Add resource limits for upgrade and delete hook batch jobs (#366)

* Add resource limits for upgrade and delete hook batch jobs

Signed-off-by: aniket patel <[email protected]>

* Fix value of resource

Signed-off-by: aniket patel <[email protected]>

* Fix resource limit in server template

Signed-off-by: aniket patel <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix up doc comment

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: aniket patel <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: aniket patel <[email protected]>

charts/spire/README.md

@@ -258,7 +258,9 @@ Now you can interact with the Spire agent socket from your own application. The
 | `global.spire.ingressControllerType`             | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""`              |
 | `global.spire.tools.kubectl.tag`                 | Set to force the tag to use for all kubectl instances                                                                                                                                                                                  | `""`              |
 | `global.installAndUpgradeHooks.enabled`          | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)                                                                                                                             | `true`            |
+| `global.installAndUpgradeHooks.resources`        | Resource requests and limits for installAndUpgradeHooks                                                                                                                                                                                | `{}`              |
 | `global.deleteHooks.enabled`                     | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)                                                                                                                                      | `true`            |
+| `global.deleteHooks.resources`                   | Resource requests and limits for deleteHooks                                                                                                                                                                                           | `{}`              |
 
 ### Spire server parameters
 

charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml

@@ -72,4 +72,8 @@ spec:
           - deployment
           - {{ include "spiffe-oidc-discovery-provider.fullname" . }}
           - --wait
+        {{- with (((.Values).global).deleteHooks).resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
 {{- end }}

charts/spire/charts/spire-server/templates/post-install-hook.yaml

@@ -85,6 +85,10 @@ spec:
                 }
               ]
             }
+        {{- with (((.Values).global).installAndUpgradeHooks).resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
 {{- end }}
 {{- end }}
 {{- end }}

charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml

@@ -85,6 +85,10 @@ spec:
                 }
               ]
             }
+        {{- with (((.Values).global).installAndUpgradeHooks).resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
 {{- end }}
 {{- end }}
 {{- end }}

charts/spire/charts/spire-server/templates/pre-delete-hook.yaml

@@ -77,6 +77,10 @@ spec:
           - {{ include "spire-server.kind" . }}
           - {{ include "spire-server.fullname" . }}
           - --wait
+        {{- with (((.Values).global).deleteHooks).resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
       - name: pre-delete-check
         securityContext:
           {{- include "spire-lib.securitycontext" . | nindent 10 }}
@@ -89,6 +93,10 @@ spec:
           - app.kubernetes.io/instance={{ include "spire-server.name" . }},app.kubernetes.io/name={{ .Release.Name }},app.kubernetes.io/component=server
           - -n
           - {{ include "spire-server.namespace" . }}
+        {{- with (((.Values).global).deleteHooks).resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
 {{- end }}
 {{- end }}
 {{- end }}

charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml

@@ -85,6 +85,10 @@ spec:
                 }
               ]
             }
+        {{- with (((.Values).global).installAndUpgradeHooks).resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
 {{- end }}
 {{- end }}
 {{- end }}

charts/spire/values.yaml

@@ -89,9 +89,33 @@ global:
   installAndUpgradeHooks:
     ## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
     enabled: true
+    ## @param global.installAndUpgradeHooks.resources [object] Resource requests and limits for installAndUpgradeHooks
+    resources: {}
+      # We usually recommend not to specify default resources and to leave this as a conscious
+      # choice for the user. This also increases chances charts run on environments with little
+      # resources, such as Minikube. If you do want to specify resources, copy the following
+      # to your values file and edit as needed.
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+      # requests:
+      #   cpu: 100m
+      #   memory: 128Mi
   deleteHooks:
     ## @param global.deleteHooks.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
     enabled: true
+    ## @param global.deleteHooks.resources [object] Resource requests and limits for deleteHooks
+    resources: {}
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, copy the following
+    # to your values file and edit as needed.
+    # limits:
+    #   cpu: 100m
+    #   memory: 128Mi
+    # requests:
+    #   cpu: 100m
+    #   memory: 128Mi
 
 #  telemetry:
 #    prometheus: