feat: add resource management resources

drydock/patches/kustomization-resources

@@ -16,3 +16,6 @@
 - plugins/drydock/k8s/debug/services.yml
 - plugins/drydock/k8s/debug/ingress.yml
 {%- endif %}
+{% if DRYDOCK_RESOURCE_MANAGEMENT -%}
+- plugins/drydock/k8s/resources/limits.yml
+{%- endif %}

drydock/plugin.py

@@ -161,6 +161,7 @@ def get_sync_waves_for_resource(resource_name: str) -> SYNC_WAVES_ORDER_ATTRS_TY
             "superset-celery-beat",
         ],
         "NGINX_STATIC_CACHE_CONFIG": {},
+        "RESOURCE_MANAGEMENT": False,
     },
     # Add here settings that don't have a reasonable default for all users. For
     # instance: passwords, secret keys, etc.

drydock/templates/drydock/k8s/resources/limits.yml

@@ -0,0 +1,70 @@
+---
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: compute-resources
+spec:
+  hard:
+    requests.cpu: "8"
+    requests.memory: 16Gi
+    limits.cpu: "16"
+    limits.memory: 32Gi
+---
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: object-counts
+spec:
+  hard:
+    pods: "30"
+---
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: cpu-resource-constraint
+spec:
+  limits:
+  - default: # this section defines default limits
+      cpu: 1000m
+    defaultRequest: # this section defines default requests
+      cpu: 100m
+    max: # max and min define the limit range
+      cpu: "2"
+    type: Container
+---
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: memory-resource-constraint
+spec:
+  limits:
+  - default: # this section defines default limits
+      memory: 512Mi
+    defaultRequest: # this section defines default requests
+      memory: 256Mi
+    max: # max and min define the limit range
+      memory: 4Gi
+    type: Container
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: allow-intranamespace-traffic
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: openedx-{{ ID }}
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/instance: openedx-{{ ID }}
+  egress:
+  - to:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/instance: openedx-{{ ID }}
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: shipyard-harmony