Skip to content

Commit 99e55c3

Browse files
snarayan-redhatsnarayan-redhat
authored
Merge pull request #64779 from xenolinux/configure-cpu-mem-cert-manager
OCPBUGS#19055: cert-manager: Configure CPU and Memory
2 parents 0028eea + 8f8bb51 commit 99e55c3

File tree

2 files changed

+198
-0
lines changed

2 files changed

+198
-0
lines changed

‎modules/cert-manager-configure-cpu-memory.adoc

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-customizing-api-fields.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="cert-manager-configure-cpu-memory_{context}"]
7+
= Overriding CPU and memory limits for the cert-manager components
8+
9+
After installing the {cert-manager-operator}, you can configure the CPU and memory limits from the {cert-manager-operator} API for the cert-manager components such as cert-manager controller, CA injector, and Webhook.
10+
11+
.Prerequisites
12+
13+
* You have access to the {product-title} cluster as a user with the `cluster-admin` role.
14+
* You have installed the {cert-manager-operator} 1.12.0 or later.
15+
16+
.Procedure
17+
18+
. Check that the deployments of the cert-manager controller, CA injector, and Webhook are available by entering the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc get deployment -n cert-manager
23+
----
24+
+
25+
.Example output
26+
[source,terminal]
27+
----
28+
NAME READY UP-TO-DATE AVAILABLE AGE
29+
cert-manager 1/1 1 1 53m
30+
cert-manager-cainjector 1/1 1 1 53m
31+
cert-manager-webhook 1/1 1 1 53m
32+
----
33+
34+
. Before setting the CPU and memory limit, check the existing configuration for the cert-manager controller, CA injector, and Webhook by entering the following command:
35+
+
36+
[source,terminal]
37+
----
38+
$ oc get deployment -n cert-manager -o yaml
39+
----
40+
+
41+
.Example output
42+
[source,terminal]
43+
----
44+
# ...
45+
metadata:
46+
name: cert-manager
47+
namespace: cert-manager
48+
# ...
49+
spec:
50+
template:
51+
spec:
52+
containers:
53+
- name: cert-manager-controller
54+
resources: {} <1>
55+
# ...
56+
metadata:
57+
name: cert-manager-cainjector
58+
namespace: cert-manager
59+
# ...
60+
spec:
61+
template:
62+
spec:
63+
containers:
64+
- name: cert-manager-cainjector
65+
resources: {} <1>
66+
# ...
67+
metadata:
68+
name: cert-manager-webhook
69+
namespace: cert-manager
70+
# ...
71+
spec:
72+
template:
73+
spec:
74+
containers:
75+
- name: cert-manager-webhook
76+
resources: {} <1>
77+
# ...
78+
----
79+
<1> The `spec.resources` field is empty by default. The cert-manager components do not have CPU and memory limits.
80+
81+
. To configure the CPU and memory limits for the cert-manager controller, CA injector, and Webhook, enter the following command:
82+
+
83+
[source,terminal]
84+
----
85+
$ oc patch certmanager.operator cluster --type=merge -p="
86+
spec:
87+
controllerConfig:
88+
overrideResources:
89+
limits: <1>
90+
cpu: 200m <2>
91+
memory: 64Mi <3>
92+
requests: <4>
93+
cpu: 200m <2>
94+
memory: 64Mi <3>
95+
webhookConfig:
96+
overrideResources:
97+
limits: <5>
98+
cpu: 200m <6>
99+
memory: 64Mi <7>
100+
requests: <8>
101+
cpu: 200m <6>
102+
memory: 64Mi <7>
103+
cainjectorConfig:
104+
overrideResources:
105+
limits: <9>
106+
cpu: 200m <10>
107+
memory: 64Mi <11>
108+
requests: <12>
109+
cpu: 200m <10>
110+
memory: 64Mi <11>
111+
"
112+
----
113+
<1> Defines the maximum amount of CPU and memory that a single container in a cert-manager controller pod can request.
114+
<2> You can specify the CPU limit that a cert-manager controller pod can request. The default value is `10m`.
115+
<3> You can specify the memory limit that a cert-manager controller pod can request. The default value is `32Mi`.
116+
<4> Defines the amount of CPU and memory set by scheduler for the cert-manager controller pod.
117+
<5> Defines the maximum amount of CPU and memory that a single container in a CA injector pod can request.
118+
<6> You can specify the CPU limit that a CA injector pod can request. The default value is `10m`.
119+
<7> You can specify the memory limit that a CA injector pod can request. The default value is `32Mi`.
120+
<8> Defines the amount of CPU and memory set by scheduler for the CA injector pod.
121+
<9> Defines the maximum amount of CPU and memory Defines the maximum amount of CPU and memory that a single container in a Webhook pod can request.
122+
<10> You can specify the CPU limit that a Webhook pod can request. The default value is `10m`.
123+
<11> You can specify the memory limit that a Webhook pod can request. The default value is `32Mi`.
124+
<12> Defines the amount of CPU and memory set by scheduler for the Webhook pod.
125+
+
126+
.Example output
127+
[source,termnal]
128+
----
129+
certmanager.operator.openshift.io/cluster patched
130+
----
131+
132+
.Verification
133+
134+
. Verify that the CPU and memory limits are updated for the cert-manager components:
135+
+
136+
[source,terminal]
137+
----
138+
$ oc get deployment -n cert-manager -o yaml
139+
----
140+
+
141+
.Example output
142+
[source,terminal]
143+
----
144+
# ...
145+
metadata:
146+
name: cert-manager
147+
namespace: cert-manager
148+
# ...
149+
spec:
150+
template:
151+
spec:
152+
containers:
153+
- name: cert-manager-controller
154+
resources:
155+
limits:
156+
cpu: 200m
157+
memory: 64Mi
158+
requests:
159+
cpu: 10m
160+
memory: 16Mi
161+
# ...
162+
metadata:
163+
name: cert-manager-cainjector
164+
namespace: cert-manager
165+
# ...
166+
spec:
167+
template:
168+
spec:
169+
containers:
170+
- name: cert-manager-cainjector
171+
resources:
172+
limits:
173+
cpu: 200m
174+
memory: 64Mi
175+
requests:
176+
cpu: 10m
177+
memory: 16Mi
178+
# ...
179+
metadata:
180+
name: cert-manager-webhook
181+
namespace: cert-manager
182+
# ...
183+
spec:
184+
template:
185+
spec:
186+
containers:
187+
- name: cert-manager-webhook
188+
resources:
189+
limits:
190+
cpu: 200m
191+
memory: 64Mi
192+
requests:
193+
cpu: 10m
194+
memory: 16Mi
195+
# ...
196+
----

‎security/cert_manager_operator/cert-manager-customizing-api-fields.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,5 @@ include::modules/cert-manager-override-environment-variables.adoc[leveloffset=+1
1818
include::modules/cert-manager-override-arguments.adoc[leveloffset=+1]
1919

2020
include::modules/cert-manager-override-flag-controller.adoc[leveloffset=+1]
21+
22+
include::modules/cert-manager-configure-cpu-memory.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)