[Merged by Bors] - Added resource limits to all init containers and sidecar containers.

CHANGELOG.md

@@ -13,10 +13,12 @@ All notable changes to this project will be documented in this file.
 
 - `operator-rs` `0.27.1` -> `0.41.0` ([#275]).
 - Removed dummy key from generated Kerberos keytab ([#285]).
+- [BREAKING] Daemonset for SecretOperator now assign resource requests and limits to all containers and init containers. Users who have configured resource limits previously in the 'values.yaml' file will need to move the configured limits from `.resources` to `.node.resources` for them to be honored going forward ([#289]).
 
 [#275]: https://github.com/stackabletech/secret-operator/pull/275
 [#285]: https://github.com/stackabletech/secret-operator/pull/285
 [#286]: https://github.com/stackabletech/secret-operator/pull/286
+[#289]: https://github.com/stackabletech/secret-operator/pull/289
 
 ## [23.4.0] - 2023-04-17
 

deploy/helm/secret-operator/templates/daemonset.yaml

@@ -32,7 +32,7 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           resources:
-            {{- toYaml .Values.resources | nindent 12 }}
+            {{ .Values.node.driver.resources | toYaml | nindent 12 }}
           env:
             - name: CSI_ENDPOINT
               value: /csi/csi.sock
@@ -56,6 +56,8 @@ spec:
         - name: external-provisioner
           image: "{{ .Values.csiProvisioner.image.repository }}:{{ .Values.csiProvisioner.image.tag }}"
           imagePullPolicy: {{ .Values.csiProvisioner.image.pullPolicy }}
+          resources:
+            {{ .Values.controller.externalProvisioner.resources | toYaml | nindent 12 }}
           args:
             - --csi-address=/csi/csi.sock
             - --feature-gates=Topology=true
@@ -66,6 +68,8 @@ spec:
         - name: node-driver-registrar
           image: "{{ .Values.csiNodeDriverRegistrar.image.repository }}:{{ .Values.csiNodeDriverRegistrar.image.tag }}"
           imagePullPolicy: {{ .Values.csiNodeDriverRegistrar.image.pullPolicy }}
+          resources:
+            {{ .Values.node.driverRegistrar.resources | toYaml | nindent 12 }}
           args:
             - --csi-address=/csi/csi.sock
             - --kubelet-registration-path={{ .Values.kubeletDir }}/plugins/secrets.stackable.tech/csi.sock
@@ -83,6 +87,8 @@ spec:
         - name: migrate-longer-csi-registration-path
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          resources:
+            {{ .Values.node.driver.resources | toYaml | nindent 12 }}
           command:
             - /bin/bash
             - -euo

deploy/helm/secret-operator/values.yaml

@@ -46,17 +46,38 @@ securityContext:
   # runAsNonRoot: true
   # runAsUser: 1000
 
-resources: {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
-  #   memory: 128Mi
+controller:
+  externalProvisioner:
+    resources:
+      # Resource requests and limits for the external-provisioner container
+      # Please note: currently this is rolled out per node, but that may change
+      # in the future.
+      limits:
+        cpu: 100m
+        memory: 128Mi
+      requests:
+        cpu: 100m
+        memory: 128Mi
+
+node:
+  driver:
+    resources:
+      # Resource requests and limits for the per node driver container
+      limits:
+        cpu: 100m
+        memory: 128Mi
+      requests:
+        cpu: 100m
+        memory: 128Mi
+  driverRegistrar:
+    resources:
+      # Resource requests and limits for the container running the registrar component per node
+      limits:
+        cpu: 100m
+        memory: 128Mi
+      requests:
+        cpu: 100m
+        memory: 128Mi
 
 nodeSelector: {}