -XX:+ScavengeBeforeFullGC -XX:+DisableExplicitGC
- # volumeMounts:
- # - name: index-data
- # mountPath: /var/gerrit/index
- # - name: git-data
- # mountPath: /var/gerrit/git
- # - name: cache-data
- # mountPath: /var/gerrit/cache
- # - name: etc-data
- # mountPath: /var/gerrit/etc
- # - name: secure-config
- # mountPath: /var/gerrit/etc/secure.config
- # readOnly: true
- # subPath: secure.config
- # - name: config
- # mountPath: /var/gerrit/etc/gerrit.config
- # readOnly: true
- # subPath: gerrit.config
+ initContainers:
+ - name: reindex
+ image: docker.benkard.de/mulk/gerrit:3.8.2-1
+ command:
+ - java
+ - -jar
+ - /var/gerrit/bin/gerrit.war
+ - reindex
+ - -d
+ - /var/gerrit
+ # - --index
+ # - changes
+ env:
+ - name: _JAVA_OPTIONS
+ value: -Xmx768m -XX:MaxMetaspaceSize=150m -XX:MaxDirectMemorySize=128m -Xss1m -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -XX:+UnlockExperimentalVMOptions -XX:+UseSerialGC -XX:+UseCompressedOops -XX:+ScavengeBeforeFullGC -XX:+DisableExplicitGC
+ volumeMounts:
+ - name: index-data
+ mountPath: /var/gerrit/index
+ - name: git-data
+ mountPath: /var/gerrit/git
+ - name: cache-data
+ mountPath: /var/gerrit/cache
+ - name: etc-data
+ mountPath: /var/gerrit/etc
+ - name: secure-config
+ mountPath: /var/gerrit/etc/secure.config
+ readOnly: true
+ subPath: secure.config
+ - name: config
+ mountPath: /var/gerrit/etc/gerrit.config
+ readOnly: true
+ subPath: gerrit.config
containers:
- name: master
- image: docker.benkard.de/mulk/gerrit:3.7.1-1
+ image: docker.benkard.de/mulk/gerrit:3.8.2-1
# for running `init`:
#
@@ -163,13 +163,13 @@
resources:
limits:
cpu: 2000m
- memory: 600Mi
+ memory: 1536Mi
requests:
- cpu: 10m
- memory: 300Mi
+ cpu: 100m
+ memory: 1Gi
env:
- name: _JAVA_OPTIONS
- value: -Xmx300m -XX:MaxMetaspaceSize=150m -XX:+CMSClassUnloadingEnabled -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -XX:+UnlockExperimentalVMOptions -XX:+UseSerialGC -XX:+UseCompressedOops -XX:+AlwaysPreTouch -XX:+ScavengeBeforeFullGC -XX:+DisableExplicitGC
+ value: -Xmx768m -XX:MaxMetaspaceSize=150m -XX:MaxDirectMemorySize=128m -Xss1m -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -XX:+UnlockExperimentalVMOptions -XX:+UseSerialGC -XX:+UseCompressedOops -XX:+ScavengeBeforeFullGC -XX:+DisableExplicitGC
- name: CANONICAL_WEB_URL
value: https://gerrit.benkard.de/
volumeMounts:
diff --git a/gitlab-system/gitlab.yaml b/gitlab-system/gitlab.yaml
index 28c5f64..a389b17 100644
--- a/gitlab-system/gitlab.yaml
+++ b/gitlab-system/gitlab.yaml
@@ -144,6 +144,10 @@
secretName: gitlab-kas-tls
minReplicas: 1
maxReplicas: 1
+ mailroom:
+ hpa:
+ minReplicas: 1
+ maxReplicas: 1
sidekiq:
#replicas: 1
minReplicas: 1
diff --git a/ingress-nginx/config.yaml b/ingress-nginx/config.yaml
new file mode 100644
index 0000000..918186d
--- /dev/null
+++ b/ingress-nginx/config.yaml
@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: ConfigMap
+
+metadata:
+ labels:
+ app.kubernetes.io/component: controller
+ app.kubernetes.io/instance: ingress-nginx
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: ingress-nginx
+ app.kubernetes.io/version: 0.48.1
+ helm.sh/chart: ingress-nginx-3.35.0
+
+ name: ingress-nginx-controller
+ namespace: ingress-nginx
+
+data:
+ proxy-buffer-size: "64k"
+
+ # Rate-limit crawlers per bot family (not per IP, since they rotate IPs).
+ # Requests with an empty $bot_key (i.e., everyone else) are not limited.
+ http-snippet: |
+ map $http_user_agent $bot_key {
+ default "";
+ ~*GPTBot gptbot;
+ ~*ClaudeBot claudebot;
+ ~*meta-externalagent meta;
+ ~*Amazonbot amazonbot;
+ ~*Bytespider bytespider;
+ ~*PerplexityBot perplexity;
+ ~*CCBot ccbot;
+ ~*SemrushBot semrush;
+ ~*AhrefsBot ahrefs;
+ ~*PetalBot petal;
+ ~*(DataForSeoBot|MJ12bot|DotBot|Reflect) seo-misc;
+ }
+ limit_req_zone $bot_key zone=bots:10m rate=10r/m;
+ limit_req_status 429;
+ server-snippet: |
+ limit_req zone=bots burst=20 nodelay;
+
diff --git a/renovate/renovate.yaml b/renovate/renovate.yaml
index 0fe645c..7ed87c3 100644
--- a/renovate/renovate.yaml
+++ b/renovate/renovate.yaml
@@ -6,8 +6,12 @@
spec:
schedule: '@hourly'
concurrencyPolicy: Forbid
+ # Suspended: failing with "Authentication failure" since 2025-07; fix the token, then unsuspend.
+ suspend: true
+ failedJobsHistoryLimit: 1
jobTemplate:
spec:
+ backoffLimit: 0
template:
spec:
containers: