fix(cozy-lib): render tenant hugepages quota only as requests by yankawai · Pull Request #5189 · cozystack/cozystack

europrinter (yankawai) · 2026-11-03T20:22:48Z

What this PR does

A tenant with hugepages-2Mi or hugepages-1Gi in resourceQuotas gets both requests.hugepages-<size> and limits.hugepages-<size> in tenant-quota. Kubernetes accepts huge pages in a ResourceQuota only as hugepages-<size> or requests.hugepages-<size> (IsStandardQuotaResourceName), so the apiserver rejects tenant-quota and the tenant release fails to install or upgrade. Huge pages are not counted in limits.memory either, so today a VM whose memory is backed by huge pages runs outside the tenant quota with no way to bound it.

cozy-lib.resources.flattenResource now drops the limits side for hugepages-*, the same way it already does for storage, so the quota carries only requests.hugepages-<size>. Both page sizes go through the same rule. sanitize is unchanged: a pod spec still needs equal requests and limits for huge pages.

helm unittest . passes 69 of 69 in packages/tests/cozy-lib-tests and 78 of 78 in packages/apps/tenant. The new case fails on main on both limits.hugepages-* keys. Admission reads hugepages usage from requests.* after #5184, which matches what this renders.

Screenshots

Not a UI change.

Downstream repositories

Template change in cozy-lib, one new test case and one line in the hand-written part of packages/apps/tenant/README.md. No values key, schema or default changes. The website tenant reference page is regenerated from that README on release, so no trigger map entry needs a manual follow-up.

Release note

fix(cozy-lib): a tenant quota with hugepages-2Mi or hugepages-1Gi now renders only requests.hugepages-<size>, so the tenant installs and its huge pages are bounded.

Summary by CodeRabbit

Bug Fixes
- Huge-page quotas now apply only to requests, avoiding unsupported limit entries in Kubernetes resource quotas.
Documentation
- Clarified how 2 MiB and 1 GiB huge-page resources are represented in resource quotas.

A tenant with hugepages-2Mi or hugepages-1Gi in resourceQuotas got both requests.hugepages-<size> and limits.hugepages-<size> in tenant-quota. A ResourceQuota accepts huge pages only as hugepages-<size> or requests.hugepages-<size>, so the apiserver rejects tenant-quota and the tenant release fails to install or upgrade. Huge pages are not counted in limits.memory either, so without this key a VM whose memory is backed by huge pages runs outside the tenant quota. The limits side is dropped for hugepages-* the same way it already is for storage. sanitize still emits equal requests and limits, which is what a pod spec needs for huge pages, so only the quota rendering changes. Signed-off-by: Yan Bondarenko <[email protected]> Assisted-by: LLM

chatgpt-codex-connector · 2026-11-03T20:23:01Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T20:30:10.588704Z	`38a3244`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-11-03T20:23:34Z

No actionable comments were generated in the recent review.

Walkthrough

The resource template now omits limits.hugepages-<size> from ResourceQuota output while retaining huge-page requests. The tenant documentation describes this mapping, and the quota test checks two huge-page sizes.

Changes: Huge-page quota mapping

Layer / File(s)	Summary
Huge-page quota mapping and validation `packages/apps/tenant/README.md`, `packages/library/cozy-lib/templates/_resources.tpl`, `packages/tests/cozy-lib-tests/tests/quota_test.yaml`	The documentation specifies requests-only huge-page quotas. The resource template omits huge-page limit entries. The test checks that `hugepages-2Mi` and `hugepages-1Gi` appear under requests and not limits.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested labels: kind/bug, size/L, area/kubernetes

Suggested reviewers: lllamnyp, ivanhunters

Merge Risk: Minimal · up to 38a32

The change removes unsupported hugepages limits quota entries while retaining requests quotas. No merge-blocking risk is identified in the supplied evidence.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: rendering tenant hugepages quota entries only as requests.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

Finishing Touches

Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

Source mode: Auto

Repository: cozystack/cozystack

Branch: main

File: .coderabbit.yaml

Commit: 4087218

Layers: Repository YAML

Review profile: CHILL

Plan: Advanced

Run ID: `a163c142-6bfd-4f99-b31a-db58dc58b76e`

Commits

Reviewing files that changed from the base of the PR and between `4087218` and `38a3244`.

