Raise default OPA sidecar resources to match ECS opa-mts (0.14.0) - #41
Merged
Conversation
Bump opa.resources defaults so opt-in OPA consumers no longer hit requests > limits when they raise requests to the ECS opa-mts reservation. Requests 50m/64Mi -> 250m/512Mi (matches ECS opa-mts cpu=256/memory=512); limits 100m/128Mi -> 500m/1Gi (2x headroom). Previously, consumers that overrode only opa.resources.requests to 250m/512Mi kept the chart's default limits (100m/128Mi), so Kubernetes rejected the Sombra Deployment with "requests must be less than or equal to limit". Raising the chart default fixes this for all opt-in OPA consumers without a per-deployment override. - ref https://linear.app/transcend/issue/LINK-6867/opa-sidecar-containment-decision-log-wrapper-in-sombra-pod-template Co-authored-by: Cursor <cursoragent@cursor.com>
Keep only the chart version bump, opa.resources defaults, matching unittest assertion, and CHANGELOG entry. Co-authored-by: Cursor <cursoragent@cursor.com>
dmattia
approved these changes
Aug 5, 2026
MadDataScience
approved these changes
Aug 5, 2026
dipack95
reviewed
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues
Internal Changelog
opa.resourcesfor the opt-in OPA sidecar so requests/limits match the ECSopa-mtsreservation and no longer reject when consumers bump only requests.0.13.0→0.14.0.Implementation details
Problem
transcend-io/main#46530 raised EKS OPA
requeststo250m/512Mito match ECSopa-mts, but left the chart defaultlimitsat100m/128Mi. Kubernetes rejected the Deployment (requests must be less than or equal to limit), and staging deploy failed (run). transcend-io/main#46704 reverted the bump to unblock staging.Fix
Raise chart default
opa.resources(requests and limits) so opt-in OPA consumers do not need a per-deploymentlimitsoverride orlimits: nullworkaround.50m/64Mi250m/512Mi(ECSopa-mtscpu=256/memory=512)100m/128Mi500m/1Gi(2x burst headroom)Scope / behavior
opa.enabled: true(container block gated by{{- if $opa.enabled }}).resourcesand is unchanged.opa.resourcesoverride now reserve more CPU/memory; self-hosted installs that need the old defaults should setopa.resourcesexplicitly.Files
charts/sombra/values.yaml— default resourcescharts/sombra/Chart.yaml— version bumpcharts/sombra/tests/deployment_test.yaml— assertion updatecharts/sombra/CHANGELOG.md—0.14.0entryFollow-up (main repo)
After chart-releaser publishes
0.14.0, bump the pinned chart0.13.0→0.14.0and drop any Pulumiopa.resourcesoverride that was compensating for the old defaults.Related
Test plan
helm lint charts/sombrahelm unittest sombra— 21/21 passtest,check-chart-lock)0.14.0; follow-upmainPR bumps chart pin and drops Pulumiopa.resourcesoverride