fix(http-cache,vpa): fix haproxy 3.3 backend name conflict and vpa-for-vpa OOM by IvanHunters · Pull Request #2654 · cozystack/cozystack

IvanHunters · 2026-05-14T10:27:47Z

What this PR does

Fixes two independent issues found during cluster operations:

http-cache (HAProxy 3.3 breaking change)

HAProxy 3.3 no longer allows a frontend and backend to share the same name. The existing config had both frontend http and backend http, which causes haproxy to refuse to start on upgrade. Rename backend http → backend cache and update the default_backend directive accordingly.

vpa-for-vpa (OOMKilled recommender)

The VPA recommender deployed by vpa-for-vpa was hitting its 512Mi memory limit and being OOMKilled. Increase the limit to 1Gi to keep the recommender running stably.

Release note

fix(http-cache): rename haproxy backend to avoid HAProxy 3.3 name conflict between frontend and backend
fix(vpa): increase vpa-for-vpa recommender memory limit from 512Mi to 1Gi to prevent OOMKilled restarts

Summary by CodeRabbit

Bug Fixes
- Corrected HAProxy routing so HTTP traffic is directed to the cache backend.
- Increased the VPA recommender’s memory limit to improve reliability under higher workloads.

…r-vpa OOM HAProxy 3.3 disallows frontend and backend sharing the same name. Rename backend 'http' to 'cache' to resolve the conflict. Increase vpa-for-vpa recommender memory limit from 512Mi to 1Gi to prevent OOMKilled restarts. Signed-off-by: IvanHunters <[email protected]>

coderabbitai · 2026-05-14T10:29:32Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b4fefb53-7905-46f4-909f-339e41caff28

📥 Commits

Reviewing files that changed from the base of the PR and between f5c84eb and 9992985.

📒 Files selected for processing (2)

packages/apps/http-cache/templates/haproxy/configmap.yaml
packages/system/vertical-pod-autoscaler/templates/vpa-for-vpa.yaml

📝 Walkthrough

Walkthrough

Updates HAProxy to use the cache backend for HTTP traffic and increases the VPA recommender memory limit from 512Mi to 1Gi.

Changes

HAProxy cache routing

Layer / File(s)	Summary
Update HAProxy routing `packages/apps/http-cache/templates/haproxy/configmap.yaml`	The `frontend http` section now routes to `backend cache`, whose identifier is updated accordingly.

VPA recommender resources

Layer / File(s)	Summary
Increase recommender memory limit `packages/system/vertical-pod-autoscaler/templates/vpa-for-vpa.yaml`	The recommender memory limit is increased from `512Mi` to `1Gi`.

Estimated code review effort: 2 (Simple) | ~5 minutes

Possibly related PRs

cozystack/cozystack#1198: Adds the VPA-for-VPA template that this change updates.

Suggested reviewers: kvaps, androndo

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches both changes: the HAProxy 3.3 backend naming fix and the vpa-for-vpa memory increase to address OOMs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/haproxy-33-backend-name-vpa-oom

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

packages/apps/http-cache/templates/haproxy/configmap.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

packages/system/vertical-pod-autoscaler/templates/vpa-for-vpa.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Aleksei Sviridkin (lexfrei)

LGTM — both fixes are correct and minimal.

Business context: http-cache runs haproxy:latest, so the image silently rolls to 3.3, which refuses to start when a frontend and a backend share a name; this PR also raises the vpa-for-vpa recommender's memory ceiling to stop OOMKills.

I verified the HAProxy behavior: 3.1 emits the deprecation warning that duplicate proxy names "will not be supported anymore in version 3.3", and 3.3 enforces it. Renaming backend http → backend cache with the matching default_backend cache resolves the conflict, and cache is unique among the proxy sections in this config. The VPA change (limit 512Mi → 1Gi, request unchanged at 512Mi) is a sane remedy. helm template renders both files correctly.

Blockers: none.