Files selected for processing: 3

`packages/apps/tenant/README.md`

`packages/library/cozy-lib/templates/_resources.tpl`

`packages/tests/cozy-lib-tests/tests/quota_test.yaml`

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 38a32445f7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

chatgpt-codex-connector · 2026-11-03T20:30:07Z

+{{-   else if and (eq $section "limits") (hasPrefix "hugepages-" $type) }}
+{{-     $out = "" }}


Update admission's huge-page key mapping alongside the renderer

When a parent tenant already consumes huge pages, the unchanged renderedLimitKey in pkg/registry/apps/application/quota.go:299-306 still maps these resources to limits.hugepages-*, and validateTenantResourceQuotas uses that mapping to read parent-pool usage at line 236. With this requests-only rendering, the recorded usage is under requests.hugepages-*, so admission reads zero instead. For example, a parent with a 4Gi budget already using 3Gi will incorrectly admit a child requesting 2Gi. Update the admission mapping and its regression tests alongside this change so child reservations account for existing huge-page consumption.

Useful? React with 👍 / 👎.

Covered by #5184, which reads parent pool usage of hugepages-<size> from requests.hugepages-<size>, the side the quota controller counts. Without it the child check still reads limits.hugepages-*, which never shows up in status.used, so the two should land together or #5184 first. It is not a regression in between, before this PR a tenant with a hugepages quota did not install at all, so there was no usage to read either. The trailers are on 38a3244, Signed-off-by and Assisted-by: LLM.

chatgpt-codex-connector · 2026-11-03T20:30:07Z

 {{-   $out := "" }}
 {{-   if and (eq $section "limits") (eq $type "storage") }}
 {{-     $out = "" }}
+{{- /*


Include the required commit trailers

The reviewed commit has no trailer block, so it contains neither Signed-off-by: nor Assisted-by: LLM. AGENTS.md requires commits “with --signoff” and an assistance trailer for agent-assisted work; the linked docs/agents/contributing.md explicitly makes a missing DCO sign-off a review blocker. Include both required trailers before merging this change.

AGENTS.md reference: AGENTS.md:L71-L71

Useful? React with 👍 / 👎.

The PR has one commit, 38a3244, with Signed-off-by and a single Assisted-by: LLM, and hack/check-commit-trailers.sh origin/main..HEAD passes, so this reads some other commit.

chatgpt-codex-connector · 2026-11-03T20:30:07Z

 {{-   if and (eq $section "limits") (eq $type "storage") }}
 {{-     $out = "" }}
+{{- /*
+      A ResourceQuota accepts hugepages only as requests.hugepages-<size>,


Keep the commit body focused on the reason for the change

The reviewed commit embeds the PR template, including implementation narration (flattenResource now drops the limits side), test results, a Screenshots section, and the downstream checklist. AGENTS.md requires commit bodies to explain “WHY, not a narration of WHAT”, and the linked docs/agents/contributing.md Review Blockers section explicitly rejects bodies that walk through the diff. Retain the failure and rationale in the commit body and keep the PR-template material outside it.

AGENTS.md reference: AGENTS.md:L72-L72

Useful? React with 👍 / 👎.

Same here, the body of 38a3244 has only the failure and the reason, the PR template is not in it.

europrinter (yankawai) requested review from IvanHunters, Andrei Kvapil (kvaps), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), Matthieu ROBIN (matthieu-robin), myasnikovdaniil and scooby87 as code owners November 3, 2026 20:22

github-actions Bot added area/platform Issues or PRs related to platform infrastructure (bundle, flux, talos, installer) kind/bug Categorizes issue or PR as related to a bug size/M This PR changes 30-99 lines, ignoring generated files labels Nov 3, 2026

chatgpt-codex-connector Bot reviewed Nov 3, 2026

View reviewed changes

coderabbitai Bot mentioned this pull request Nov 4, 2026

fix(api): read pool usage under the quota key the controller counts #5184

Merged

1 of 12 tasks

Navigation Menu

Repository navigation

fix(cozy-lib): render tenant hugepages quota only as requests - #5189

fix(cozy-lib): render tenant hugepages quota only as requests#5189
europrinter (yankawai) wants to merge 1 commit into
cozystack:mainfrom
yankawai:fix/tenant-quota-hugepages

europrinter (yankawai) commented Nov 3, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Nov 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 3, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Nov 3, 2026

Uh oh!

europrinter (yankawai) Nov 4, 2026

Uh oh!

chatgpt-codex-connector Bot Nov 3, 2026

Uh oh!

europrinter (yankawai) Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot Nov 3, 2026

Uh oh!

europrinter (yankawai) Nov 5, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		{{- else if and (eq $section "limits") (hasPrefix "hugepages-" $type) }}
		{{- $out = "" }}

Conversation

europrinter (yankawai) commented Nov 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Screenshots

Downstream repositories

Release note

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CodeRabbit Verify

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

europrinter (yankawai) Nov 4, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

europrinter (yankawai) Nov 5, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

europrinter (yankawai) Nov 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

europrinter (yankawai) commented Nov 3, 2026 •

edited by coderabbitai Bot

Loading

chatgpt-codex-connector Bot commented Nov 3, 2026 •

edited

Loading

coderabbitai Bot commented Nov 3, 2026 •

edited

Loading