Use GOMEMLIMIT to reduce the likelihood of an OOM issue

deploy/concierge/deployment.yaml

@@ -192,6 +192,11 @@ spec:
             - name: NO_PROXY
               value: #@ data.values.no_proxy
             #@ end
+            #! reduce OOM likelihood
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
           livenessProbe:
             httpGet:
               path: /healthz

deploy/local-user-authenticator/deployment.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
@@ -76,6 +76,12 @@ spec:
             #! `--validate=false` flag. Note that installing via `kapp` does not complain about this validation error.
             seccompProfile:
               type: "RuntimeDefault"
+          env:
+            #! reduce OOM likelihood
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
       tolerations:
         - key: kubernetes.io/arch
           effect: NoSchedule

deploy/supervisor/deployment.yaml

@@ -1,4 +1,4 @@
-#! Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
@@ -152,6 +152,11 @@ spec:
             - name: NO_PROXY
               value: #@ data.values.no_proxy
             #@ end
+            #! reduce OOM likelihood
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
           livenessProbe:
             httpGet:
               path: /healthz