Add/vertical pod autoscaler

_sub/compute/vertical-pod-autoscaler/apps.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cluster-reconciler-vpa
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: helm-controller
+    namespace: vpa
+
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: platform-apps-vpa
+  namespace: flux-system
+spec:
+  serviceAccountName: kustomize-controller
+  interval: 1m0s
+  path: "${path}"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

_sub/compute/vertical-pod-autoscaler/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ${apps_repo_url}/apps/vertical-pod-autoscaler?ref=${apps_repo_ref}

_sub/compute/vertical-pod-autoscaler/main.tf

@@ -0,0 +1,24 @@
+locals {
+  kustomization_path = "./platform-apps/${var.cluster_name}/vertical-pod-autoscaler"
+}
+
+resource "github_repository_file" "apps" {
+  repository = var.repo_name
+  branch     = var.repo_branch
+  file       = "clusters/${var.cluster_name}/platform-apps-vertical-pod-autoscaler.yaml"
+  content = templatefile("${path.module}/apps.yaml", {
+    path = local.kustomization_path
+  })
+  overwrite_on_create = true
+}
+
+resource "github_repository_file" "kustomization" {
+  repository = var.repo_name
+  branch     = var.repo_branch
+  file       = "${local.kustomization_path}/kustomization.yaml"
+  content = templatefile("${path.module}/kustomization.yaml", {
+    apps_repo_url = var.apps_repo_url
+    apps_repo_ref = var.apps_repo_ref
+  })
+  overwrite_on_create = true
+}

_sub/compute/vertical-pod-autoscaler/vars.tf

@@ -0,0 +1,26 @@
+variable "cluster_name" {
+  type = string
+}
+
+variable "repo_name" {
+  type        = string
+  description = "Name of the Github repo to store the manifests in"
+}
+
+variable "repo_branch" {
+  type        = string
+  description = "Override the default branch of the repo (optional)"
+  default     = "main"
+}
+
+variable "apps_repo_url" {
+  type        = string
+  default     = ""
+  description = "The https url for your GitOps manifests"
+}
+
+variable "apps_repo_ref" {
+  type        = string
+  default     = "main"
+  description = "The default branch or tag for your GitOps manifests"
+}

_sub/compute/vertical-pod-autoscaler/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    github = {
+      source  = "integrations/github"
+      version = ">= 6.8.0,!=6.8.2"
+    }
+  }
+}

compute/k8s-services/main.tf

@@ -809,3 +809,20 @@ module "kyverno" {
     github = github.fluxcd
   }
 }
+
+# --------------------------------------------------
+# Vertical-pod-autoscaler
+# --------------------------------------------------
+
+module "vertical-pod-autoscaler" {
+  source        = "../../_sub/compute/vertical-pod-autoscaler"
+  cluster_name  = var.eks_cluster_name
+  repo_name     = var.fluxcd_bootstrap_repo_name
+  repo_branch   = var.fluxcd_bootstrap_repo_branch
+  apps_repo_url = local.fluxcd_apps_repo_url
+  apps_repo_ref = local.gitops_apps_repo_ref
+
+  providers = {
+    github = github.fluxcd
+  }
+}

test/integration/eu-west-1/k8s-qa/services/terragrunt.hcl

@@ -65,7 +65,7 @@ inputs = {
   # Flux CD
   # --------------------------------------------------
 
-  fluxcd_apps_repo_branch           = "main"
+  fluxcd_apps_repo_branch           = "add/vertical-pod-autoscaler"
   fluxcd_bootstrap_repo_name        = "platform-manifests-qa"
   fluxcd_bootstrap_repo_branch      = "main"
   fluxcd_version                    = "v2.7.5"

test/integration/suite/vpa_test.go

@@ -0,0 +1,29 @@
+package main
+
+import (
+	_ "embed"
+	"testing"
+	"time"
+
+	"github.com/gruntwork-io/terratest/modules/k8s"
+)
+
+// TestVPADeployments verifies that all VPA-related deployments are available.
+func TestVPADeployments(t *testing.T) {
+	t.Parallel()
+	options := k8s.NewKubectlOptions("", "", "vpa")
+	k8s.WaitUntilDeploymentAvailableContext(t, t.Context(), options, "vpa-recommender", 60, 5*time.Second)
+	k8s.WaitUntilDeploymentAvailableContext(t, t.Context(), options, "vpa-admission-controller", 60, 5*time.Second)
+	k8s.WaitUntilDeploymentAvailableContext(t, t.Context(), options, "vpa-updater", 60, 5*time.Second)
+}
+
+// TestVPACertificates verifies that all VPA-related certificates are ready and not expired
+func TestVPACertificates(t *testing.T) {
+	t.Parallel()
+	resource := "certificates"
+	options := k8s.NewKubectlOptions("", "", "vpa")
+	err := k8s.RunKubectlContextE(t, t.Context(), options, "wait", resource, "--for=condition=Ready", "--all", "--timeout=5m")
+	if err != nil {
+		t.Fatalf("%s not ready: %v", resource, err)
+	}
+}