EV-4687 Make resource request/limits configurable for dex,IDC

[vara2504]

Description

Set default for CSR
Add AuthenticationDeployment to configure resources
Add IntrusionDetectionDeployment to configure resources

vara@vara:~/bzprofiles/Clusters/tc_res$ kubectl patch authentication tigera-secure  --type=merge --patch='{"spec": {"dexDeployment":{"spec": {"template": {"spec": {"containers":[{"name":"tigera-dex","resources":{"limits":{"cpu":"150m", "memory":"500Mi"},"requests":{"cpu":"20m", "memory":"50Mi"}}}]}}}}}}'
authentication.operator.tigera.io/tigera-secure patched
vara@vara:~/bzprofiles/Clusters/tc_res$ k get authentication -o yaml
apiVersion: v1
items:
- apiVersion: operator.tigera.io/v1
  kind: Authentication
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"operator.tigera.io/v1","kind":"Authentication","metadata":{"annotations":{},"name":"tigera-secure"},"spec":{"managerDomain":"https://tigera-manager.tigera-manager:9443","oidc":{"issuerURL":"https://oidc.oidc:443","usernameClaim":"email"}}}
    creationTimestamp: "2024-03-05T18:02:18Z"
    generation: 3
    name: tigera-secure
    resourceVersion: "174147"
    uid: 14144119-ab06-4bd8-894e-29db30357b88
  spec:
    dexDeployment:
      spec:
        template:
          spec:
            containers:
            - name: tigera-dex
              resources:
                limits:
                  cpu: 150m
                  memory: 500Mi
                requests:
                  cpu: 20m
                  memory: 50Mi
vara@vara:~/bzprofiles/Clusters/tc_res$ k get deployment.apps/tigera-dex -n tigera-dex -o yaml|grep -A 5 -B 1 resources
          protocol: TCP
        resources:
          limits:
            cpu: 150m
            memory: 500Mi
          requests:
            cpu: 20m

vara@vara:~/bzprofiles/Clusters/tc_res$ k get deployment.apps/intrusion-detection-controller -n tigera-intrusion-detection -o yaml|grep -A 5 -B 1 resources
        name: controller
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
--
        name: webhooks-processor
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
vara@vara:~/bzprofiles/Clusters/tc_res$ 
vara@vara:~/bzprofiles/Clusters/tc_res$  kubectl patch intrusiondetection tigera-secure  --type=merge --patch='{"spec": {"intrusionDetectionControllerDeployment":{"spec": {"template": {"spec": {"containers":[{"name":"webhooks-processor","resources":{"limits":{"cpu":"150m", "memory":"500Mi"},"requests":{"cpu":"20m", "memory":"50Mi"}}}]}}}}}}'
intrusiondetection.operator.tigera.io/tigera-secure patched
vara@vara:~/bzprofiles/Clusters/tc_res$ 
vara@vara:~/bzprofiles/Clusters/tc_res$ 
vara@vara:~/bzprofiles/Clusters/tc_res$ k get deployment.apps/intrusion-detection-controller -n tigera-intrusion-detection -o yaml|grep -A 5 -B 1 resources
        name: controller
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
--
        name: webhooks-processor
        resources:
          limits:
            cpu: 150m
            memory: 500Mi
          requests:
            cpu: 20m

APIServer already have this option - tested

vara@vara:~/bzprofiles/Clusters/tc_monitoring$ k get deployment.apps/tigera-apiserver -n tigera-system -o yaml|grep -A 5 -B 1 resources
          timeoutSeconds: 5
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
--
        name: tigera-queryserver
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

[rene-dekker]

lgtm