webhook: enforce minimum memory limit

If memory limit is set and less than minimum, set it to minimum.

This is to to account for kata-containers@0ec3403

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

Author: Redent0r

tools/testing/kata-webhook/deploy/webhook.yaml

@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: pod-annotate-webhook
-          image: quay.io/kata-containers/kata-webhook-example:latest
+          image: marineraks.azurecr.io/kata-containers/kata-webhook:min_memory_limit
           imagePullPolicy: Always
           env:
             - name: RUNTIME_CLASS
@@ -29,6 +29,12 @@ spec:
                   name: kata-webhook
                   key: runtime_class
                   optional: true
+            - name: MIN_MEMORY_LIMIT
+              valueFrom:
+                configMapKeyRef:
+                  name: kata-webhook
+                  key: min_memory_limit
+                  optional: true
           args:
             - -tls-cert-file=/etc/webhook/certs/cert.pem
             - -tls-key-file=/etc/webhook/certs/key.pem
@@ -74,3 +80,4 @@ metadata:
   name: kata-webhook
 data:
   runtime_class: kata
+  min_memory_limit: "128Mi"

tools/testing/kata-webhook/main.go

@@ -14,6 +14,7 @@ import (
 	"strings"
 
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"github.com/sirupsen/logrus"
@@ -75,6 +76,23 @@ func annotatePodMutator(_ context.Context, ar *kwhmodel.AdmissionReview, obj met
 	kataRuntimeClassName := getRuntimeClass(runtimeClassEnvKey, "kata")
 	pod.Spec.RuntimeClassName = &kataRuntimeClassName
 
+	minMemoryLimit, foundMinMemoryLimit := os.LookupEnv("MIN_MEMORY_LIMIT")
+
+	if foundMinMemoryLimit {
+		minMemoryLimitVal := resource.MustParse(minMemoryLimit)
+		for i := range pod.Spec.Containers {
+			if pod.Spec.Containers[i].Resources.Limits == nil {
+				continue
+			} else {
+				currentMemoryLimit := pod.Spec.Containers[i].Resources.Limits.Memory().Value()
+				if currentMemoryLimit < minMemoryLimitVal.Value() {
+					pod.Spec.Containers[i].Resources.Limits["memory"] = resource.MustParse(minMemoryLimit)
+					fmt.Println("memory limit too low. Updating to : ", pod.Spec.Containers[i].Resources.Limits)
+				}
+			}
+		}
+	}
+
 	return &kwhmutating.MutatorResult{
 		MutatedObject: pod,
 	}, nil