FIX(velero): increase memory limit to fix plugin startup

- Increase memory request from 50Mi to 128Mi
- Increase memory limit from 50Mi to 256Mi
- Fixes AWS plugin timeout/killed error loop

application.yaml

@@ -9,7 +9,7 @@ spec:
   project: default
 
   source:
-    repoURL: https://github.com/K3S-HOME/storage.git
+    repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     path: .
 

cnpg/argocd.yaml

@@ -14,7 +14,7 @@ spec:
     helm:
       valueFiles:
       - $values/cnpg/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/storage.git
+  - repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     ref: values
   destination:

cnpg/helm-values.yaml

@@ -8,15 +8,15 @@ image:
   pullPolicy: IfNotPresent
 
 # Replica count for operator
-replicaCount: 2
+replicaCount: 1
 
-# Resource requests for operator
+# Resource settings (no CPU limit for stability)
 resources:
   requests:
     cpu: 15m
-    memory: 128Mi
+    memory: 100Mi
   limits:
-    memory: 128Mi
+    memory: 100Mi
 
 # RBAC
 rbac:
@@ -67,6 +67,9 @@ nodeSelector: {}
 # Tolerations
 tolerations: []
 
+# High priority for critical database operator
+priorityClassName: high-priority
+
 # Affinity - Soft Anti-Affinity to spread pods across nodes
 affinity:
   podAntiAffinity:

minio/argocd.yaml

@@ -14,10 +14,10 @@ spec:
     helm:
       valueFiles:
       - $values/minio/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/storage.git
+  - repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     ref: values
-  - repoURL: https://github.com/K3S-HOME/storage.git
+  - repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     path: minio
   destination:

minio/helm-values.yaml

@@ -32,13 +32,13 @@ existingSecret: minio-root-password
 rootUserSecretKey: root-user
 rootPasswordSecretKey: root-password
 
-# Resources
+# Resource settings (no CPU limit for stability)
 resources:
   requests:
-    memory: 263Mi
+    cpu: 48m
-    cpu: 15m
+    memory: 126Mi
   limits:
-    memory: 263Mi
+    memory: 183Mi
 
 # Service
 service:
@@ -58,7 +58,7 @@ environment:
   MINIO_API_REPLICATION_MAX_WORKERS: "1"
   MINIO_API_REPLICATION_MAX_LRG_WORKERS: "1"
   MINIO_API_TRANSITION_WORKERS: "1"
-  MINIO_SCANNER_SPEED: "slow"
+  MINIO_SCANNER_SPEED: "slowest"
 
 # API Ingress (S3 endpoint)
 ingress:
@@ -101,16 +101,18 @@ affinity:
                   - minio
           topologyKey: kubernetes.io/hostname
 
-# Tolerations for control-plane node (minio-0 runs on control-plane)
+# High priority for critical storage infrastructure
-tolerations:
+priorityClassName: high-priority
-  - key: "node-role.kubernetes.io/control-plane"
-    operator: "Exists"
-    effect: "NoSchedule"
 
 # Prometheus metrics
 metrics:
   serviceMonitor:
-    enabled: true  # Enable ServiceMonitor for Prometheus scraping
+    enabled: true
+    includeNode: true
+    additionalLabels:
+      release: prometheus
+    interval: 30s
+    scrapeTimeout: 10s
 
 # Disable post-install job by setting all triggers to empty
 # Job is created if any of: buckets, users, policies, customCommands, svcaccts exist

minio/manifests/console-deployment.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app: minio-console
 spec:
-  replicas: 2
+  replicas: 1
   selector:
     matchLabels:
       app: minio-console

