Repository: VictoriaMetrics/operator

Issue:
Defaults CPU requests for reload container too high
Currently all the configReloaders have default cpu requests like this

```
# memory omitted here they look ok to me
resources:
  requests:
    cpu: 100m
```

I think that is too much. If you spin up 5 vmauth half a cpu is gone just for triggering a config reload.

So I propose something like this:

```
resources:
  requests:
    cpu: 10m
  limits:
    cpu: 50m
```
Or maybe even 10m/10m (not sure about that). But the above is what I did to my deployments.

Discussion:
@f41gh7:  I think, limits must be removed by default and only requests left. So config-reloader container should have the following resources:
```
resources:
  requests:
    cpu: 10m
    memory: 25Mi
```
@f41gh7:  The feature was included into [v0.54.0 release](https://docs.victoriametrics.com/operator/changelog/#v0540)@yuriydzobak: Is it possible to configure the memory limit globally?@f41gh7: > Is it possible to configure the memory limit globally?

No, currently it's not possible.  Can you please share your case, why it's needed to have `resources.limit` set at config-reloader container? @yuriydzobak: Hi,
In my case, I'm using [OPA](https://www.openpolicyagent.org/docs/v0.12.2/kubernetes-admission-control/) and i have rule that verify fields for `resources.limit.memory`. If a POD resource is misconfigured and to control eviction priority. Additionally, removing `resources.limit` has changed the [POD's QoS](https://kubernetes.io/docs/concepts/workloads/pods/pod-qos/); it is no longer [guaranteed](https://kubernetes.io/docs/concepts/workloads/pods/pod-qos/#guaranteed), and we need to update each CRD accordingly. It would be helpful if we could use environment variables to configure parameters like these for config-reload in Operator globally. [LINK](https://docs.victoriametrics.com/operator/vars/) insted of expand CRD VMagent/VMalert and so on
```
  containers:
    - name: config-reloader
      resources:
        limits:
          cpu: 10m
          memory: 20Mi
```

Solution patch:
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 22fc2a3c..e3798330 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -25,6 +25,7 @@ aliases:
 * FEATURE: [vmagent](https://docs.victoriametrics.com/operator/resources/vmagent/): support stream aggregation `enableWindows`.
 * FEATURE: [vmagent](https://docs.victoriametrics.com/operator/resources/vmagent/): add RBAC access to [/metrics/slis](https://kubernetes.io/docs/reference/instrumentation/slis/). See [this issue](https://github.com/VictoriaMetrics/operator/issues/1252) for details.
 * FEATURE: [vmoperator](https://docs.victoriametrics.com/operator/): Introduce possible labels breaking changes to kustomize configs. See [this commit](https://github.com/VictoriaMetrics/operator/commit/7a947ae80ef72ca94765cf8a5db1ebb100842775).
+* FEATURE: [vmoperator](https://docs.victoriametrics.com/operator/): reduce `config-reloader` container resources.cpu.requests from `100m` to `10m`. And remove container `resources.limits`. See [this issue](https://github.com/VictoriaMetrics/operator/issues/1235) for details. Thanks @xiaozongyang
 
 * BUGFOX: [vmoperator](https://docs.victoriametrics.com/operator/): Properly generate kustomize config for validation webhook. See [this commit](https://github.com/VictoriaMetrics/operator/commit/40e91d66440db52bf1cbfa9cc41f18f4879dbff0).
 * BUGFIX: [vmagent](https://docs.victoriametrics.com/operator/resources/vmagent/): reduce request latency for `validtion` webhook. See [this issue](https://github.com/VictoriaMetrics/operator/issues/1094) for details.
diff --git a/docs/vars.md b/docs/vars.md
index 03915ced..0e649e33 100644
--- a/docs/vars.md
+++ b/docs/vars.md
@@ -10,7 +10,7 @@ aliases:
   - /operator/vars/index.html
 ---
 <!-- this doc autogenerated - don't edit it manually -->
- updated at Tue Feb 25 09:22:59 UTC 2025
+ updated at Tue Feb 25 13:35:41 UTC 2025
 
