Repository: kubernetes-sigs/security-profiles-operator
Pull request #550 (2021-07-22 11:04:57)

Add resource requests/limits to manager and webhook
#### What type of PR is this?

/kind cleanup

#### What this PR does / why we need it:
Beside setting some sane defaults (tested locally), we now also remove
the CPU limits from the spod to avoid having negative side effects with
CPU throttling.

#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Removed CPU limits from SPOD and added resource requests/limits to manager and webhook.
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/550#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/550?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#550](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/550?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (28bf737) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/8db24324206bfb28b14d4204087dc74c155dc9f3?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (8db2432) will **not change** coverage.
> The diff coverage is `n/a`.


```diff
@@           Coverage Diff           @@
##           master     #550   +/-   ##
=======================================
  Coverage   44.02%   44.02%           
=======================================
  Files          26       26           
  Lines        1338     1338           
=======================================
  Hits          589      589           
  Misses        709      709           
  Partials       40       40           
```


Patch:
diff --git a/Makefile b/Makefile
index 2de251947..1ce671610 100644
--- a/Makefile
+++ b/Makefile
@@ -104,7 +104,7 @@ $(BUILD_DIR):
 	mkdir -p $(BUILD_DIR)
 
 $(BUILD_DIR)/$(PROJECT): $(BUILD_DIR) $(BUILD_FILES)
-	$(GO) build -ldflags '$(LDFLAGS)' -tags '$(BUILDTAGS)' -o $@ ./cmd/security-profiles-operator
+	$(GO) build -trimpath -ldflags '$(LDFLAGS)' -tags '$(BUILDTAGS)' -o $@ ./cmd/security-profiles-operator
 
 .PHONY: clean
 clean: ## Clean the build directory
diff --git a/dependencies.yaml b/dependencies.yaml
index 79ed4cd59..4140b5be7 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -30,7 +30,7 @@ dependencies:
       match: KUSTOMIZE_VERSION
 
   - name: cert-manager
-    version: 1.4.0
+    version: 1.4.1
     refPaths:
     - path: test/e2e_test.go
       match: jetstack/cert-manager
diff --git a/deploy/base/manager_deployment.yaml b/deploy/base/manager_deployment.yaml
index 0afb2d696..970eab726 100644
--- a/deploy/base/manager_deployment.yaml
+++ b/deploy/base/manager_deployment.yaml
@@ -26,6 +26,12 @@ spec:
           securityContext:
             readOnlyRootFilesystem: true
             allowPrivilegeEscalation: false
+          resources:
+            requests:
+              memory: 32Mi
+              cpu: 250m
+            limits:
+              memory: 64Mi
           env:
             - name: RELATED_IMAGE_SELINUXD
               value: quay.io/jaosorior/selinuxd
diff --git a/deploy/base/webhook_deployment.yaml b/deploy/base/webhook_deployment.yaml
index 8f25a60af..1b180543e 100644
--- a/deploy/base/webhook_deployment.yaml
+++ b/deploy/base/webhook_deployment.yaml
@@ -27,6 +27,12 @@ spec:
           securityContext:
             readOnlyRootFilesystem: true
             allowPrivilegeEscalation: false
+          resources:
+            requests:
+              memory: 32Mi
+              cpu: 250m
+            limits:
+              memory: 64Mi
           volumeMounts:
           - name: cert
             mountPath: /tmp/k8s-webhook-server/serving-certs
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index b6ad93a2f..3a8ed2574 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -1386,6 +1386,12 @@ spec:
         image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
+        resources:
+          limits:
+            memory: 64Mi
+          requests:
+            cpu: 250m
+            memory: 32Mi
         securityContext:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
@@ -1438,6 +1444,12 @@ spec:
         - containerPort: 9443
           name: webhook
           protocol: TCP
+        resources:
+          limits:
+            memory: 64Mi
+          requests:
+            cpu: 250m
+            memory: 32Mi
         securityContext:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 0ec08e7ec..4b5729ee5 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -1384,6 +1384,12 @@ spec:
         image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
+        resources:
+          limits:
+            memory: 64Mi
+          requests:
+            cpu: 250m
+            memory: 32Mi
         securityContext:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
@@ -1436,6 +1442,12 @@ spec:
         - containerPort: 9443
           name: webhook
           protocol: TCP
+        resources:
+          limits:
+            memory: 64Mi
+          requests:
+            cpu: 250m
+            memory: 32Mi
         securityContext:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
diff --git a/installation-usage.md b/installation-usage.md
index 351f27d9b..80f36b02a 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -46,7 +46,7 @@ architectures `amd64` and `arm64` for now. To deploy the operator, first install
 cert-manager via `kubectl`:
 
 ```sh
-$ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.4.0/cert-manager.yaml
+$ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.4.1/cert-manager.yaml
 $ kubectl --namespace cert-manager wait --for condition=ready pod -l app.kubernetes.io/instance=cert-manager
 ```
 
diff --git a/internal/pkg/manager/spod/bindata/spod.go b/internal/pkg/manager/spod/bindata/spod.go
index 0d2e5d22a..1acd8e45c 100644
--- a/internal/pkg/manager/spod/bindata/spod.go
+++ b/internal/pkg/manager/spod/bindata/spod.go
@@ -116,7 +116,6 @@ var Manifest = &appsv1.DaemonSet{
 							},
 							Limits: v1.ResourceList{
 								v1.ResourceMemory:           resource.MustParse("64Mi"),
-								v1.ResourceCPU:              resource.MustParse("250m"),
 								v1.ResourceEphemeralStorage: resource.MustParse("50Mi"),
 							},
 						},
@@ -192,7 +191,6 @@ semodule -i /opt/spo-profiles/selinuxd.cil
 							Limits: v1.ResourceList{
 								// libsemanage is very resource hungry...
 								v1.ResourceMemory:           resource.MustParse("1024Mi"),
-								v1.ResourceCPU:              resource.MustParse("250m"),
 								v1.ResourceEphemeralStorage: resource.MustParse("50Mi"),
 							},
 						},
@@ -242,7 +240,6 @@ semodule -i /opt/spo-profiles/selinuxd.cil
 							},
 							Limits: v1.ResourceList{
 								v1.ResourceMemory:           resource.MustParse("128Mi"),
-								v1.ResourceCPU:              resource.MustParse("300m"),
 								v1.ResourceEphemeralStorage: resource.MustParse("200Mi"),
 							},
 						},
@@ -347,7 +344,6 @@ semodule -i /opt/spo-profiles/selinuxd.cil
 							},
 							Limits: v1.ResourceList{
 								v1.ResourceMemory:           resource.MustParse("1024Mi"),
-								v1.ResourceCPU:              resource.MustParse("1000m"),
 								v1.ResourceEphemeralStorage: resource.MustParse("400Mi"),
 							},
 						},
@@ -386,7 +382,6 @@ semodule -i /opt/spo-profiles/selinuxd.cil
 							},
 							Limits: v1.ResourceList{
 								v1.ResourceMemory:           resource.MustParse("128Mi"),
-								v1.ResourceCPU:              resource.MustParse("150m"),
 								v1.ResourceEphemeralStorage: resource.MustParse("20Mi"),
 							},
 						},
@@ -420,7 +415,6 @@ semodule -i /opt/spo-profiles/selinuxd.cil
 							},
 							Limits: v1.ResourceList{
 								v1.ResourceMemory:           resource.MustParse("128Mi"),
-								v1.ResourceCPU:              resource.MustParse("150m"),
 								v1.ResourceEphemeralStorage: resource.MustParse("20Mi"),
 							},
 						},


Test patch:
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 269475cd3..145880596 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -32,7 +32,7 @@ import (
 )
 
 const (
-	certmanager       = "https://github.com/jetstack/cert-manager/releases/download/v1.4.0/cert-manager.yaml"
+	certmanager       = "https://github.com/jetstack/cert-manager/releases/download/v1.4.1/cert-manager.yaml"
 	manifest          = "deploy/operator.yaml"
 	namespaceManifest = "deploy/namespace-operator.yaml"
 	testNamespace     = "test-ns"