From 9b231b8bf03cc3894418214f815f4f2cb3f8f790 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Mon, 3 Aug 2026 23:25:44 +0000 Subject: [PATCH] step-registry/tls-scanner: split CPU/memory into request and limit Align the step-registry env vars with the upstream tls-scanner change (openshift/tls-scanner#87) that splits SCANNER_CPU / SCANNER_MEMORY into separate request and limit variables. New variables (both run and hypershift-run refs): SCANNER_CPU_REQUEST / SCANNER_CPU_LIMIT (default 4 / 4) SCANNER_MEM_REQUEST / SCANNER_MEM_LIMIT (default 4Gi / 4Gi) New guest-cluster variables (hypershift-run ref only): SCANNER_CPU_GUEST_REQUEST / SCANNER_CPU_GUEST_LIMIT (default 1 / 1) SCANNER_MEM_GUEST_REQUEST / SCANNER_MEM_GUEST_LIMIT (default 2Gi / 2Gi) The original SCANNER_CPU, SCANNER_MEMORY, SCANNER_CPU_GUEST, and SCANNER_MEMORY_GUEST are preserved as deprecated fallbacks so that existing CI configs continue to work without changes. This unblocks openshift/release#82553 (add tls-scanner to cluster-monitoring-operator e2e) which uses the new split vars to set a lower CPU request for scheduling while keeping a higher burst limit. --- .../tls-scanner-hypershift-run-ref.yaml | 35 +++++++++++++++---- .../scanner/run/tls-scanner-run-commands.sh | 26 +++++++++----- .../tls/scanner/run/tls-scanner-run-ref.yaml | 16 +++++++-- 3 files changed, 59 insertions(+), 18 deletions(-) diff --git a/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml b/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml index 962465de31798..095c5151eda73 100644 --- a/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml +++ b/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml @@ -20,19 +20,40 @@ ref: documentation: "Max IPs to scan (empty/0 = no limit). Bounds actual TLS scans after full endpoint discovery." - name: SCANNER_CPU default: "4" - documentation: "CPU request/limit for the scanner pod on the management cluster." + documentation: "Deprecated: use SCANNER_CPU_REQUEST and SCANNER_CPU_LIMIT. Kept as fallback." - name: SCANNER_MEMORY default: "4Gi" - documentation: "Memory request/limit for the scanner pod on the management cluster." + documentation: "Deprecated: use SCANNER_MEM_REQUEST and SCANNER_MEM_LIMIT. Kept as fallback." + - name: SCANNER_CPU_REQUEST + default: "4" + documentation: "CPU request for the scanner pod." + - name: SCANNER_CPU_LIMIT + default: "4" + documentation: "CPU limit for the scanner pod." + - name: SCANNER_MEM_REQUEST + default: "4Gi" + documentation: "Memory request for the scanner pod." + - name: SCANNER_MEM_LIMIT + default: "4Gi" + documentation: "Memory limit for the scanner pod." - name: SCANNER_CPU_GUEST default: "1" - documentation: |- - CPU request/limit for the scanner pod on the guest cluster. Defaults to 1 - because HyperShift guest workers (e.g. m5.xlarge) cannot schedule a 4 CPU - Guaranteed pod. + documentation: "Deprecated: use SCANNER_CPU_GUEST_REQUEST and SCANNER_CPU_GUEST_LIMIT. Kept as fallback. Defaults to 1 because HyperShift guest workers (e.g. m5.xlarge) cannot schedule a 4 CPU Guaranteed pod." - name: SCANNER_MEMORY_GUEST default: "2Gi" - documentation: "Memory request/limit for the scanner pod on the guest cluster." + documentation: "Deprecated: use SCANNER_MEM_GUEST_REQUEST and SCANNER_MEM_GUEST_LIMIT. Kept as fallback." + - name: SCANNER_CPU_GUEST_REQUEST + default: "1" + documentation: "CPU request for the scanner pod on the guest cluster." + - name: SCANNER_CPU_GUEST_LIMIT + default: "1" + documentation: "CPU limit for the scanner pod on the guest cluster." + - name: SCANNER_MEM_GUEST_REQUEST + default: "2Gi" + documentation: "Memory request for the scanner pod on the guest cluster." + - name: SCANNER_MEM_GUEST_LIMIT + default: "2Gi" + documentation: "Memory limit for the scanner pod on the guest cluster." - name: TLS_PROFILE_TYPE default: "Modern" documentation: |- diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index 98ef1439cf269..eb48bac978faa 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -66,13 +66,21 @@ run_tls_scan() { echo "Using expected TLS profile type for compliance checks: ${TLS_PROFILE_TYPE}" fi - local scanner_cpu="${SCANNER_CPU}" - local scanner_memory="${SCANNER_MEMORY}" + # SCANNER_CPU / SCANNER_MEMORY are deprecated but still honoured as fallback + # defaults for both request and limit when the split vars aren't explicitly + # set, so that a lower CPU request (e.g. 500m) can get the Pod scheduled + # while still allowing it to burst up to the higher limit. + local scanner_cpu_request="${SCANNER_CPU_REQUEST:-${SCANNER_CPU}}" + local scanner_cpu_limit="${SCANNER_CPU_LIMIT:-${SCANNER_CPU}}" + local scanner_mem_request="${SCANNER_MEM_REQUEST:-${SCANNER_MEMORY}}" + local scanner_mem_limit="${SCANNER_MEM_LIMIT:-${SCANNER_MEMORY}}" if [[ "${TLS_SCANNER_CLUSTER_LABEL:-}" == "guest" ]]; then - scanner_cpu="${SCANNER_CPU_GUEST:-1}" - scanner_memory="${SCANNER_MEMORY_GUEST:-2Gi}" + scanner_cpu_request="${SCANNER_CPU_GUEST_REQUEST:-${SCANNER_CPU_GUEST}}" + scanner_cpu_limit="${SCANNER_CPU_GUEST_LIMIT:-${SCANNER_CPU_GUEST}}" + scanner_mem_request="${SCANNER_MEM_GUEST_REQUEST:-${SCANNER_MEMORY_GUEST}}" + scanner_mem_limit="${SCANNER_MEM_GUEST_LIMIT:-${SCANNER_MEMORY_GUEST}}" fi - echo "Scanner pod resources: cpu=${scanner_cpu} memory=${scanner_memory}" + echo "Scanner pod resources: cpu=${scanner_cpu_request}/${scanner_cpu_limit} memory=${scanner_mem_request}/${scanner_mem_limit}" mkdir -p "${SCANNER_ARTIFACT_DIR}" @@ -191,11 +199,11 @@ spec: exit \${SCAN_EXIT_CODE} resources: requests: - cpu: "${scanner_cpu}" - memory: ${scanner_memory} + cpu: "${scanner_cpu_request}" + memory: ${scanner_mem_request} limits: - cpu: "${scanner_cpu}" - memory: ${scanner_memory} + cpu: "${scanner_cpu_limit}" + memory: ${scanner_mem_limit} securityContext: ${SECURITY_CONTEXT_YAML} volumeMounts: diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml index d7d22f177e0aa..37072ca16a889 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml @@ -15,10 +15,22 @@ ref: documentation: "Max IPs to scan (empty/0 = no limit). Bounds actual TLS scans after full endpoint discovery." - name: SCANNER_CPU default: "4" - documentation: "CPU request/limit for the scanner pod." + documentation: "Deprecated: use SCANNER_CPU_REQUEST and SCANNER_CPU_LIMIT. Kept as fallback." - name: SCANNER_MEMORY default: "4Gi" - documentation: "Memory request/limit for the scanner pod." + documentation: "Deprecated: use SCANNER_MEM_REQUEST and SCANNER_MEM_LIMIT. Kept as fallback." + - name: SCANNER_CPU_REQUEST + default: "4" + documentation: "CPU request for the scanner pod." + - name: SCANNER_CPU_LIMIT + default: "4" + documentation: "CPU limit for the scanner pod." + - name: SCANNER_MEM_REQUEST + default: "4Gi" + documentation: "Memory request for the scanner pod." + - name: SCANNER_MEM_LIMIT + default: "4Gi" + documentation: "Memory limit for the scanner pod." - name: TLS_SCANNER_CLUSTER_LABEL default: "" documentation: |-