From 16e265239bfdade78eba31c4edb56e8ebcdb09e6 Mon Sep 17 00:00:00 2001
From: Jeffrey Smeets <jeffreysmeets@jsme.be>
Date: Wed, 26 Aug 2026 17:05:56 +0200
Subject: [PATCH] crowdsec: cut lapi and appsec cpu requests so they schedule

Chart defaults set requests == limits == 500m for both. The node is at 95% of
allocatable CPU in requests while actually using about 10%, so lapi sat Pending
with Insufficient cpu. Requests dropped to 50m/100m with the limits left
generous, since appsec runs inline on every public request.
---
 infra/crowdsec/values.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/infra/crowdsec/values.yaml b/infra/crowdsec/values.yaml
index 93e6beb..764c62f 100644
--- a/infra/crowdsec/values.yaml
+++ b/infra/crowdsec/values.yaml
@@ -19,6 +19,15 @@ lapi:
         secretKeyRef:
           name: crowdsec-secrets
           key: bouncer-key
+  # Chart default is requests == limits == 500m, which will not schedule: the
+  # node is at 95% of allocatable CPU in requests while actually using ~10%.
+  resources:
+    requests:
+      cpu: 50m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
   persistentVolume:
     data:
       enabled: true
@@ -42,6 +51,15 @@ agent:
 #=============================#
 appsec:
   enabled: true
+  # Inline on every public request, so it keeps a generous limit but a small
+  # request (same reason as lapi above).
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 1000m
+      memory: 512Mi
   # Hub collections installed into the AppSec pod at startup (the WAF rule sets).
   env:
     - name: COLLECTIONS