Remove default resources limits for istio-proxy sidecar

Hi,

Is it possible to remove resources limits at all? By default they are set to cpu: 2000m and memory: 1024Mi. I understand that, I can override those values, but my question is: is it possible to completely remove these settings?

Cheers,
Pawel

Anyone? cc @ostromart?

There should be a way to delete items with k8s.overlays and in general with settings in overlay files for all paths, but I just verified it doesn’t work.
The rather clunky way of making this work in 1.5 would be to use external charts and edit the default.yaml profile to remove the values there. I’ve created https://github.com/istio/istio/issues/23429 to track it, I think it should make it into 1.6.

fyi it’s fixed in https://github.com/istio/istio/pull/23596.

1 Like

@ostromart, I’ve just checked with Istio 1.6.2 and still it doesn’t work.

Here is my manifest (integration-testing.yaml):

apiVersion: operator.istio.io/v1alpha1
kind: IstioOperator
spec:
  tag: 1.6.2
  components:
    pilot:
      k8s:
        hpaSpec:
          minReplicas: 1

  values:
    global:
      proxy:
        autoInject: enabled
        resources:
          limits:
            memory: 256Mi
    
    grafana:
      enabled: false

    kiali:
      enabled: false

    prometheus:
      enabled: false

And I install Istio this way:

$ istioctl manifest apply -f integration-testing.yaml

Then I can see, that CPU limits are set, but it shouldn’t be:

$ kubectl -n istio-system get istiooperator installed-state -o json | jq .spec.values.global.proxy.resources.limits
{
  "cpu": "2000m",
  "memory": "256Mi"
}

And istio-proxy containers in my pods have those CPU limits:

$ kubectl -n default describe pod application-bf595fc58-69m7k
...
  istio-proxy:
    Container ID:  containerd://a84348116f71c35928c3ba383204339b03ef837ef81d4797fe824d8248ffd0ec
    Image:         docker.io/istio/proxyv2:1.6.2
    Image ID:      docker.io/istio/proxyv2@sha256:ac25e39a130f5678bef302adea9e22163cd9d4737b0777e4e5e8353d916e223f
    Port:          15090/TCP
    Host Port:     0/TCP
    Args:
      proxy
      sidecar
      --domain
      $(POD_NAMESPACE).svc.cluster.local
      --serviceCluster
      application.$(POD_NAMESPACE)
      --proxyLogLevel=warning
      --proxyComponentLogLevel=misc:error
      --trust-domain=cluster.local
      --concurrency
      2
    State:          Running
      Started:      Tue, 16 Jun 2020 10:01:18 +0200
    Ready:          True
    Restart Count:  0
    Limits:
      cpu:     2
      memory:  256Mi
    Requests:
      cpu:      100m
      memory:   128Mi

As you can see the istio-proxy container has CPU limits set to 2.

Hi Pawel,
That’s correct, there’s no way to do it through the regular overlay, but you can now do it in the output manifest using the components.X.k8s.overlays path. See examples here: https://istio.io/latest/docs/setup/install/istioctl/#patching-the-output-manifest
To make this possible in the rest of the API we’d probably need to recognize a special “null” string. It’s doable but I’m not sure if anyone on the team would have time to prioritize it given the current workload. Feel free to open a feature request in istio/istio and assign to me to triage though.
You can also do it at the general API level by using the external charts i.e. use the charts in the tarball and run istioctl --charts /manifests to point to them. Then you can edit the profiles under manfiests/profiles/default.yaml to remove the settings there.

Hi @ostromart,

Thank you for the response. When I set null I can see, that CPU limits are not set.

Cheers,
Pawel

I wasn’t expecting that to work :slight_smile: Luckily for us the yaml unmarshaler does the right thing and creates an in memory structure with nil in it.