step-registry/tls-scanner: split CPU/memory into request and limit

ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml

@@ -20,19 +20,40 @@ ref:
     documentation: "Max IPs to scan (empty/0 = no limit). Bounds actual TLS scans after full endpoint discovery."
   - name: SCANNER_CPU
     default: "4"
-    documentation: "CPU request/limit for the scanner pod on the management cluster."
+    documentation: "Deprecated: use SCANNER_CPU_REQUEST and SCANNER_CPU_LIMIT. Kept as fallback."
   - name: SCANNER_MEMORY
     default: "4Gi"
-    documentation: "Memory request/limit for the scanner pod on the management cluster."
+    documentation: "Deprecated: use SCANNER_MEM_REQUEST and SCANNER_MEM_LIMIT. Kept as fallback."
+  - name: SCANNER_CPU_REQUEST
+    default: "4"
+    documentation: "CPU request for the scanner pod."
+  - name: SCANNER_CPU_LIMIT
+    default: "4"
+    documentation: "CPU limit for the scanner pod."
+  - name: SCANNER_MEM_REQUEST
+    default: "4Gi"
+    documentation: "Memory request for the scanner pod."
+  - name: SCANNER_MEM_LIMIT
+    default: "4Gi"
+    documentation: "Memory limit for the scanner pod."
   - name: SCANNER_CPU_GUEST
     default: "1"
-    documentation: |-
-      CPU request/limit for the scanner pod on the guest cluster. Defaults to 1
-      because HyperShift guest workers (e.g. m5.xlarge) cannot schedule a 4 CPU
-      Guaranteed pod.
+    documentation: "Deprecated: use SCANNER_CPU_GUEST_REQUEST and SCANNER_CPU_GUEST_LIMIT. Kept as fallback. Defaults to 1 because HyperShift guest workers (e.g. m5.xlarge) cannot schedule a 4 CPU Guaranteed pod."
   - name: SCANNER_MEMORY_GUEST
     default: "2Gi"
-    documentation: "Memory request/limit for the scanner pod on the guest cluster."
+    documentation: "Deprecated: use SCANNER_MEM_GUEST_REQUEST and SCANNER_MEM_GUEST_LIMIT. Kept as fallback."
+  - name: SCANNER_CPU_GUEST_REQUEST
+    default: "1"
+    documentation: "CPU request for the scanner pod on the guest cluster."
+  - name: SCANNER_CPU_GUEST_LIMIT
+    default: "1"
+    documentation: "CPU limit for the scanner pod on the guest cluster."
+  - name: SCANNER_MEM_GUEST_REQUEST
+    default: "2Gi"
+    documentation: "Memory request for the scanner pod on the guest cluster."
+  - name: SCANNER_MEM_GUEST_LIMIT
+    default: "2Gi"
+    documentation: "Memory limit for the scanner pod on the guest cluster."
   - name: TLS_PROFILE_TYPE
     default: "Modern"
     documentation: |-

ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh

@@ -66,13 +66,21 @@ run_tls_scan() {
       echo "Using expected TLS profile type for compliance checks: ${TLS_PROFILE_TYPE}"
   fi
 
-  local scanner_cpu="${SCANNER_CPU}"
-  local scanner_memory="${SCANNER_MEMORY}"
+  # SCANNER_CPU / SCANNER_MEMORY are deprecated but still honoured as fallback
+  # defaults for both request and limit when the split vars aren't explicitly
+  # set, so that a lower CPU request (e.g. 500m) can get the Pod scheduled
+  # while still allowing it to burst up to the higher limit.
+  local scanner_cpu_request="${SCANNER_CPU_REQUEST:-${SCANNER_CPU}}"
+  local scanner_cpu_limit="${SCANNER_CPU_LIMIT:-${SCANNER_CPU}}"
+  local scanner_mem_request="${SCANNER_MEM_REQUEST:-${SCANNER_MEMORY}}"
+  local scanner_mem_limit="${SCANNER_MEM_LIMIT:-${SCANNER_MEMORY}}"
   if [[ "${TLS_SCANNER_CLUSTER_LABEL:-}" == "guest" ]]; then
-    scanner_cpu="${SCANNER_CPU_GUEST:-1}"
-    scanner_memory="${SCANNER_MEMORY_GUEST:-2Gi}"
+    scanner_cpu_request="${SCANNER_CPU_GUEST_REQUEST:-${SCANNER_CPU_GUEST}}"
+    scanner_cpu_limit="${SCANNER_CPU_GUEST_LIMIT:-${SCANNER_CPU_GUEST}}"
+    scanner_mem_request="${SCANNER_MEM_GUEST_REQUEST:-${SCANNER_MEMORY_GUEST}}"
+    scanner_mem_limit="${SCANNER_MEM_GUEST_LIMIT:-${SCANNER_MEMORY_GUEST}}"
   fi
-  echo "Scanner pod resources: cpu=${scanner_cpu} memory=${scanner_memory}"
+  echo "Scanner pod resources: cpu=${scanner_cpu_request}/${scanner_cpu_limit} memory=${scanner_mem_request}/${scanner_mem_limit}"
 
   mkdir -p "${SCANNER_ARTIFACT_DIR}"
 
@@ -191,11 +199,11 @@ spec:
       exit \${SCAN_EXIT_CODE}
     resources:
       requests:
-        cpu: "${scanner_cpu}"
-        memory: ${scanner_memory}
+        cpu: "${scanner_cpu_request}"
+        memory: ${scanner_mem_request}
       limits:
-        cpu: "${scanner_cpu}"
-        memory: ${scanner_memory}
+        cpu: "${scanner_cpu_limit}"
+        memory: ${scanner_mem_limit}
     securityContext:
 ${SECURITY_CONTEXT_YAML}
     volumeMounts:

ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml

@@ -15,10 +15,22 @@ ref:
     documentation: "Max IPs to scan (empty/0 = no limit). Bounds actual TLS scans after full endpoint discovery."
   - name: SCANNER_CPU
     default: "4"
-    documentation: "CPU request/limit for the scanner pod."
+    documentation: "Deprecated: use SCANNER_CPU_REQUEST and SCANNER_CPU_LIMIT. Kept as fallback."
   - name: SCANNER_MEMORY
     default: "4Gi"
-    documentation: "Memory request/limit for the scanner pod."
+    documentation: "Deprecated: use SCANNER_MEM_REQUEST and SCANNER_MEM_LIMIT. Kept as fallback."
+  - name: SCANNER_CPU_REQUEST
+    default: "4"
+    documentation: "CPU request for the scanner pod."
+  - name: SCANNER_CPU_LIMIT
+    default: "4"
+    documentation: "CPU limit for the scanner pod."
+  - name: SCANNER_MEM_REQUEST
+    default: "4Gi"
+    documentation: "Memory request for the scanner pod."
+  - name: SCANNER_MEM_LIMIT
+    default: "4Gi"
+    documentation: "Memory limit for the scanner pod."
   - name: TLS_SCANNER_CLUSTER_LABEL
     default: ""
     documentation: |-