fix: add resource limits, PodDisruptionBudgets, and backup error handling

base/api/deployment.yaml

@@ -37,6 +37,13 @@ spec:
       containers:
         - image: ghcr.io/5stackgg/api:latest
           name: api
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "4Gi"
+              cpu: "1000m"
           ports:
             - containerPort: 5585
           startupProbe:

base/api/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - deployment.yaml
   - service.yaml
+  - pdb.yaml
   - ingress.yaml
   - ingress-ws.yaml
   - ingress-relay.yaml

base/api/pdb.yaml

@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: api-pdb
+  namespace: 5stack
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: api

base/backups/postgres-backup-cronjob.yaml

@@ -21,7 +21,7 @@ spec:
                 - |
                   set -euo pipefail
 
-                  apk add --no-cache zip curl ca-certificates bash aws-cli || true
+                  apk add --no-cache zip curl ca-certificates bash aws-cli
 
                   TS=$(date -u +"%Y%m%d%H%M%S")
                   DUMP_FILE="/tmp/backup-$TS.dump"
@@ -30,7 +30,12 @@ spec:
                   export PGPASSWORD="$POSTGRES_PASSWORD"
 
                   pg_dump -h "$POSTGRES_HOST" -p "$POSTGRES_PORT" -U "$POSTGRES_USER" -d "$POSTGRES_DB" -F c -Z 0 --no-owner --no-privileges -f "$DUMP_FILE"
-
+
+                  if [ ! -f "$DUMP_FILE" ] || [ ! -s "$DUMP_FILE" ]; then
+                    echo "ERROR: pg_dump failed or produced empty file"
+                    exit 1
+                  fi
+
                   zip -j "$ZIP_FILE" "$DUMP_FILE"
 
                   ENDPOINT="${S3_ENDPOINT:-minio}"
@@ -49,7 +54,10 @@ spec:
 
                   echo "Uploading to $ENDPOINT : $S3_DB_BACKUP_BUCKET/backup-$TS.zip"
 
-                  aws s3 cp "$ZIP_FILE" "s3://$S3_DB_BACKUP_BUCKET/backup-$TS.zip" --endpoint-url "$ENDPOINT"
+                  if ! aws s3 cp "$ZIP_FILE" "s3://$S3_DB_BACKUP_BUCKET/backup-$TS.zip" --endpoint-url "$ENDPOINT"; then
+                    echo "ERROR: S3 upload failed"
+                    exit 1
+                  fi
 
                   echo "Backup complete: $ZIP_FILE"
 

base/hasura/deployment.yaml

@@ -36,6 +36,13 @@ spec:
       containers:
         - image: hasura/graphql-engine:v2.48.9-ce.cli-migrations-v3
           name: hasura
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "4Gi"
+              cpu: "1000m"
           ports:
             - containerPort: 8080
           startupProbe:

base/hasura/kustomization.yaml

@@ -4,4 +4,5 @@ kind: Kustomization
 resources:
   - deployment.yaml
   - service.yaml
-  - ingress.yaml
+  - ingress.yaml
+  - pdb.yaml

base/hasura/pdb.yaml

@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: hasura-pdb
+  namespace: 5stack
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: hasura

base/minio/stateful-set.yaml

@@ -31,6 +31,13 @@ spec:
       containers:
         - name: minio
           image: quay.io/minio/minio:latest
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
           ports:
             - containerPort: 9000
             - containerPort: 9090

base/redis/stateful-set.yaml

@@ -30,6 +30,13 @@ spec:
       containers:
       - name: redis
         image: redis:8.4-alpine
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "100m"
+          limits:
+            memory: "256Mi"
+            cpu: "250m"
         ports:
         - containerPort: 6379
           protocol: TCP

base/timescaledb/kustomization.yaml

@@ -3,4 +3,5 @@ kind: Kustomization
 
 resources:
   - stateful-set.yaml
-  - service.yaml
+  - service.yaml
+  - pdb.yaml

base/timescaledb/pdb.yaml

@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: timescaledb-pdb
+  namespace: 5stack
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: timescaledb

base/timescaledb/stateful-set.yaml

@@ -29,6 +29,13 @@ spec:
       containers:
         - name: timescaledb
           image: timescale/timescaledb:latest-pg17
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "500m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
           args:
             - postgres
             - '-c'

base/typesense/stateful-set.yaml

@@ -31,6 +31,13 @@ spec:
       containers:
         - name: typesense
           image: typesense/typesense:29.0
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
           ports:
             - containerPort: 8108
           startupProbe:

base/web/deployment.yaml

@@ -36,6 +36,13 @@ spec:
       containers:
         - image: ghcr.io/5stackgg/web:latest
           name: web
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "256Mi"
+              cpu: "250m"
           ports:
             - containerPort: 3000
           startupProbe: