mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 10:37:21 +09:00
Ivan Okhotnikov
223c0ef4fb
cainjector loads all ValidatingWebhookConfigurations, APIServices and CRDs into its informer caches at startup. On a full cozystack install that working set exceeds the 128Mi limit, so the single leader-elected cainjector Pod is OOMKilled during cache population and CrashLoops before it injects any caBundle. Webhook ValidatingWebhookConfigurations then keep an empty caBundle and every admission call fails with "x509: certificate signed by unknown authority" (failurePolicy: Fail), intermittently blocking Ingress creation and stalling tenant installs. Raise the cainjector memory limit to 512Mi (matching the controller) and the request to 128Mi, and add a helm-unittest that pins the sizing so a blanket resource change or a `make update` cannot silently lower it again. Signed-off-by: Ivan Okhotnikov <xorokhotnikov@gmail.com>
17 lines
471 B
Makefile
17 lines
471 B
Makefile
export NAME=cert-manager
|
|
export NAMESPACE=cozy-$(NAME)
|
|
|
|
include ../../../hack/package.mk
|
|
|
|
test:
|
|
helm unittest .
|
|
|
|
update:
|
|
rm -rf charts
|
|
helm repo add jetstack https://charts.jetstack.io
|
|
helm repo update jetstack
|
|
helm pull jetstack/cert-manager --untar --untardir charts
|
|
rm -rf ../cert-manager-crds/templates/*
|
|
mv charts/cert-manager/templates/crd-*.yaml ../cert-manager-crds/templates/
|
|
cp charts/cert-manager/templates/_helpers.tpl ../cert-manager-crds/templates/
|