From 69edb7dd0332f224be02b04370cda7202ea3d761 Mon Sep 17 00:00:00 2001
From: Davanum Srinivas <davanum@gmail.com>
Date: Tue, 20 Oct 2026 06:31:54 -0400
Subject: [PATCH] manifests: requests and 5 s probes for the two remaining
 BestEffort pods

ate-idp-server and podcertificate-controller ran BestEffort, and the
idp server's probes used the default 1 s timeout. On a node packed with
sandboxes such a pod gets almost no CPU: an idp replica missed three
liveness probes and was restarted with nothing wrong in it. Give both
the CPU and memory requests the other control-plane pods have, and the
idp server a 5 s probe timeout with a failure threshold of 6.
---
 manifests/ate-install/ate-idp-server.yaml             | 10 ++++++++++
 manifests/ate-install/pod-certificate-controller.yaml |  6 ++++++
 2 files changed, 16 insertions(+)

diff --git a/manifests/ate-install/ate-idp-server.yaml b/manifests/ate-install/ate-idp-server.yaml
index a78641a2ba..53004039c4 100644
--- a/manifests/ate-install/ate-idp-server.yaml
+++ b/manifests/ate-install/ate-idp-server.yaml
@@ -50,18 +50,28 @@ spec:
         ports:
         - name: https
           containerPort: 8443
+        # Requests, no limits: a node packed with sandboxes gives a BestEffort
+        # pod almost no CPU and its probes time out.
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
         readinessProbe:
           httpGet:
             path: /healthz
             port: https
             scheme: HTTPS
           periodSeconds: 5
+          timeoutSeconds: 5
+          failureThreshold: 6
         livenessProbe:
           httpGet:
             path: /healthz
             port: https
             scheme: HTTPS
           periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
         securityContext:
           capabilities:
             drop:
diff --git a/manifests/ate-install/pod-certificate-controller.yaml b/manifests/ate-install/pod-certificate-controller.yaml
index 4b7887b33c..b69095bf45 100644
--- a/manifests/ate-install/pod-certificate-controller.yaml
+++ b/manifests/ate-install/pod-certificate-controller.yaml
@@ -173,6 +173,12 @@ spec:
               fieldPath: metadata.uid
         - name: WORKERS_PER_SIGNER
           value: "1"
+        # Requests, no limits: a node packed with sandboxes gives a BestEffort
+        # pod almost no CPU.
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
         volumeMounts:
         - name: "ca-state"
           mountPath: "/run/ca-state"