Add resources requests and limits for kube-rbac-proxy.

[camilamacedo86]

What do you want to happen?

Currently, the kube-rbac-proxy container does not have any resources amount set.
We ought to add at least the resource request for CPU and Memory for its container. The change to add the amount of the resource would be done in this [bollerplate]Ohttps://github.com/kubernetes-sigs/kubebuilder/blob/master/pkg/plugins/common/kustomize/v1/scaffolds/internal/templates/config/kdefault/manager_auth_proxy_patch.go#L56). However, we also need to check what values we could define by default here.

Why?

• If a LimitRange is activated in a namespace for computing resources like CPU and memory, users must specify requests or limits for those values. Otherwise, the system may reject Pod creation.
• If a resourQuota be configured and the pods do not have at least requests or limits for those values the system may reject Pod creation.

And then, the above configuration is commonly adopted and recommended in multi-tenancy and or production clusters. Also, setting values to the container would protect something that goes wrong with them which would make consume all available resources and/or affect other containers running on the cluster.

More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

Extra Labels

No response

[camilamacedo86]

Hi @fgiloux,

We would need to discover the ideal init values for the auth proxy side container. Is that related to what are you looking for currently? WDYT? Would you be able to give us a hand to us do this one?

[fgiloux]

Hi @camilamacedo86

Besides the quota aspect. Resource requests play a role in scheduling and QoS allocation. From what I have seen kube-rbac-proxy consumes generally very few CPU cycles: On a not so busy decent size cluster over 12h looking at 27 kube-rbac-proxy containers most of them were using between 1m and 2m in average and the busiest one picked up at 7m.
I believe to remember that 5m is the lowest limit for accounting. On this basis I would recommend to have 5m for CPU request and the same value that we have for the controller manager as limit: 500m.
In regards to memory the same 27 containers were using between 30 MiB and 150 MiB of resident memory. Most of them were below 100MiB not surprisingly kube-rbac-proxy for Prometheus and Ingress operators were the top consumers. I think that it would be reasonable to have the same defaults as we have for the controller manager: 64MiB request and 128MiB limit.

Does it sound OK to you?

[camilamacedo86]

So, that mean adding:

        resources:
          limits:
            cpu: 500m
            memory: 128Mi
          requests:
            cpu: 5m
            memory: 64Mi

[fgiloux]

Yes that's my proposal. I can create a PR if you agree with it.

[camilamacedo86]

Sure, that would be great 👍