Allow init and lifecycle containers resource limits to be configured

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## UNRELEASED
 
+IMPROVEMENTS:
+
+* Connect: Add resource request and limit flags for the injected init and lifecycle sidecar containers [[GH-298](https://github.com/hashicorp/consul-k8s/pull/298)].
+
 BUG FIXES:
 
 * Connect: Respect allow/deny list flags when namespaces are disabled. [[GH-296](https://github.com/hashicorp/consul-k8s/issues/296)]

connect-inject/container_init.go

@@ -8,17 +8,6 @@ import (
 	"text/template"
 
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/resource"
-)
-
-// The init container is bound in memory usage by the size of the consul binary
-// as it issues a cpu of the binary to a shared volume. The limit is set to be
-// slightly larger than the binary to ensure we don't get OOM killed during the cp.
-const (
-	initContainerCPULimit      = "50m"
-	initContainerCPURequest    = "50m"
-	initContainerMemoryLimit   = "150Mi"
-	initContainerMemoryRequest = "25Mi"
 )
 
 type initContainerCommandData struct {
@@ -203,17 +192,6 @@ func (h *Handler) containerInit(pod *corev1.Pod, k8sNamespace string) (corev1.Co
 		return corev1.Container{}, err
 	}
 
-	resources := corev1.ResourceRequirements{
-		Limits: corev1.ResourceList{
-			corev1.ResourceCPU:    resource.MustParse(initContainerCPULimit),
-			corev1.ResourceMemory: resource.MustParse(initContainerMemoryLimit),
-		},
-		Requests: corev1.ResourceList{
-			corev1.ResourceCPU:    resource.MustParse(initContainerCPURequest),
-			corev1.ResourceMemory: resource.MustParse(initContainerMemoryRequest),
-		},
-	}
-
 	return corev1.Container{
 		Name:  "consul-connect-inject-init",
 		Image: h.ImageConsul,
@@ -251,7 +229,7 @@ func (h *Handler) containerInit(pod *corev1.Pod, k8sNamespace string) (corev1.Co
 				Value: fmt.Sprintf("$(POD_NAME)-%s", data.ProxyServiceName),
 			},
 		},
-		Resources:    resources,
+		Resources:    h.InitContainerResources,
 		VolumeMounts: volMounts,
 		Command:      []string{"/bin/sh", "-ec", buf.String()},
 	}, nil

connect-inject/container_init_test.go

@@ -1488,7 +1488,18 @@ export CONSUL_GRPC_ADDR="${HOST_IP}:8502"`)
 
 func TestHandlerContainerInit_Resources(t *testing.T) {
 	require := require.New(t)
-	h := Handler{}
+	h := Handler{
+		InitContainerResources: corev1.ResourceRequirements{
+			Requests: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("10m"),
+				corev1.ResourceMemory: resource.MustParse("10Mi"),
+			},
+			Limits: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("20m"),
+				corev1.ResourceMemory: resource.MustParse("25Mi"),
+			},
+		},
+	}
 	pod := &corev1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
 			Annotations: map[string]string{
@@ -1508,12 +1519,12 @@ func TestHandlerContainerInit_Resources(t *testing.T) {
 	require.NoError(err)
 	require.Equal(corev1.ResourceRequirements{
 		Limits: corev1.ResourceList{
-			corev1.ResourceCPU:    resource.MustParse(initContainerCPULimit),
-			corev1.ResourceMemory: resource.MustParse(initContainerMemoryLimit),
+			corev1.ResourceCPU:    resource.MustParse("20m"),
+			corev1.ResourceMemory: resource.MustParse("25Mi"),
 		},
 		Requests: corev1.ResourceList{
-			corev1.ResourceCPU:    resource.MustParse(initContainerCPURequest),
-			corev1.ResourceMemory: resource.MustParse(initContainerMemoryRequest),
+			corev1.ResourceCPU:    resource.MustParse("10m"),
+			corev1.ResourceMemory: resource.MustParse("10Mi"),
 		},
 	}, container.Resources)
 }

connect-inject/handler.go

@@ -78,6 +78,7 @@ const (
 	// service is synced (i.e. re-registered) with the local agent.
 	annotationSyncPeriod = "consul.hashicorp.com/connect-sync-period"
 
+	// annotations for sidecar proxy resource limits
 	annotationSidecarProxyCPULimit      = "consul.hashicorp.com/sidecar-proxy-cpu-limit"
 	annotationSidecarProxyCPURequest    = "consul.hashicorp.com/sidecar-proxy-cpu-request"
 	annotationSidecarProxyMemoryLimit   = "consul.hashicorp.com/sidecar-proxy-memory-limit"
@@ -169,12 +170,21 @@ type Handler struct {
 	// Only necessary if ACLs are enabled.
 	CrossNamespaceACLPolicy string
 
-	// Default resource settings for sidecar proxies.
+	// Default resource settings for sidecar proxies. Some of these
+	// fields may be empty.
 	DefaultProxyCPURequest    resource.Quantity
 	DefaultProxyCPULimit      resource.Quantity
 	DefaultProxyMemoryRequest resource.Quantity
 	DefaultProxyMemoryLimit   resource.Quantity
 
+	// Resource settings for init container. All of these fields
+	// will be populated by the defaults provided in the initial flags.
+	InitContainerResources corev1.ResourceRequirements
+
+	// Resource settings for lifecycle sidecar. All of these fields
+	// will be populated by the defaults provided in the initial flags.
+	LifecycleSidecarResources corev1.ResourceRequirements
+
 	// Log
 	Log hclog.Logger
 }

connect-inject/lifecycle_sidecar.go

@@ -1,17 +1,9 @@
 package connectinject
 
 import (
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/resource"
-
 	"strings"
-)
 
