Add container resource caps enforcement for workspace containers

apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go

@@ -183,6 +183,12 @@ type WorkspaceConfig struct {
 	// the value "0" should be used. By default, the memory limit is 128Mi and the memory request is 64Mi.
 	// No CPU limit or request is added by default.
 	DefaultContainerResources *corev1.ResourceRequirements `json:"defaultContainerResources,omitempty"`
+	// ContainerResourceCaps defines the maximum resource requirements enforced for workspace
+	// containers. If a container specifies limits or requests that exceed these values, they
+	// will be capped at the maximum. Note: Caps only apply when resources are already specified
+	// on a container. For containers without resource specifications, use DefaultContainerResources
+	// instead. These resource caps do not apply to initContainers or the projectClone container.
+	ContainerResourceCaps *corev1.ResourceRequirements `json:"containerResourceCaps,omitempty"`
 	// PodAnnotations defines the metadata.annotations for DevWorkspace pods created by the DevWorkspace Operator.
 	PodAnnotations map[string]string `json:"podAnnotations,omitempty"`
 	// RuntimeClassName defines the spec.runtimeClassName for DevWorkspace pods created by the DevWorkspace Operator.

controllers/workspace/devworkspace_controller.go

@@ -335,6 +335,7 @@ func (r *DevWorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		workspace.Config.Workspace.ContainerSecurityContext,
 		workspace.Config.Workspace.ImagePullPolicy,
 		workspace.Config.Workspace.DefaultContainerResources,
+		workspace.Config.Workspace.ContainerResourceCaps,
 		workspace.Config.Workspace.PostStartTimeout,
 		postStartDebugTrapSleepDuration,
 	)