Add container resource caps enforcement for workspace containers

Implements ContainerResourceCaps configuration to enforce maximum resource
limits and requests for workspace containers. When configured, container
resource requirements that exceed the caps will be limited to the maximum
values. This feature does not apply to initContainers or projectClone containers.

Changes include:
- New ContainerResourceCaps field in DevWorkspaceOperatorConfig API
- Updated CRDs with the new field definition
- Controller integration to pass resource caps to container handlers
- Resource capping logic in container, flatten, merge, and projects packages
- Tests for resource cap enforcement

Assisted-by: Claude.
Signed-off-by: Anatolii Bazko <[email protected]>

Author: tolusha

apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go

@@ -183,6 +183,11 @@ type WorkspaceConfig struct {
 	// the value "0" should be used. By default, the memory limit is 128Mi and the memory request is 64Mi.
 	// No CPU limit or request is added by default.
 	DefaultContainerResources *corev1.ResourceRequirements `json:"defaultContainerResources,omitempty"`
+	// ContainerResourceCaps defines the maximum resource requirements enforced for all
+	// workspace containers. If a container specifies higher limits or requests, they
+	// will be capped at these maximum values. This is not applied to initContainers or
+	// the projectClone container.
+	ContainerResourceCaps *corev1.ResourceRequirements `json:"containerResourceCaps,omitempty"`
 	// PodAnnotations defines the metadata.annotations for DevWorkspace pods created by the DevWorkspace Operator.
 	PodAnnotations map[string]string `json:"podAnnotations,omitempty"`
 	// RuntimeClassName defines the spec.runtimeClassName for DevWorkspace pods created by the DevWorkspace Operator.

apis/controller/v1alpha1/zz_generated.deepcopy.go

@@ -264,6 +264,7 @@ func (r *DevWorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		K8sClient:                   r.Client,
 		HttpClient:                  httpClient,
 		DefaultResourceRequirements: workspace.Config.Workspace.DefaultContainerResources,
+		ResourceCaps:                workspace.Config.Workspace.ContainerResourceCaps,
 	}
 
 	if wsDefaults.NeedsDefaultTemplate(workspace) {
@@ -335,6 +336,7 @@ func (r *DevWorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		workspace.Config.Workspace.ContainerSecurityContext,
 		workspace.Config.Workspace.ImagePullPolicy,
 		workspace.Config.Workspace.DefaultContainerResources,
+		workspace.Config.Workspace.ContainerResourceCaps,
 		workspace.Config.Workspace.PostStartTimeout,
 		postStartDebugTrapSleepDuration,
 	)
@@ -356,6 +358,7 @@ func (r *DevWorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		Image:     workspace.Config.Workspace.ProjectCloneConfig.Image,
 		Env:       env.GetEnvironmentVariablesForProjectClone(workspace),
 		Resources: workspace.Config.Workspace.ProjectCloneConfig.Resources,
+		Caps:      workspace.Config.Workspace.ContainerResourceCaps,
 	}
 	if workspace.Config.Workspace.ProjectCloneConfig.ImagePullPolicy != "" {
 		projectCloneOptions.PullPolicy = config.Workspace.ProjectCloneConfig.ImagePullPolicy