Ivan Okhotnikov 223c0ef4fb fix(cert-manager): raise cainjector memory limit to unblock caBundle injection ...

cainjector loads all ValidatingWebhookConfigurations, APIServices and CRDs
into its informer caches at startup. On a full cozystack install that working
set exceeds the 128Mi limit, so the single leader-elected cainjector Pod is
OOMKilled during cache population and CrashLoops before it injects any
caBundle. Webhook ValidatingWebhookConfigurations then keep an empty caBundle
and every admission call fails with "x509: certificate signed by unknown
authority" (failurePolicy: Fail), intermittently blocking Ingress creation
and stalling tenant installs.

Raise the cainjector memory limit to 512Mi (matching the controller) and the
request to 128Mi, and add a helm-unittest that pins the sizing so a blanket
resource change or a `make update` cannot silently lower it again.

Signed-off-by: Ivan Okhotnikov <xorokhotnikov@gmail.com>

2026-07-04 15:57:49 +03:00

..

apps

[kubernetes] Add CPU/memory limits to csi-resizer sidecar

2026-07-03 19:04:30 +03:00

core

fix(platform): migration 49 backfills tenant ancestor labels

2026-07-03 09:54:12 +03:00

extra

[bootbox] Add resources requests/limits to matchbox container

2026-07-03 19:14:12 +03:00

library

fix(cozy-lib,harbor,mariadb): digest-pin cleanup-hook kubectl image and route it through cozy-lib.images-registry

2026-07-02 17:44:59 +03:00

system

fix(cert-manager): raise cainjector memory limit to unblock caBundle injection

2026-07-04 15:57:49 +03:00

tests/cozy-lib-tests

feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants

2026-06-23 03:12:17 +03:00