-const (
-	lifecycleContainerCPULimit      = "20m"
-	lifecycleContainerCPURequest    = "20m"
-	lifecycleContainerMemoryLimit   = "25Mi"
-	lifecycleContainerMemoryRequest = "25Mi"
+	corev1 "k8s.io/api/core/v1"
 )
 
 func (h *Handler) lifecycleSidecar(pod *corev1.Pod) corev1.Container {
@@ -61,17 +53,6 @@ func (h *Handler) lifecycleSidecar(pod *corev1.Pod) corev1.Container {
 			})
 	}
 
-	resources := corev1.ResourceRequirements{
-		Limits: corev1.ResourceList{
-			corev1.ResourceCPU:    resource.MustParse(lifecycleContainerCPULimit),
-			corev1.ResourceMemory: resource.MustParse(lifecycleContainerMemoryLimit),
-		},
-		Requests: corev1.ResourceList{
-			corev1.ResourceCPU:    resource.MustParse(lifecycleContainerCPURequest),
-			corev1.ResourceMemory: resource.MustParse(lifecycleContainerMemoryRequest),
-		},
-	}
-
 	return corev1.Container{
 		Name:  "consul-connect-lifecycle-sidecar",
 		Image: h.ImageConsulK8S,
@@ -83,6 +64,6 @@ func (h *Handler) lifecycleSidecar(pod *corev1.Pod) corev1.Container {
 			},
 		},
 		Command:   command,
-		Resources: resources,
+		Resources: h.LifecycleSidecarResources,
 	}
 }

connect-inject/lifecycle_sidecar_test.go

@@ -1,12 +1,26 @@
 package connectinject
 
 import (
+	"testing"
+
 	"github.com/hashicorp/go-hclog"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"testing"
+)
+
+var (
+	lifecycleResources = corev1.ResourceRequirements{
+		Requests: corev1.ResourceList{
+			corev1.ResourceCPU:    resource.MustParse("10m"),
+			corev1.ResourceMemory: resource.MustParse("25Mi"),
+		},
+		Limits: corev1.ResourceList{
+			corev1.ResourceCPU:    resource.MustParse("20m"),
+			corev1.ResourceMemory: resource.MustParse("50Mi"),
+		},
+	}
 )
 
 // NOTE: This is tested here rather than in handler_test because doing it there
@@ -16,8 +30,9 @@ import (
 // Test that the lifecycle sidecar is as expected.
 func TestLifecycleSidecar_Default(t *testing.T) {
 	handler := Handler{
-		Log:            hclog.Default().Named("handler"),
-		ImageConsulK8S: "hashicorp/consul-k8s:9.9.9",
+		Log:                       hclog.Default().Named("handler"),
+		ImageConsulK8S:            "hashicorp/consul-k8s:9.9.9",
+		LifecycleSidecarResources: lifecycleResources,
 	}
 	container := handler.lifecycleSidecar(&corev1.Pod{
 		Spec: corev1.PodSpec{
@@ -54,16 +69,7 @@ func TestLifecycleSidecar_Default(t *testing.T) {
 			"-service-config", "/consul/connect-inject/service.hcl",
 			"-consul-binary", "/consul/connect-inject/consul",
 		},
-		Resources: corev1.ResourceRequirements{
-			Limits: corev1.ResourceList{
-				corev1.ResourceCPU:    resource.MustParse(lifecycleContainerCPULimit),
-				corev1.ResourceMemory: resource.MustParse(lifecycleContainerMemoryLimit),
-			},
-			Requests: corev1.ResourceList{
-				corev1.ResourceCPU:    resource.MustParse(lifecycleContainerCPURequest),
-				corev1.ResourceMemory: resource.MustParse(lifecycleContainerMemoryRequest),
-			},
-		},
+		Resources: lifecycleResources,
 	}, container)
 }
 
@@ -128,9 +134,10 @@ func TestLifecycleSidecar_SyncPeriodAnnotation(t *testing.T) {
 // and that the CA is provided
 func TestLifecycleSidecar_TLS(t *testing.T) {
 	handler := Handler{
-		Log:            hclog.Default().Named("handler"),
-		ImageConsulK8S: "hashicorp/consul-k8s:9.9.9",
-		ConsulCACert:   "consul-ca-cert",
+		Log:                       hclog.Default().Named("handler"),
+		ImageConsulK8S:            "hashicorp/consul-k8s:9.9.9",
+		ConsulCACert:              "consul-ca-cert",
+		LifecycleSidecarResources: lifecycleResources,
 	}
 	container := handler.lifecycleSidecar(&corev1.Pod{
 		Spec: corev1.PodSpec{
@@ -171,15 +178,6 @@ func TestLifecycleSidecar_TLS(t *testing.T) {
 			"-service-config", "/consul/connect-inject/service.hcl",
 			"-consul-binary", "/consul/connect-inject/consul",
 		},
-		Resources: corev1.ResourceRequirements{
-			Limits: corev1.ResourceList{
-				corev1.ResourceCPU:    resource.MustParse(lifecycleContainerCPULimit),
-				corev1.ResourceMemory: resource.MustParse(lifecycleContainerMemoryLimit),
-			},
-			Requests: corev1.ResourceList{
-				corev1.ResourceCPU:    resource.MustParse(lifecycleContainerCPURequest),
-				corev1.ResourceMemory: resource.MustParse(lifecycleContainerMemoryRequest),
-			},
-		},
+		Resources: lifecycleResources,
 	}, container)
 }