Add VerticalPodAutoscaler support with HPA-style workload reverse-matching

[bergerx]

Summary

• Adds a standalone VerticalPodAutoscaler.tmpl (target ref, update mode, per-container min/max policy, applied recommendation) built from the live autoscaling.k8s.io/v1 CRD schema.
• Reverse-matches VPAs onto their target workload the same way HorizontalPodAutoscaler already does (matching_hpas), via a new matching_vpas template in common.tmpl, gated by a vpaTargetable flag separate from HPA's scalable gate since VPA can also target DaemonSet directly (unlike HPA).
• install-e2e-deps now installs the real VPA controllers (recommender/updater/admission-controller) via the cowboysysop Helm chart, since the new e2e scenario exercises the updater actually evicting/recreating a Pod to apply a recommendation, not just rendering a static object.
• New e2e test creates a CPU-burning Deployment with deliberately low resource requests, attaches a VPA, waits for a real recommendation and for the updater to evict/recreate the Pod, then asserts both the Deployment's reverse-match line and the VPA's own rendered output against fully anchored (\A...\z) fixtures.

Test plan

• go build ./..., go vet ./..., staticcheck ./...
• go test ./... (unit suite)
• TestE2ERegexFixturesAreAnchored passes for both new fixtures
• TestE2EDynamicManifests/VerticalPodAutoscaler... passes against real minikube (verified on two independent fresh runs)
• Manually verified --deep terminates cleanly (mutual-recursion guard, same as HPA) and DaemonSet reverse-matching works

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request adds support for rendering VerticalPodAutoscaler (VPA) resources, including reverse-matching them to their target workloads (Deployments, StatefulSets, ReplicaSets, and DaemonSets). It also introduces end-to-end tests that deploy VPA controllers via Helm to verify recommendation and eviction behavior. The review feedback highlights several opportunities to prevent potential nil pointer dereferences during template evaluation by defensively guarding .Spec and .Status fields with default empty dictionaries. Additionally, the reviewer suggests renaming misleading labels, such as changing 'Scales' to 'Targets' and clarifying the 'Min replicas to evict' label.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The label 'Scales' is misleading for a VerticalPodAutoscaler because VPA does not scale the number of replicas (like an HPA does); instead, it autoscales the resource requests and limits of the target workload. Consider using 'Targets' or 'Target workload' to accurately describe this relationship.

            {{- \"Targets\" | bold | nindent 2 }}: {{ $.Include \"resource_ref\" (dict \"kind\" (.kind | default \"Deployment\") \"name\" .name \"namespace\" $.Namespace) }}

[gemini-code-assist]

This block has two issues:\n1. Defensive Programming: If .Spec is nil (which can happen for newly created resources or when rendering local files with missing fields), accessing .Spec.updatePolicy or .Spec.resourcePolicy directly will cause a template evaluation error (nil pointer dereference). Guarding .Spec with a default empty dictionary prevents this.\n2. Misleading Label: The label 'Min replicas to evict' is misleading. In the VPA updatePolicy, minReplicas defines the minimum number of replicas that must be running for the updater to be allowed to perform any evictions. It does not mean the minimum number of replicas that will be evicted. Using 'Min replicas for eviction' or 'Min replicas required to evict' is much more accurate.

    {{- $updateMode := ((.Spec | default dict).updatePolicy | default dict).updateMode | default \"Auto\" }}\n    {{- if ne $updateMode \"Auto\" }}\n        {{- \"Update mode\" | bold | nindent 2 }}: {{ $updateMode | cyan }}\n    {{- end }}\n    {{- with ((.Spec | default dict).updatePolicy | default dict).minReplicas }}\n        {{- \"Min replicas for eviction\" | bold | nindent 2 }}: {{ . | toString | cyan }}\n    {{- end }}\n    {{- range ((.Spec | default dict).resourcePolicy | default dict).containerPolicies }}

[gemini-code-assist]

If .Status is nil (e.g., when rendering local files or resources that haven't been reconciled yet), accessing .Status.recommendation directly will cause a template evaluation error. Guard .Status with a default empty dictionary to prevent nil pointer dereferences.

    {{- with ((.Status | default dict).recommendation | default dict).containerRecommendations }}

[gemini-code-assist]

If .Spec or .Status is nil, accessing .Spec.updatePolicy or .Status.recommendation directly will cause a template evaluation error. Use defensive programming to guard these fields with default empty dictionaries.

    {{- $updateMode := ((.Spec | default dict).updatePolicy | default dict).updateMode | default \"Auto\" }}\n    {{- if ne $updateMode \"Auto\" }}, {{ $updateMode | cyan }}{{ end }}\n    {{- range ((.Status | default dict).recommendation | default dict).containerRecommendations }}

[gemini-code-assist]

If .Spec is nil for any retrieved VPA, accessing .Spec.targetRef directly will cause a template evaluation error. Guard .Spec with a default empty dictionary.

            {{- $ref := (.Spec | default dict).targetRef | default dict }}