I checked on barnard and andromeda, the only cron job is backup (already notifies on failures/warnings) and the certbot timer is the only one that I found that needs email notifications. Closing this one
I have managed to update mysql-server-5.7, after stopping /etc/systemd/system/mysql.service, moving it, running systemctl daemon-reload.
On andromeda there is a /etc/systemd/system/mysql.service file that was created by Chef, on a fresh VM the service is provided by the package and is located at /lib/systemd/system/mysql.service. So it looks like an issue caused by past versions of the mysql cookbook
The apt preferences files you created are being ignored because of their name (apt thinks .7 is the extension, so they would need to end with .pref). Here's the manpage
I found a resource that lists the actual allocatable memory for different node types: https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-architecture#memory_cpu
I found what caused this, it's https://gitea.kosmos.org/kosmos/chef/src/branch/master/site-cookbooks/kosmos-nginx/recipes/default.rb#L63-L68 (introduced in 36a5048).