tweak resource requests/limits for sidecars, vault auto-unseal, and enrollment-operator

they were too low to sucessfully spin up minikube 🙃

also fixes cAdvisor metrics in minikube

Author: ewdurbin

minikube/main.tf

@@ -74,6 +74,11 @@ module "cabotage" {
   rustfs_disks_per_replica = 1    # FS mode — no erasure coding
   loki_standalone          = true # single all-in-one process
   mimir_standalone         = true
+  # Minikube's kubelet uses a serving cert signed by minikube-cabotage-ca,
+  # which is NOT the same CA as the projected serviceaccount/ca.crt
+  # (minikubeCA). Production EKS uses cluster-CA-signed kubelet certs so
+  # verification works there.
+  alloy_cadvisor_insecure_skip_verify = true
   consul_replicas          = 1
   consul_storage_size      = "1Gi"
   vault_replicas           = 1

modules/cabotage/manifests/enrollment-operator/03-deployment.yml.tftpl

@@ -41,6 +41,14 @@ spec:
           volumeMounts:
             - name: vault-token
               mountPath: /var/run/secrets/vault
+          startupProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - test -f /var/run/secrets/vault/vault-token && test -f /var/run/secrets/vault/consul-token
+            periodSeconds: 1
+            failureThreshold: 30
       containers:
         - name: enrollment-operator
           image: cabotage/enrollment-operator:4.4.4

modules/cabotage/monitoring.tf

@@ -31,7 +31,9 @@ resource "kubectl_manifest" "alloy_clusterrolebinding" {
 }
 
 resource "kubectl_manifest" "alloy_configmap" {
-  yaml_body = file("${path.module}/manifests/resident-monitoring/alloy/02-configmap.yml")
+  yaml_body = templatefile("${path.module}/manifests/resident-monitoring/alloy/02-configmap.yml.tftpl", {
+    cadvisor_insecure_skip_verify = var.alloy_cadvisor_insecure_skip_verify
+  })
 
   depends_on = [kubernetes_namespace_v1.cabotage]
 }

modules/cabotage/variables.tf

@@ -165,7 +165,7 @@ variable "cabotage_sidecar_resources" {
       memory = "16Mi"
     }
     limits = {
-      cpu    = "10m"
+      cpu    = "25m"
       memory = "16Mi"
     }
   }
@@ -261,7 +261,7 @@ variable "cabotage_app_worker_beat_resources" {
       memory = "256Mi"
     }
     limits = {
-      cpu    = "25m"
+      cpu    = "100m"
       memory = "256Mi"
     }
   }
@@ -452,8 +452,8 @@ variable "vault_consul_agent_resources" {
       memory = "48Mi"
     }
     limits = {
-      cpu    = "25m"
-      memory = "48Mi"
+      cpu    = "50m"
+      memory = "96Mi"
     }
   }
 }
@@ -476,7 +476,7 @@ variable "cert_watcher_resources" {
       memory = "8Mi"
     }
     limits = {
-      cpu    = "5m"
+      cpu    = "25m"
       memory = "8Mi"
     }
   }
@@ -500,7 +500,7 @@ variable "vault_auto_unseal_resources" {
       memory = "32Mi"
     }
     limits = {
-      cpu    = "10m"
+      cpu    = "50m"
       memory = "32Mi"
     }
   }
@@ -524,8 +524,8 @@ variable "vault_resources" {
       memory = "128Mi"
     }
     limits = {
-      cpu    = "50m"
-      memory = "128Mi"
+      cpu    = "100m"
+      memory = "256Mi"
     }
   }
 }
@@ -796,7 +796,7 @@ variable "enrollment_operator_resources" {
       memory = "128Mi"
     }
     limits = {
-      cpu    = "25m"
+      cpu    = "100m"
       memory = "128Mi"
     }
   }
@@ -832,6 +832,12 @@ variable "s3_storage" {
 
 # --- Resident Monitoring ---
 
+variable "alloy_cadvisor_insecure_skip_verify" {
+  description = "Skip TLS verification when scraping cadvisor from the kubelet. Required for minikube where the kubelet serving cert is signed by a CA not present in the projected service account bundle. Should remain false in production where the kubelet uses cluster-CA-signed certs."
+  type        = bool
+  default     = false
+}
+
 variable "alloy_resources" {
   description = "CPU/memory requests and limits for the Alloy DaemonSet"
   type = object({