Adds resource limits for containers in deploy (#11886)

* Adds resource limits for containers in deploy

Signed-off-by: Thomas Miller <thomas@tlm.id.au>

* Updated README and bumped chart.

- README with new variables
- Bumped chart version

Signed-off-by: Thomas Miller <thomas@tlm.id.au>

stable/opa/Chart.yaml

@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.1.0
+version: 1.2.0
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:

stable/opa/README.md

@@ -70,7 +70,9 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `replicas` | Number of admission controller replicas to deploy. | `1` |
 | `tolerations` | List of node taint tolerations. | `[]` |
 | `nodeSelector` | Node labels for pod assignment. | `{}` |
-| `resources` | CPU and memory limits for OPA Pod. | `{}` |
+| `resources` | CPU and memory limits for OPA container. | `{}` |
 | `readinessProbe` | HTTP readiness probe for OPA container. | See [values.yaml](values.yaml) |
 | `livenessProbe` | HTTP liveness probe for OPA container. | See [values.yaml](values.yaml) |
 | `opa` | OPA configuration. | See [values.yaml](values.yaml) |
+| `mgmt.resources` | CPU and memory limits for the kube-mgmt container. | `{}` |
+| `sar.resources` | CPU and memory limits for the sar container. | `{}` |

stable/opa/templates/deployment.yaml

@@ -20,6 +20,8 @@ spec:
         - name: initpolicy
           image: {{ .Values.mgmt.image }}:{{ .Values.mgmt.imageTag }}
           imagePullPolicy: {{ .Values.mgmt.imagePullPolicy }}
+          resources:
+{{ toYaml .Values.mgmt.resources | indent 12 }}
           command:
           - /bin/sh
           - -c
@@ -41,6 +43,8 @@ spec:
         - name: opa
           image: {{ .Values.image }}:{{ .Values.imageTag }}
           imagePullPolicy: {{ .Values.imagePullPolicy }}
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
           args:
             - "run"
             - "--server"
@@ -75,6 +79,8 @@ spec:
         - name: mgmt
           image: {{ .Values.mgmt.image }}:{{ .Values.mgmt.imageTag }}
           imagePullPolicy: {{ .Values.mgmt.imagePullPolicy }}
+          resources:
+{{ toYaml .Values.mgmt.resources | indent 12 }}
           args:
 {{- if .Values.authz.enabled }}
             - --opa-auth-token-file=/authz/mgmt-token
@@ -103,6 +109,8 @@ spec:
         - name: sarproxy
           image: {{ .Values.sar.image }}:{{ .Values.sar.imageTag }}
           imagePullPolicy: {{ .Values.sar.imagePullPolicy }}
+          resources:
+{{ toYaml .Values.sar.resources | indent 12 }}
           command:
             - kubectl
             - proxy
@@ -128,5 +136,3 @@ spec:
 {{ toYaml .Values.nodeSelector | indent 8 }}
       tolerations:
 {{ toYaml .Values.tolerations | indent 8 }}
-      resources:
-{{ toYaml .Values.resources | indent 8 }}

stable/opa/values.yaml

@@ -60,6 +60,7 @@ mgmt:
   imageTag: 0.8
   imagePullPolicy: IfNotPresent
   extraArgs: []
+  resources: {}
   configmapPolicies:
     enabled: false
     namespaces: [opa, kube-federation-scheduling-policy]
@@ -125,6 +126,7 @@ sar:
   image: lachlanevenson/k8s-kubectl
   imageTag: latest
   imagePullPolicy: IfNotPresent
+  resources: {}
 
 # To control the liveness and readiness probes change the fields below.
 readinessProbe: