fix: add resource limits

.cspell.json

@@ -6,6 +6,9 @@
   "ignorePaths": ["/CHANGELOG.md", "*.json"],
   "ignoreRegExpList": ["/'s\\b/"],
   "ignoreWords": [
+    "adrs",
+    "adrlog",
+    "adrlogstop",
     "anyuid",
     "appgw",
     "auths",
@@ -31,11 +34,13 @@
     "kubeapps",
     "kubes",
     "kubeval",
+    "madr",
     "millis",
     "mkilled",
     "nindent",
     "nothrow",
     "nslookup",
+    "nygard",
     "rAGRS",
     "jwks",
     "pids",

charts/host-mods/templates/daemonset.yaml

@@ -46,6 +46,10 @@ spec:
               value: "{{ .Values.certDir }}"
             - name: UPDATE_CMD
               value: "{{ .Values.updateCmd }}"
+          resources:
+            limits:
+              cpu: 100m
+              memory: 256Mi
           securityContext:
             runAsUser: 0
             privileged: true
@@ -54,3 +58,7 @@ spec:
           image: k8s.gcr.io/pause:3.1
           securityContext:
             runAsUser: 1000
+          resources:
+            limits:
+              cpu: 50m
+              memory: 64Mi

charts/tigera-operator/templates/tigera-operator/02-tigera-operator.yaml

@@ -62,6 +62,10 @@ spec:
             - configMapRef:
                 name: kubernetes-services-endpoint
                 optional: true
+          resources:
+            limits:
+              cpu: 250m
+              memory: 512Mi
       volumes:
         - name: var-lib-calico
           hostPath:

tests/fixtures/env/policies.yaml

@@ -5,7 +5,7 @@ policies:
             - latest
     container-limits:
         cpu: '2'
-        enabled: false
+        enabled: true
         memory: 2Gi
     psp-allowed-repos:
         enabled: false

values/gatekeeper/gatekeeper.gotmpl

@@ -49,3 +49,11 @@ controllerManager:
     {{- end }}
 
 otomiVersions: {{- toYaml .Values.versions | nindent 2 }}
+crds:
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 50m
+      memory: 64Mi