chart: allow a gateway-only resources override (MLI-8534)

charts/model-engine/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.9
+version: 0.2.10
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/model-engine/templates/gateway_deployment.yaml

@@ -82,7 +82,15 @@ spec:
             - -m
             - model_engine_server.entrypoints.start_fastapi_server
           resources:
-            {{- toYaml .Values.resources | nindent 12 }}
+            {{- /* The gateway proxies async-task results inline, so its memory profile is
+                 unrelated to the cacher and endpoint-builder that share .Values.resources.
+                 gateway.resources deep-merges OVER that shared block, so a memory-only
+                 override keeps the shared cpu / ephemeral-storage requests.
+                 deepCopy is required: mergeOverwrite mutates its first argument, and
+                 .Values.resources is also rendered into the cacher and endpoint-builder. */}}
+            {{- $base := .Values.resources | default dict }}
+            {{- $gatewayResources := (.Values.gateway | default dict).resources | default dict }}
+            {{- toYaml (mergeOverwrite (deepCopy $base) $gatewayResources) | nindent 12 }}
           {{- include "modelEngine.gatewayEnv" . | indent 10 }}
           {{- include "modelEngine.volumeMounts" . | indent 10 }}
       automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}

charts/model-engine/templates/gateway_vpa.yaml

@@ -23,5 +23,5 @@ spec:
         maxAllowed:
           cpu: {{ .Values.autoscaling.vertical.maxAllowed.cpu }}
           memory: {{ .Values.autoscaling.vertical.maxAllowed.memory }}
-        controlledResources: ["cpu", "memory"]
+        controlledResources: {{ (.Values.gateway | default dict).vpaControlledResources | default (list "cpu" "memory") | toJson }}
 {{- end }}

charts/model-engine/values.yaml

@@ -48,6 +48,21 @@ gateway:
     attempts: 3
     retryOn: connect-failure,unavailable,502,504
     perTryTimeout: null
+  # resources deep-merges over the top-level `resources` for the gateway container only.
+  # That top-level block is shared with the cacher and endpoint-builder, which run a
+  # handful of pods each and sit near 1GiB; the gateway runs the whole fleet and holds
+  # task results in memory while it proxies them. Sizing all three off one block means
+  # either under-declaring the gateway or over-reserving for the other two.
+  # Keys set here win; keys absent here fall through to `resources`, so a memory-only
+  # override keeps the shared cpu and ephemeral-storage requests. Leave empty to inherit
+  # `resources` unchanged.
+  resources: {}
+  # vpaControlledResources sets the gateway VPA's controlledResources. The VPA runs in
+  # updateMode: Initial, so it rewrites requests at pod creation and clamps them to
+  # autoscaling.vertical.maxAllowed — which would silently override any memory request
+  # pinned in `gateway.resources` above. Set to ["cpu"] when pinning memory statically,
+  # so the VPA keeps managing CPU and stops managing memory.
+  vpaControlledResources: ["cpu", "memory"]
 
 # rateLimits [optional] per-pod Envoy local_ratelimit token buckets on the gateway
 # sidecars (inbound). Overflow returns 429 at the proxy without reaching a gateway