fix(operator): ignore non-pod LimitRange scopes

Kubernetes accepts memory keys on PVC-scoped LimitRange items when a
storage bound is also present, but those quantities cannot affect pod
admission. Restrict the foreign-policy guard to Container and Pod items.

Assisted-By: LLM
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

internal/operator/package_reconciler.go

@@ -1116,12 +1116,15 @@ func (r *PackageReconciler) foreignContainerMemoryPolicy(ctx context.Context, ns
 
 // constrainsMemory reports whether a LimitRange item expresses any policy about memory.
 //
-// Every field is read, at every scope. The list below is the complete set of quantity maps a
-// LimitRangeItem carries today, which also means a field added upstream has to be added here
-// or it becomes a hole. That is exactly why this is its own function with its own table test
-// rather than a few conditions inline: the test enumerates the fields, so a new one shows up
-// as a gap in a list somebody is already reading.
+// Only Container and Pod items can constrain pod admission. Kubernetes accepts other scopes,
+// including a PersistentVolumeClaim item that mentions memory alongside its required storage
+// bound, but those quantities are not applied to pods. Within the pod-affecting scopes, every
+// field is read: the list below is the complete set of quantity maps a LimitRangeItem carries.
 func constrainsMemory(item corev1.LimitRangeItem) bool {
+	if item.Type != corev1.LimitTypeContainer && item.Type != corev1.LimitTypePod {
+		return false
+	}
+
 	for _, quantities := range []corev1.ResourceList{
 		item.Default, item.DefaultRequest, item.Max, item.Min, item.MaxLimitRequestRatio,
 	} {

internal/operator/package_reconciler_test.go

@@ -1337,6 +1337,8 @@ func TestReconcileSystemDefaultsLimitRangeWithdrawsWhenAForeignPolicyAppears(t *
 // or the guard becomes a blanket opt-out any unrelated policy can trip.
 func TestReconcileSystemDefaultsLimitRangeIgnoresLimitRangesThatDoNotTouchMemory(t *testing.T) {
 	scheme := limitRangeScheme(t)
+	pvcPolicy := foreignLimitRange("pvc-policy", corev1.LimitTypePersistentVolumeClaim, "max", "memory", "2Gi")
+	pvcPolicy.Spec.Limits[0].Max[corev1.ResourceStorage] = resource.MustParse("1Ti")
 
 	for _, tc := range []struct {
 		name    string
@@ -1345,6 +1347,7 @@ func TestReconcileSystemDefaultsLimitRangeIgnoresLimitRangesThatDoNotTouchMemory
 		{"container cpu default", foreignLimitRange("cpu-policy", corev1.LimitTypeContainer, "default", "cpu", "500m")},
 		{"container cpu max", foreignLimitRange("cpu-ceiling", corev1.LimitTypeContainer, "max", "cpu", "2")},
 		{"pod cpu max", foreignLimitRange("pod-cpu", corev1.LimitTypePod, "max", "cpu", "4")},
+		{"persistent volume claim memory max", pvcPolicy},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			cl := fake.NewClientBuilder().WithScheme(scheme).WithObjects(tc.foreign).Build()