fix(repo-server): Correctly inherit resources for init-container

controllers/argocd/openshift/openshift.go

@@ -128,6 +128,11 @@ func updateSystemCATrustBuilding(cr *argoapp.ArgoCD, o *appsv1.Deployment, prodI
 		},
 	)
 
+	// Allow override of resource requirements from CR
+	resources := corev1.ResourceRequirements{}
+	if cr.Spec.Repo.Resources != nil {
+		resources = *cr.Spec.Repo.Resources
+	}
 	initContainer := corev1.Container{
 		Name:            "update-ca-certificates",
 		Image:           prodImage,
@@ -136,7 +141,8 @@ func updateSystemCATrustBuilding(cr *argoapp.ArgoCD, o *appsv1.Deployment, prodI
 			{Name: volumeSource, MountPath: "/var/run/secrets/ca-trust-source", ReadOnly: true},
 			{Name: volumeTarget, MountPath: "/etc/pki/ca-trust"},
 		},
-		Command: []string{"/bin/bash", "-c"},
+		Resources: resources,
+		Command:   []string{"/bin/bash", "-c"},
 		Args: []string{`
 set -eEuo pipefail
 trap 's=$?; echo >&2 "$0: Error on line "$LINENO": $BASH_COMMAND"; exit $s' ERR