Non-blocking:

The same HAProxy 3.3 break is present and unfixed in tcp-balancer, which also runs haproxy:latest. Every frontend/backend pair there shares a name and will refuse to start on 3.3. Evidence: packages/apps/tcp-balancer/templates/configmap.yaml:38,52 (frontend http / backend http), :60,78 (https), :89,111 (kubernetes), :100,117 (talos); packages/apps/tcp-balancer/templates/deployment.yaml:35 (image: haproxy:latest). Worth a follow-up so the next 3.3 rollout does not take tcp-balancer down the same way.
haproxy:latest is unpinned in both charts, which is what turned a major HAProxy upgrade into a surprise outage. Pinning to a tracked major (e.g. haproxy:3.3) would make such breaks deliberate and reviewable. Evidence: packages/apps/http-cache/templates/haproxy/deployment.yaml:34, packages/apps/tcp-balancer/templates/deployment.yaml:35.
Two unrelated fixes are bundled in a single commit (fix(http-cache,vpa): ...). Splitting them would allow either to be reverted independently. Evidence: commit 999298510 touches both packages/apps/http-cache/templates/haproxy/configmap.yaml and packages/system/vertical-pod-autoscaler/templates/vpa-for-vpa.yaml.

gemini-code-assist · 2026-07-22T17:56:37Z

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

github-actions · 2026-10-22T10:30:35Z

Successfully created backport PR for release-1.6:

[Backport release-1.6] fix(http-cache,vpa): fix haproxy 3.3 backend name conflict and vpa-for-vpa OOM #5054

…ame conflict and vpa-for-vpa OOM (#5054) # Description Backport of #2654 to `release-1.6`.

github-actions Bot added size/XS This PR changes 0-9 lines, ignoring generated files area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review kind/bug Categorizes issue or PR as related to a bug labels May 14, 2026

Aleksei Sviridkin (lexfrei) added area/platform Issues or PRs related to platform infrastructure (bundle, flux, talos, installer) and removed area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review labels May 25, 2026

Aleksei Sviridkin (lexfrei) mentioned this pull request Jun 9, 2026

[tcp-balancer] Fix HAProxy 3.3 startup regression #2321

Closed

Aleksei Sviridkin (lexfrei) approved these changes Jun 24, 2026

View reviewed changes

IvanHunters marked this pull request as ready for review July 22, 2026 17:56

IvanHunters requested review from Andrey Kolkov (androndo), Andrei Kvapil (kvaps), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners July 22, 2026 17:56

IvanHunters merged commit f077420 into main Jul 22, 2026
10 of 11 checks passed

IvanHunters deleted the fix/haproxy-33-backend-name-vpa-oom branch July 22, 2026 17:57

myasnikovdaniil added the kind/backport-previous Categorizes issue or PR as requiring a backport to the previous release line label Oct 22, 2026

github-actions Bot mentioned this pull request Oct 22, 2026

[Backport release-1.6] fix(http-cache,vpa): fix haproxy 3.3 backend name conflict and vpa-for-vpa OOM #5054

Merged

myasnikovdaniil added a commit that referenced this pull request Oct 22, 2026

[Backport release-1.6] fix(http-cache,vpa): fix haproxy 3.3 backend n…

e11ff3d

…ame conflict and vpa-for-vpa OOM (#5054) # Description Backport of #2654 to `release-1.6`.

Navigation Menu

Repository navigation

fix(http-cache,vpa): fix haproxy 3.3 backend name conflict and vpa-for-vpa OOM - #2654

fix(http-cache,vpa): fix haproxy 3.3 backend name conflict and vpa-for-vpa OOM#2654
IvanHunters merged 1 commit into
mainfrom
fix/haproxy-33-backend-name-vpa-oom

IvanHunters commented May 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 14, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

Aleksei Sviridkin (lexfrei) left a comment

Uh oh!

gemini-code-assist Bot commented Jul 22, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

IvanHunters commented May 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Aleksei Sviridkin (lexfrei) left a comment

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot commented Jul 22, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

IvanHunters commented May 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 14, 2026 •

edited

Loading