chore: set resource request and limit

cert-manager/cert-manager-values.yaml

@@ -0,0 +1,31 @@
+# cert-manager resource configuration
+# Based on Goldilocks recommendations (Burstable QoS)
+
+# cert-manager controller
+resources:
+  requests:
+    cpu: 15m
+    memory: 128Mi
+  limits:
+    cpu: 50m
+    memory: 192Mi
+
+# CA injector
+cainjector:
+  resources:
+    requests:
+      cpu: 15m
+      memory: 192Mi
+    limits:
+      cpu: 50m
+      memory: 256Mi
+
+# Webhook
+webhook:
+  resources:
+    requests:
+      cpu: 15m
+      memory: 128Mi
+    limits:
+      cpu: 50m
+      memory: 128Mi

cert-manager/justfile

@@ -26,7 +26,8 @@ install:
     echo "Installing cert-manager from OCI registry..."
     helm upgrade --cleanup-on-fail --install cert-manager \
         oci://quay.io/jetstack/charts/cert-manager --version ${CERT_MANAGER_CHART_VERSION} \
-        -n ${CERT_MANAGER_NAMESPACE} --set crds.enabled=true --wait --timeout=5m
+        -n ${CERT_MANAGER_NAMESPACE} --set crds.enabled=true --wait --timeout=5m \
+        -f cert-manager-values.yaml
 
     echo "Waiting for cert-manager webhook to be ready..."
     kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=webhook \
@@ -51,7 +52,8 @@ upgrade:
     echo "Upgrading cert-manager from OCI registry..."
     helm upgrade cert-manager oci://quay.io/jetstack/charts/cert-manager \
         --version ${CERT_MANAGER_CHART_VERSION} -n ${CERT_MANAGER_NAMESPACE} \
-        --set crds.enabled=true --wait --timeout=5m
+        --set crds.enabled=true --wait --timeout=5m \
+        -f cert-manager-values.yaml
 
     echo "cert-manager upgraded successfully"