attune-io/attune v0.1.28 on GitHub

What's New in v0.1.28

v0.1.28 keeps existing pod-level resource envelopes valid when containers resize, and it treats HPA scale-to-zero as idle instead of a human shutdown. VPA and HPA list failures now skip apply. A post-resize OOMKill reverts even when kubelet omits FinishedAt.

Highlights

Existing spec.resources envelopes are raised to cover the new container requests on live /resize, CREATE, and AfterSuccessfulResize persist. Attune does not invent an envelope or shrink one.
HPA ScaledToZero skips in-place resize, persist, boost, and eviction on leftover pods. CREATE still sizes when the owner is at zero replicas.
Recommend-only VPA (updateMode: Off) no longer emits VPAConflict. A post-resize OOMKill is classified without waiting for a later FinishedAt.

Pod-level resource envelopes

Container increases could exceed spec.resources and the API would reject the resize. When a pod already has an envelope, live /resize raises it in the same UpdateResize when in-place pod-level resize is available. If that capability is off, an increase that would exceed the envelope is skipped. Decreases still apply. Missing envelopes are left untouched (#763, #758).
CREATE and template persist wrote only container resources. After container mutations they now raise an existing envelope with the same helper. Persist copies a live envelope onto the template so the next rollout keeps it. Persist does not invent an envelope when the live pod had none. If the live envelope list fails, persist is skipped instead of writing a template without the envelope (#764, #771).

HPA idle and VPA coexistence

HPA scale-to-zero looked like a human setting replicas to 0. Workloads with ScaledToZero=True now skip apply. Leftover Running pods stay at their current requests. CREATE still applies initial sizing when the owner is at zero replicas (#762).
Recommend-only VPA (updateMode: Off) warned as a conflict. That is the documented VPA-as-source path. VPAConflict is now skipped for Off. Applying modes still warn (#766).
A VPA target that omitted CPU or memory was treated as zero. The omitted resource is held from live pods (or the template). Unlimited metrics sampling (--max-pods-in-metrics-query=-1) still lists pods so that hold can run (#770, #772, #773).
VPA or HPA list errors looked like none installed. Any list error other than a missing VPA CRD now skips apply, persist, boost, and CREATE (ResizeBlocked=VPAListUnavailable or HPAListUnavailable). kubectl attune status and explain show those reasons. A missing VPA CRD still skips the conflict check (#774, #775, #767).

Safety and events

A post-resize OOMKill was missed when kubelet FinishedAt was zero or not strictly after resized-at. Attune now classifies OOMKilled on the current Terminated state or LastTerminationState, including a 2s kubelet skew. After a successful safety revert, cooldown is stamped so the same reconcile does not re-apply the shrink (#777).
Attune's no-op Event shared the name ResizeDeferred with Kubernetes 1.36 kubelet. The Attune no-op reason is now ResizeUnchanged. Kubelet still uses ResizeDeferred when the node is out of room (#760).

kubectl attune doctor

Doctor had no cgroup v2 row. It now prints an optional cgroup v2 WARN when the runtime version cannot be determined (expected on k3s, kind, and most managed clusters). Missing pods/resize remains a required FAIL. The optional row does not change the exit code (#761).

Compatibility

Surface	Requires
Existing policies	Unchanged on Kubernetes 1.32+
In-place pod-level envelope raise	Cluster reports in-place pod-level resources. Otherwise increases that would exceed the envelope are skipped
Tested Kubernetes versions	1.32 through 1.36 (1.37 experimental)

Upgrade notes

Upgrade the chart to 0.1.28, or set image.tag to 0.1.28 or v0.1.28.
Pull ghcr.io/attune-io/attune:v0.1.28 or ghcr.io/attune-io/attune:0.1.28. Both tags point at the same digest.
Apply CRDs before helm upgrade if you need new schema fields (kubectl apply --server-side --force-conflicts from the release crds.yaml).
Scripts that watched Attune ResizeDeferred for no-ops should watch ResizeUnchanged. Kubelet ResizeDeferred still means the node cannot accept the resize.
VPAListUnavailable and HPAListUnavailable now block apply. Check kubectl attune status if resizes stop after an RBAC or apiserver list error.
CPU-only or memory-only VPA targets hold the omitted resource instead of recommending from zero.

See Upgrading for dest leftover, freeze, and OneShot notes from earlier releases.

Full changelog

v0.1.27...v0.1.28