minio/manifests/secret.yaml

@@ -14,19 +14,19 @@ spec:
   data:
     - secretKey: root-user
       remoteRef:
-        key: minio
+        key: storage/minio
         property: ROOT_USER
     - secretKey: root-password
       remoteRef:
-        key: minio
+        key: storage/minio
         property: ROOT_PASSWORD
     - secretKey: rootUser
       remoteRef:
-        key: minio
+        key: storage/minio
         property: ROOT_USER
     - secretKey: rootPassword
       remoteRef:
-        key: minio
+        key: storage/minio
         property: ROOT_PASSWORD
 ---
 apiVersion: external-secrets.io/v1
@@ -49,28 +49,28 @@ spec:
     data:
       - secretKey: AWS_ACCESS_KEY_ID
         remoteRef:
-          key: minio-s3-credentials
+          key: storage/minio-s3-credentials
           property: AWS_ACCESS_KEY_ID
           conversionStrategy: Default
           decodingStrategy: None
           metadataPolicy: None
       - secretKey: AWS_SECRET_ACCESS_KEY
         remoteRef:
-          key: minio-s3-credentials
+          key: storage/minio-s3-credentials
           property: AWS_SECRET_ACCESS_KEY
           conversionStrategy: Default
           decodingStrategy: None
           metadataPolicy: None
       - secretKey: AWS_REGION
         remoteRef:
-          key: minio-s3-credentials
+          key: storage/minio-s3-credentials
           property: AWS_REGION
           conversionStrategy: Default
           decodingStrategy: None
           metadataPolicy: None
       - secretKey: AWS_S3_ENDPOINT
         remoteRef:
-          key: minio-s3-credentials
+          key: storage/minio-s3-credentials
           property: AWS_S3_ENDPOINT
           conversionStrategy: Default
           decodingStrategy: None

pgweb/argocd.yaml

@@ -14,10 +14,10 @@ spec:
     helm:
       valueFiles:
       - $values/pgweb/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/storage.git
+  - repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     ref: values
-  - repoURL: https://github.com/K3S-HOME/storage.git
+  - repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     path: pgweb
   destination:

pgweb/helm-values.yaml

@@ -3,7 +3,7 @@
 
 controllers:
   main:
-    replicas: 2
+    replicas: 1
     annotations:
       reloader.stakater.com/auto: "true"
     containers:
@@ -20,6 +20,7 @@ controllers:
               secretKeyRef:
                 name: pgweb-password
                 key: database-url
+        # Resource settings (no CPU limit for stability)
         resources:
           requests:
             cpu: 15m

pgweb/manifests/secret.yaml

@@ -14,13 +14,13 @@ spec:
   data:
     - secretKey: database-url
       remoteRef:
-        key: pgweb
+        key: storage/pgweb
         property: DATABASE_URL
     - secretKey: auth-user
       remoteRef:
-        key: pgweb
+        key: storage/pgweb
         property: AUTH_USER
     - secretKey: auth-password
       remoteRef:
-        key: pgweb
+        key: storage/pgweb
         property: AUTH_PASSWORD

postgresql/argocd/postgresql.yaml

@@ -9,7 +9,7 @@ spec:
   project: default
 
   source:
-    repoURL: https://github.com/K3S-HOME/storage.git
+    repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     path: postgresql
 

postgresql/manifests/cluster.yaml

@@ -67,10 +67,6 @@ spec:
   # Affinity to spread replicas across nodes (soft - prefer different nodes)
   affinity:
     podAntiAffinityType: preferred
-    tolerations:
-      - key: "node-role.kubernetes.io/control-plane"
-        operator: "Exists"
-        effect: "NoSchedule"
 
   # Enable superuser access
   enableSuperuserAccess: true

postgresql/manifests/secret.yaml

@@ -19,7 +19,7 @@ spec:
   data:
     - secretKey: password
       remoteRef:
-        key: postgresql
+        key: storage/postgresql
         property: PASSWORD
 
 ---
@@ -44,5 +44,5 @@ spec:
   data:
     - secretKey: password
       remoteRef:
-        key: postgresql
+        key: storage/postgresql
         property: PASSWORD

velero/argocd.yaml

@@ -20,10 +20,10 @@ spec:
     helm:
       valueFiles:
       - $values/velero/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/storage.git
+  - repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     ref: values
-  - repoURL: https://github.com/K3S-HOME/storage.git
+  - repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     path: velero
     kustomize: {}
@@ -74,9 +74,9 @@ spec:
         resources:
           requests:
             cpu: 15m  # VPA recommendation
-            memory: 128Mi
+            memory: 256Mi
           limits:
-            memory: 128Mi
+            memory: 256Mi
 
         service:
           type: ClusterIP
@@ -86,15 +86,6 @@ spec:
           - name: BASIC_AUTH_ENABLED
             value: "false"
 
-        # Run on master node with velero controller
-        nodeSelector:
-          node-role.kubernetes.io/control-plane: "true"
-
-        tolerations:
-          - key: "node-role.kubernetes.io/control-plane"
-            operator: "Exists"
-            effect: "NoSchedule"
-
         affinity: {}
         envFrom: []
 

velero/helm-values.yaml

@@ -13,13 +13,13 @@ image:
 # Replica count (Velero does not support multiple replicas)
 replicaCount: 1
 
-# Resource requests (VPA recommendation: 11m CPU)
+# Resource settings (no CPU limit for stability)
 resources:
   requests:
-    cpu: 11m
+    cpu: 10m
     memory: 128Mi
   limits:
-    memory: 128Mi
+    memory: 256Mi
 
 # Init containers for plugins
 initContainers:
@@ -37,18 +37,13 @@ deployNodeAgent: true
 nodeAgent:
   podVolumePath: /var/lib/kubelet/pods
   privileged: false
+  # Resource settings (no CPU limit for stability)
   resources:
     requests:
-      cpu: 15m  # VPA recommendation: 15m
+      cpu: 15m
-      memory: 256Mi
+      memory: 100Mi
     limits:
-      memory: 256Mi
+      memory: 100Mi
-  # Run on all nodes including control-plane for full backup coverage
-  tolerations:
-    - key: "node-role.kubernetes.io/control-plane"
-      operator: "Exists"
-      effect: "NoSchedule"
-
 # Configuration for backup storage
 configuration:
   # Use existing BackupStorageLocation and VolumeSnapshotLocation
@@ -81,7 +76,8 @@ configuration:
   # This prevents status updates that trigger ArgoCD refreshes
   storeValidationFrequency: 0s
 
-  # Note: backup-sync is enabled to show backups in velero-ui
+  # Disable backup-sync (user only uses manual backups)
+  backupSyncPeriod: 0s
 
 # Credentials for S3 access (from Vault via External Secrets)
 credentials:
@@ -106,15 +102,5 @@ serviceAccount:
 rbac:
   create: true
 
-# Node selector - Run on control-plane node for stability
-nodeSelector:
-  node-role.kubernetes.io/control-plane: "true"
-
-# Tolerations - Allow scheduling on control-plane node
-tolerations:
-  - key: "node-role.kubernetes.io/control-plane"
-    operator: "Exists"
-    effect: "NoSchedule"
-
 # Affinity (disabled - single replica on master)
 affinity: {}

velero/manifests/secret.yaml

@@ -21,11 +21,11 @@ spec:
   data:
     - secretKey: minioAccessKey
       remoteRef:
-        key: minio
+        key: storage/minio
         property: ROOT_USER
     - secretKey: minioSecretKey
       remoteRef:
-        key: minio
+        key: storage/minio
         property: ROOT_PASSWORD
 
 ---
@@ -45,9 +45,9 @@ spec:
   data:
     - secretKey: username
       remoteRef:
-        key: velero
+        key: storage/velero
         property: UI_USERNAME
     - secretKey: password
       remoteRef:
-        key: velero
+        key: storage/velero
         property: UI_PASSWORD

zot/argocd.yaml

@@ -14,10 +14,10 @@ spec:
     helm:
       valueFiles:
       - $values/zot/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/storage.git
+  - repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     ref: values
-  - repoURL: https://github.com/K3S-HOME/storage.git
+  - repoURL: https://github0213.com/K3S-HOME/storage.git
     targetRevision: main
     path: zot
   destination:

zot/helm-values.yaml

@@ -32,12 +32,13 @@ controllers:
                 port: 5000
               initialDelaySeconds: 5
               periodSeconds: 10
+        # Resource settings (no CPU limit for stability)
         resources:
           requests:
             cpu: 15m
-            memory: 128Mi
+            memory: 100Mi
           limits:
-            memory: 128Mi
+            memory: 248Mi
 service:
   zot:
     controller: zot

zot/manifests/secret.yaml

@@ -14,7 +14,7 @@ spec:
   data:
   - secretKey: htpasswd
     remoteRef:
-      key: zot
+      key: storage/zot
       property: HTPASSWD
 ---
 apiVersion: external-secrets.io/v1
@@ -41,11 +41,11 @@ spec:
   data:
   - secretKey: client_id
     remoteRef:
-      key: zot
+      key: storage/zot
       property: OIDC_CLIENT_ID
   - secretKey: client_secret
     remoteRef:
-      key: zot
+      key: storage/zot
       property: OIDC_CLIENT_SECRET
 ---
 apiVersion: external-secrets.io/v1
@@ -72,9 +72,9 @@ spec:
   data:
   - secretKey: hashKey
     remoteRef:
-      key: zot
+      key: storage/zot
       property: SESSION_HASH_KEY
   - secretKey: encryptKey
     remoteRef:
-      key: zot
+      key: storage/zot
       property: SESSION_BLOCK_KEY