 
 | variable name | variable default value | variable required | variable description |
@@ -39,7 +39,7 @@ aliases:
 | VM_VMALERTDEFAULT_RESOURCE_LIMIT_CPU | 200m | false | - |
 | VM_VMALERTDEFAULT_RESOURCE_REQUEST_MEM | 200Mi | false | - |
 | VM_VMALERTDEFAULT_RESOURCE_REQUEST_CPU | 50m | false | - |
-| VM_VMALERTDEFAULT_CONFIGRELOADERCPU | 100m | false | - |
+| VM_VMALERTDEFAULT_CONFIGRELOADERCPU | 10m | false | - |
 | VM_VMALERTDEFAULT_CONFIGRELOADERMEMORY | 25Mi | false | - |
 | VM_VMSERVICESCRAPEDEFAULT_ENFORCEENDPOINTSLICES | false | false | Use endpointslices instead of endpoints as discovery role for vmservicescrape when generate scrape config for vmagent. |
 | VM_VMAGENTDEFAULT_IMAGE | victoriametrics/vmagent | false | - |
@@ -51,7 +51,7 @@ aliases:
 | VM_VMAGENTDEFAULT_RESOURCE_LIMIT_CPU | 200m | false | - |
 | VM_VMAGENTDEFAULT_RESOURCE_REQUEST_MEM | 200Mi | false | - |
 | VM_VMAGENTDEFAULT_RESOURCE_REQUEST_CPU | 50m | false | - |
-| VM_VMAGENTDEFAULT_CONFIGRELOADERCPU | 100m | false | - |
+| VM_VMAGENTDEFAULT_CONFIGRELOADERCPU | 10m | false | - |
 | VM_VMAGENTDEFAULT_CONFIGRELOADERMEMORY | 25Mi | false | - |
 | VM_VMSINGLEDEFAULT_IMAGE | victoriametrics/victoria-metrics | false | - |
 | VM_VMSINGLEDEFAULT_VERSION | v1.112.0 | false | - |
@@ -89,7 +89,7 @@ aliases:
 | VM_VMCLUSTERDEFAULT_VMINSERTDEFAULT_RESOURCE_REQUEST_MEM | 200Mi | false | - |
 | VM_VMCLUSTERDEFAULT_VMINSERTDEFAULT_RESOURCE_REQUEST_CPU | 150m | false | - |
 | VM_VMALERTMANAGER_CONFIGRELOADERIMAGE | jimmidyson/configmap-reload:v0.3.0 | false | - |
-| VM_VMALERTMANAGER_CONFIGRELOADERCPU | 100m | false | - |
+| VM_VMALERTMANAGER_CONFIGRELOADERCPU | 10m | false | - |
 | VM_VMALERTMANAGER_CONFIGRELOADERMEMORY | 25Mi | false | - |
 | VM_VMALERTMANAGER_ALERTMANAGERDEFAULTBASEIMAGE | prom/alertmanager | false | - |
 | VM_VMALERTMANAGER_ALERTMANAGERVERSION | v0.27.0 | false | - |
@@ -117,7 +117,7 @@ aliases:
 | VM_VMAUTHDEFAULT_RESOURCE_LIMIT_CPU | 200m | false | - |
 | VM_VMAUTHDEFAULT_RESOURCE_REQUEST_MEM | 100Mi | false | - |
 | VM_VMAUTHDEFAULT_RESOURCE_REQUEST_CPU | 50m | false | - |
-| VM_VMAUTHDEFAULT_CONFIGRELOADERCPU | 100m | false | - |
+| VM_VMAUTHDEFAULT_CONFIGRELOADERCPU | 10m | false | - |
 | VM_VMAUTHDEFAULT_CONFIGRELOADERMEMORY | 25Mi | false | - |
 | VM_ENABLEDPROMETHEUSCONVERTER_PODMONITOR | true | false | - |
 | VM_ENABLEDPROMETHEUSCONVERTER_SERVICESCRAPE | true | false | - |
@@ -137,4 +137,4 @@ aliases:
 | VM_PODWAITREADYINTERVALCHECK | 5s | false | Defines poll interval for pods ready check at statefulset rollout update |
 | VM_FORCERESYNCINTERVAL | 60s | false | configures force resync interval for VMAgent, VMAlert, VMAlertmanager and VMAuth. |
 | VM_ENABLESTRICTSECURITY | false | false | EnableStrictSecurity will add default `securityContext` to pods and containers created by operator Default PodSecurityContext include: 1. RunAsNonRoot: true 2. RunAsUser/RunAsGroup/FSGroup: 65534 '65534' refers to 'nobody' in all the used default images like alpine, busybox. If you're using customize image, please make sure '65534' is a valid uid in there or specify SecurityContext. 3. FSGroupChangePolicy: &onRootMismatch If KubeVersion>=1.20, use `FSGroupChangePolicy="onRootMismatch"` to skip the recursive permission change when the root of the volume already has the correct permissions 4. SeccompProfile:      type: RuntimeDefault Use `RuntimeDefault` seccomp profile by default, which is defined by the container runtime, instead of using the Unconfined (seccomp disabled) mode. Default container SecurityContext include: 1. AllowPrivilegeEscalation: false 2. ReadOnlyRootFilesystem: true 3. Capabilities:      drop:        - all turn off `EnableStrictSecurity` by default, see https://github.com/VictoriaMetrics/operator/issues/749 for details |
-[envconfig-sum]: 718ad808b5d9ebe2a7f980d76e4f9600
\ No newline at end of file
+[envconfig-sum]: 0fbde57a6221eb3d0742ce6b399a6e05
diff --git a/internal/config/config.go b/internal/config/config.go
index 002f4eac..e8a92f21 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -118,7 +118,7 @@ type BaseOperatorConf struct {
 				Cpu string `default:"50m"`
 			}
 		}
-		ConfigReloaderCPU    string `default:"100m"`
+		ConfigReloaderCPU    string `default:"10m"`
 		ConfigReloaderMemory string `default:"25Mi"`
 	}
 