test/openshift/e2e/ginkgo/parallel/1-064_validate_deployment_attributes_test.go

@@ -0,0 +1,181 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package parallel
+
+import (
+	"context"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	argov1beta1api "github.com/redhat-developer/gitops-operator/argocd-operator/api/v1beta1"
+	"github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture"
+	argocdFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/argocd"
+	k8sFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/k8s"
+	fixtureUtils "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/utils"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+var _ = Describe("GitOps Operator Parallel E2E Tests", func() {
+
+	Context("1-064_validate_deployment_attributes", func() {
+
+		var (
+			k8sClient client.Client
+			ctx       context.Context
+		)
+
+		expectedSecurityContext := corev1.SecurityContext{
+			Capabilities:             &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}},
+			AllowPrivilegeEscalation: new(false),
+			RunAsNonRoot:             new(true),
+			ReadOnlyRootFilesystem:   new(true),
+			SeccompProfile: &corev1.SeccompProfile{
+				Type:             corev1.SeccompProfileTypeRuntimeDefault,
+				LocalhostProfile: nil,
+			},
+		}
+
+		verifiedDeployments := func() []string {
+			deployments := []string{
+				"argocd-applicationset-controller", "argocd-notifications-controller", "argocd-redis", "argocd-repo-server", "argocd-server",
+				"argocd-commit-server", "argocd-argocd-image-updater-controller",
+			}
+			if fixture.RunningOnOpenShift() {
+				deployments = append(deployments, "argocd-dex-server")
+			}
+			return deployments
+		}
+
+		initialResources := &corev1.ResourceRequirements{
+			Limits: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("500m"),
+				corev1.ResourceMemory: resource.MustParse("512Mi"),
+			},
+			Requests: corev1.ResourceList{
+				corev1.ResourceCPU:    resource.MustParse("250m"),
+				corev1.ResourceMemory: resource.MustParse("256Mi"),
+			},
+		}
+
+		BeforeEach(func() {
+			fixture.EnsureParallelCleanSlate()
+
+			k8sClient, _ = fixtureUtils.GetE2ETestKubeClient()
+			ctx = context.Background()
+		})
+
+		It("verifies that Argo CD deployments have expected config", func() {
+
+			By("creating simple namespace-scoped Argo CD instance")
+			ns, cleanupFunc := fixture.CreateRandomE2ETestNamespaceWithCleanupFunc()
+			defer cleanupFunc()
+
+			argoCD := &argov1beta1api.ArgoCD{
+				ObjectMeta: metav1.ObjectMeta{Name: "argocd", Namespace: ns.Name},
+				Spec: argov1beta1api.ArgoCDSpec{
+					ApplicationSet: &argov1beta1api.ArgoCDApplicationSet{
+						Resources: initialResources,
+					},
+					Notifications: argov1beta1api.ArgoCDNotifications{
+						Enabled:   true,
+						Resources: initialResources,
+					},
+					Redis: argov1beta1api.ArgoCDRedisSpec{
+						Resources: initialResources,
+					},
+					Repo: argov1beta1api.ArgoCDRepoSpec{
+						Resources: initialResources,
+						// Creates new init container
+						SystemCATrust: &argov1beta1api.ArgoCDSystemCATrustSpec{
+							DropImageCertificates: true,
+						},
+						// TODO: override the Ubuntu specified image with a RHEL one. Drop once all images are on UBI
+						Image:   "quay.io/redhat-user-workloads/rh-openshift-gitops-tenant/argocd-rhel9",
+						Version: "main",
+					},
+					Server: argov1beta1api.ArgoCDServerSpec{
+						Resources: initialResources,
+					},
+					CommitServer: argov1beta1api.ArgoCDCommitServerSpec{
+						Resources: initialResources,
+					},
+					SourceHydrator: argov1beta1api.ArgoCDSourceHydratorSpec{
+						// Needed for commit server
+						Enabled: new(true),
+					},
+					ImageUpdater: argov1beta1api.ArgoCDImageUpdaterSpec{
+						Enabled:   true,
+						Resources: initialResources,
+					},
+				},
+			}
+
+			if fixture.RunningOnOpenShift() {
+				argoCD.Spec.SSO = &argov1beta1api.ArgoCDSSOSpec{
+					Provider: argov1beta1api.SSOProviderTypeDex,
+					Dex: &argov1beta1api.ArgoCDDexSpec{
+						OpenShiftOAuth: true,
+						Resources:      initialResources,
+					},
+				}
+			}
+
+			Expect(k8sClient.Create(ctx, argoCD)).To(Succeed())
+
+			By("waiting for ArgoCD to be ready")
+			Eventually(argoCD, "5m", "5s").Should(argocdFixture.BeAvailable())
+
+			By("verifying that each Argo CD deployment has expected security context")
+			for _, deployment := range verifiedDeployments() {
+				By("verifying " + deployment)
+
+				depl := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: deployment, Namespace: ns.Name}}
+				Eventually(depl).Should(k8sFixture.ExistByName())
+
+				if fixture.RunningOnOpenShift() {
+					By("verifying security context")
+					seccompProfile := depl.Spec.Template.Spec.SecurityContext.SeccompProfile.Type
+					Expect(seccompProfile).To(Equal(corev1.SeccompProfileTypeRuntimeDefault), "deployment %s has unexpected seccomp profile", depl.Name)
+				}
+
+				containers := depl.Spec.Template.Spec.Containers
+				Expect(containers).To(HaveLen(1))
+				for _, container := range containers {
+					secContext := container.SecurityContext
+					Expect(secContext).ToNot(BeNil(), "container %s has no security context", container.Name)
+					Expect(*secContext).To(Equal(expectedSecurityContext), "container %s has unexpected security context", container.Name)
+
+					Expect(container.Resources.Limits).To(Not(BeNil()), "container %s has no limits", container.Name)
+					Expect(container.Resources.Requests).To(Not(BeNil()), "container %s has no requests", container.Name)
+				}
+				initContainers := depl.Spec.Template.Spec.InitContainers
+				for _, container := range initContainers {
+					secContext := container.SecurityContext
+					Expect(secContext).ToNot(BeNil(), "init container %s has no security context", container.Name)
+					Expect(*secContext).To(Equal(expectedSecurityContext), "init container %s has unexpected security context", container.Name)
+
+					Expect(container.Resources.Limits).To(Not(BeNil()), "init container %s has no limits", container.Name)
+					Expect(container.Resources.Requests).To(Not(BeNil()), "init container %s has no requests", container.Name)
+				}
+			}
+		})
+	})
+})