FIX(vpa): vpa outofsync by ignoring cpu limits

- differences
- Add ignoreDifferences for Deployment CPU limits
- Prevents ArgoCD from detecting drift when CPU limits are null
- Add RespectIgnoreDifferences syncOption

vpa/argocd/vpa.yaml

@@ -35,6 +35,7 @@ spec:
       - CreateNamespace=true
       - PrunePropagationPolicy=foreground
       - PruneLast=true
+      - RespectIgnoreDifferences=true
 
     retry:
       limit: 5
@@ -43,4 +44,11 @@ spec:
         factor: 2
         maxDuration: 3m
 
+  # Ignore Deployment differences for CPU limits (set to null)
+  ignoreDifferences:
+    - group: apps
+      kind: Deployment
+      jqPathExpressions:
+        - '.spec.template.spec.containers[].resources.limits.cpu'
+
   revisionHistoryLimit: 10

vpa/helm-values/vpa.yaml

@@ -15,33 +15,14 @@ recommender:
       memory: 512Mi
 
 # Updater - applies recommended resource requests to pods
+# Disabled because we're using updateMode: Off (recommendations only)
 updater:
-  enabled: true
-  replicaCount: 1
-
-  resources:
-    limits:
-      cpu: null
-      memory: 1Gi
-    requests:
-      cpu: 50m
-      memory: 512Mi
+  enabled: false
 
 # Admission Controller - injects resource requests into new pods
+# Disabled because we're using updateMode: Off (recommendations only)
 admissionController:
-  enabled: true
-  replicaCount: 1
-
-  resources:
-    limits:
-      cpu: null
-      memory: 512Mi
-    requests:
-      cpu: 50m
-      memory: 256Mi
-
-  # Generate self-signed certificate
-  generateCertificate: true
+  enabled: false
 
 # Optional: Configure default VPA behavior
 # metrics-server should be installed in the cluster