openova/platform/vpa/chart/values.yaml

# Catalyst Blueprint umbrella metadata — the upstream chart is resolved as
# a Helm subchart via Chart.yaml `dependencies:`. Catalyst-curated values
# under the `vertical-pod-autoscaler:` key flow into the upstream subchart
# unchanged.
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode), every operationally-
# meaningful value is configurable; cluster overlays in clusters/<sovereign>/
# may override any of these without rebuilding the Blueprint OCI artifact.

catalystBlueprint:
  upstream:
    chart: vertical-pod-autoscaler
    version: "11.1.1"
    repo: "https://cowboysysop.github.io/charts/"

# ─── Upstream chart values (subchart key: vertical-pod-autoscaler) ───────
# Note: the cowboysysop chart name on disk is `vertical-pod-autoscaler` —
# Helm's umbrella convention requires the values key match that name.
vertical-pod-autoscaler:

  # Pin upstream image versions — DO NOT use floating tags per
  # docs/INVIOLABLE-PRINCIPLES.md.
  recommender:
    enabled: true
    replicaCount: 1
    image:
      # Upstream cowboysysop chart prepends `.image.registry` (default
      # registry.k8s.io) to `.image.repository`, so we MUST NOT include
      # the registry hostname in repository — the rendered image would
      # be `registry.k8s.io/registry.k8s.io/autoscaling/...` (doubled
      # prefix) and pulls fail with "image not found" (caught live on
      # otech26).
      repository: autoscaling/vpa-recommender
      tag: "1.5.0"
      pullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 50m
        memory: 256Mi
      limits:
        cpu: 500m
        memory: 1Gi
    # Recommender prefers metrics-server but will also scrape Prometheus
    # when configured. The default (metrics-server only) is fine for a
    # fresh Sovereign — per-Sovereign overlays MAY add Prometheus extra
    # args once bp-mimir reconciles.
    extraArgs: {}
    # ServiceMonitor / PrometheusRule — DEFAULT FALSE per
    # docs/BLUEPRINT-AUTHORING.md §11.2. monitoring.coreos.com/v1 CRDs
    # ship with kube-prometheus-stack, which is an Application-tier
    # Blueprint. Operator opts in via per-cluster overlay.
    metrics:
      serviceMonitor:
        enabled: false
      prometheusRule:
        enabled: false

  updater:
    enabled: true
    replicaCount: 1
    image:
      repository: autoscaling/vpa-updater
      tag: "1.5.0"
      pullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        cpu: 200m
        memory: 512Mi
    # Per-Sovereign overlays MAY tune `--eviction-tolerance` etc.
    extraArgs: {}
    metrics:
      serviceMonitor:
        enabled: false
      prometheusRule:
        enabled: false

  admissionController:
    enabled: true
    replicaCount: 1
    image:
      repository: autoscaling/vpa-admission-controller
      tag: "1.5.0"
      pullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        cpu: 200m
        memory: 512Mi
    # The admission controller serves a MutatingWebhookConfiguration over
    # TLS. The upstream chart bootstraps a self-signed CA + cert via an
    # init job, which is fine for Catalyst because the webhook is
    # cluster-internal and not exposed externally. Per-Sovereign overlays
    # MAY swap to cert-manager-issued certs if preferred.
    generateCertificate: true
    metrics:
      serviceMonitor:
        enabled: false
      prometheusRule:
        enabled: false

  # CRDs — VPA's CRDs (verticalpodautoscalers, verticalpodautoscalercheck
  # points) ship with the chart. `helm install` creates them. Per
  # docs/INVIOLABLE-PRINCIPLES.md #3, we keep CRD lifecycle managed by
  # the chart — Flux will surface CRD upgrade conflicts as
  # InstallFailed/UpgradeFailed events that the operator resolves
  # explicitly (no silent drift).
  crds:
    install: true
    keep: true

  # RBAC — chart manages its own ClusterRole + ServiceAccount.
  rbac:
    create: true

  # Default UpdateMode for autogenerated VPAs is `Off` (recommend only).
  # Per docs/INVIOLABLE-PRINCIPLES.md #1: Catalyst doesn't auto-enable
  # mutation of customer workloads — SREs opt in per-workload via a
  # VerticalPodAutoscaler CR with `updatePolicy.updateMode: Auto`.
  # (This setting is not consumed by the upstream chart directly — it
  # documents intent. Per-workload VPA CRs override it.)

# ─── Catalyst overlay values (consumed by templates/ in this chart) ──────
# Reserved for Catalyst-side overlays (NetworkPolicy) added in a follow-up
# PR once bp-vpa is consumed in clusters/_template/.
vpaOverlay:
  networkPolicy:
    enabled: false
    admissionWebhookPort: 8000
    metricsPort: 8942
    metricsServerPort: 4443