@@ -144,7 +144,7 @@ type BaseOperatorConf struct {
 				Cpu string `default:"50m"`
 			}
 		}
-		ConfigReloaderCPU    string `default:"100m"`
+		ConfigReloaderCPU    string `default:"10m"`
 		ConfigReloaderMemory string `default:"25Mi"`
 	}
 
@@ -224,7 +224,7 @@ type BaseOperatorConf struct {
 
 	VMAlertManager struct {
 		ConfigReloaderImage          string `default:"jimmidyson/configmap-reload:v0.3.0"`
-		ConfigReloaderCPU            string `default:"100m"`
+		ConfigReloaderCPU            string `default:"10m"`
 		ConfigReloaderMemory         string `default:"25Mi"`
 		AlertmanagerDefaultBaseImage string `default:"prom/alertmanager"`
 		AlertManagerVersion          string `default:"v0.27.0"`
@@ -275,7 +275,7 @@ type BaseOperatorConf struct {
 				Cpu string `default:"50m"`
 			}
 		}
-		ConfigReloaderCPU    string `default:"100m"`
+		ConfigReloaderCPU    string `default:"10m"`
 		ConfigReloaderMemory string `default:"25Mi"`
 	}
 
diff --git a/internal/controller/operator/factory/build/defaults.go b/internal/controller/operator/factory/build/defaults.go
index ce608836..bfac3d52 100644
--- a/internal/controller/operator/factory/build/defaults.go
+++ b/internal/controller/operator/factory/build/defaults.go
@@ -540,8 +540,8 @@ func addDefaluesToConfigReloader(common *vmv1beta1.CommonConfigReloaderParams, u
 			Mem string
 			Cpu string
 		}{
-			Cpu: appDefaults.ConfigReloaderCPU,
-			Mem: appDefaults.ConfigReloaderMemory,
+			Cpu: config.UnLimitedResource,
+			Mem: config.UnLimitedResource,
 		},
 		Request: struct {
 			Mem string



Test patch:
diff --git a/test/e2e/vmauth_test.go b/test/e2e/vmauth_test.go
index c2660022..771904f4 100644
--- a/test/e2e/vmauth_test.go
+++ b/test/e2e/vmauth_test.go
@@ -12,6 +12,7 @@ import (
 	networkingv1 "k8s.io/api/networking/v1"
 	policyv1 "k8s.io/api/policy/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/intstr"
@@ -69,6 +70,15 @@ var _ = Describe("test vmauth Controller", func() {
 					},
 				}, func(cr *v1beta1vm.VMAuth) {
 					Expect(expectPodCount(k8sClient, 1, cr.Namespace, cr.SelectorLabels())).To(BeEmpty())
+					var dep appsv1.Deployment
+					Expect(k8sClient.Get(ctx, types.NamespacedName{Name: cr.PrefixedName(), Namespace: namespace}, &dep)).To(Succeed())
+					ps := dep.Spec.Template.Spec
+					reloaderContainer := ps.Containers[1]
+					Expect(reloaderContainer.Name).To(Equal("config-reloader"))
+					Expect(reloaderContainer.Resources.Limits.Cpu().CmpInt64(0)).To(Equal(0))
+					Expect(reloaderContainer.Resources.Limits.Memory().CmpInt64(0)).To(Equal(0))
+					Expect(reloaderContainer.Resources.Requests.Cpu()).To(Equal(ptr.To(resource.MustParse("10m"))))
+					Expect(reloaderContainer.Resources.Requests.Memory()).To(Equal(ptr.To(resource.MustParse("25Mi"))))
 				}),
 				Entry("with strict security and vm config-reloader", "strict-with-reloader", &v1beta1vm.VMAuth{
 					ObjectMeta: metav1.ObjectMeta{
@@ -107,7 +117,6 @@ var _ = Describe("test vmauth Controller", func() {
 					Expect(ps.Containers[0].SecurityContext.AllowPrivilegeEscalation).NotTo(BeNil())
 					Expect(ps.Containers[1].SecurityContext.AllowPrivilegeEscalation).NotTo(BeNil())
 					Expect(ps.InitContainers[0].SecurityContext.AllowPrivilegeEscalation).NotTo(BeNil())
-
 				}),
 			)