[etcd] Add VPA for etcd - #1489

The maxAllowed CPU is set to 500m, but the default CPU request in packages/extra/etcd/values.yaml is being set to 1000m. This means the VPA will cap the CPU at a value lower than the default request, which is likely not the intention. The maxAllowed value should be greater than or equal to the default request to allow for proper scaling. I'd recommend increasing maxAllowed.cpu to a more reasonable value, for example 4 (which was the previous default request) to give it room to scale.

        cpu: "4"

The updateMode is set to Auto, which will cause VPA to evict etcd pods to apply new resource recommendations. For a critical stateful component like etcd, this can lead to leader elections and potential brief interruptions. While etcd is designed to handle this, it's a risk, especially if a Pod Disruption Budget is not in place to ensure quorum is maintained. A safer approach would be to set updateMode: "Off". This will allow VPA to generate recommendations without automatically applying them, giving you a chance to review them first. Once you are confident with the recommendations, you can apply them manually or switch to an automatic mode.

  updatePolicy:
    updateMode: "Off"

⚠️ Potential issue | 🔴 Critical

Template the VPA names to match the StatefulSet

Both metadata.name and spec.targetRef.name are hard-coded to etcd, but the charted StatefulSet uses the templated fullname. On any release where the generated name differs, this VPA either conflicts with other installs or never binds to the intended target. Reuse the same helper the StatefulSet employs, e.g.:

-  name: etcd
+  name: {{ include "etcd.fullname" . }}
…
-    name: etcd
+    name: {{ include "etcd.fullname" . }}

This keeps the VPA aligned with the StatefulSet across releases.

In packages/extra/etcd/templates/vpa.yaml around lines 1 to 21, both
metadata.name and spec.targetRef.name are hard-coded to "etcd" but must use the
chart's fullname template used by the StatefulSet; change both fields to
reference the same fullname helper (the chart helper the StatefulSet uses) so
the VPA name and the targetRef.name are generated identically to the StatefulSet
across releases, ensuring no conflicts and correct binding.

⚠️ Potential issue | 🟠 Major

Prevent the VPA from clamping baseline CPU

The new default request is 1000m, but the VPA caps recommendations at 500m. As soon as VPA applies, it will evict the pods and drop them to 500m, halving the CPU headroom that was just configured. Raise the maxAllowed (or lower the default) so the baseline is inside the permitted range and the VPA retains freedom to scale up rather than down.

In packages/extra/etcd/values.yaml around lines 15-16, the container CPU request
is set to 1000m which is above the VPA's maxAllowed (500m), causing VPA to clamp
recommendations down and trigger evictions; fix by making the baseline request
fall within the VPA permitted range or expanding the VPA cap — either lower the
default cpu request to ≤500m (e.g., 500m) or update the VPA configuration to
raise maxAllowed.cpu to at least 1000m so the VPA can scale up instead of
forcing pods down.

Fixed in the VPA config.

#!/bin/bash
# Check the VPA configuration to verify the fix
cat packages/extra/etcd/templates/vpa.yaml

Timofei Larkin (@lllamnyp) Perfect! ✅ I can confirm the fix is in place. The VPA maxAllowed CPU is now set to 5000m, which comfortably accommodates the 1000m baseline request. This gives the VPA room to scale from 1000m up to 5000m based on actual usage, rather than being forced to clamp down immediately upon applying recommendations.

The configuration looks good:

• minAllowed: 250m CPU / 256Mi memory
• Default request: 1000m CPU / 512Mi memory
• maxAllowed: 5000m CPU / 8Gi memory

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

⚠️ Potential issue | 🟠 Major

Avoid automatic VPA evictions for etcd.

updateMode: Auto lets VPA evict etcd pods to apply new requests, risking avoidable leader churn and quorum loss if a PDB doesn’t stop back-to-back evictions. Default to "Off" (or at least "Initial") so you can inspect recommendations and roll them out deliberately.

packages/extra/etcd/templates/vpa.yaml around lines 11 to 12: the VPA is
configured with updateMode: Auto which allows automated evictions of etcd pods;
change updateMode to Off (or at minimum Initial) so VPA only reports resource
recommendations and does not evict pods automatically, allowing manual review
and controlled rollout to avoid leader churn and quorum loss.