From 6093c52160ff84bf177b9fde6370a2160946a7e2 Mon Sep 17 00:00:00 2001 From: Nguyen Minh Phuc Date: Mon, 20 Jul 2026 06:58:28 +0000 Subject: [PATCH] argocd: ignore the cpu request this cluster rewrites MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A Kyverno ClusterPolicy, force-best-effort-cpu, rewrites every container's CPU request to "0" at admission. It is deliberate and predates this app by well over a year: the nodes are oversubscribed and BestEffort-on-CPU is how everything gets scheduled. The chart asks for 50m and the cluster writes 0, so all three Deployments sat permanently OutOfSync while perfectly Healthy — the failure mode where a dashboard is always yellow, everyone learns to ignore it, and it stops meaning anything the day it goes yellow for a real reason. Ignored on the Application rather than capitulating in the chart. What the chart asks for is the honest intent; what the cluster does with it is the cluster's business, and a reader of the repo should see the former. jqPathExpressions rather than jsonPointers, which would have to name a container index and this has to hold for every container in all three Deployments. Takes effect only after a hard refresh. --- deploy/argocd/app.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/deploy/argocd/app.yaml b/deploy/argocd/app.yaml index 9be05b4..dbae640 100644 --- a/deploy/argocd/app.yaml +++ b/deploy/argocd/app.yaml @@ -67,3 +67,23 @@ spec: kind: Job jsonPointers: - /spec/template/metadata/labels + # This cluster runs a Kyverno ClusterPolicy, `force-best-effort-cpu`, whose rule + # set-cpu-request-to-zero rewrites every container's CPU request to "0" at admission. + # It is deliberate and predates this app by well over a year: the nodes are + # oversubscribed, and making pods BestEffort on CPU is how everything gets scheduled. + # + # The chart asks for 50m and the cluster writes 0, so without this the Deployments sit + # permanently OutOfSync while being perfectly Healthy — the failure mode where a + # dashboard is always yellow, everyone learns to ignore it, and it stops meaning + # anything the day it goes yellow for a real reason. + # + # The chart deliberately keeps its real request rather than capitulating to 0. What the + # chart asks for is the honest intent; what the cluster does with it is the cluster's + # business, and a reader of the repo should see the former. + # + # jqPathExpressions, not jsonPointers: a pointer would have to name a container index, + # and this has to hold for every container in every one of the three Deployments. + - group: apps + kind: Deployment + jqPathExpressions: + - .spec.template.spec.containers[].resources.requests.cpu