fix: restore memory limit at 4Gi to prevent node starvation

[BATMAN-JD]

Summary

PR #1044 removed the memory limit to address OOMKilled issues with 3Gi limit. However, this creates a risk where the memory leak in AAO could consume the entire node's memory and starve other pods.

Changes

Restore memory limit at 4Gi in both deployment manifests:

• deploy/operator.yaml
• deploy_pko/Deployment-aws-account-operator.yaml.gotmpl

Rationale

• Provide headroom: 4Gi accommodates current workload (586 Account CRs in hivei01ue1) with ~33% increase over previous 3Gi
• Prevent node starvation: Contains memory leak from consuming entire node memory (~25% of smallest 16Gi nodes)
• Address OOM issues: Increase over previous 3Gi limit reduces OOM risk without consuming too much node capacity

Next Steps

The memory leak itself needs to be investigated and fixed separately.

Related

• Reverts: Remove memory limit to prevent OOMKilled in integration #1044
• Context: https://redhat-internal.slack.com/archives/C0AKBJST8QH (Alex's message about memory leak)

[coderabbitai]

Walkthrough

Adds a memory: 6Gi resource limit for the aws-account-operator container in both deploy/operator.yaml and deploy_pko/Deployment-aws-account-operator.yaml.gotmpl, extending the existing cpu limits configuration.

Changes

Resource Limit Configuration

Layer / File(s)	Summary
Add memory limit to deployment manifests deploy/operator.yaml, deploy_pko/Deployment-aws-account-operator.yaml.gotmpl	Adds a memory: 6Gi entry under resources.limits for the aws-account-operator container in both files, alongside the existing cpu limit.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: deployment, configuration

Suggested reviewers: none

🐰 A hop, a nibble, a memory boost,
Six gigabytes now, no more roost
For carrots crammed too tight in a jar,
The operator breathes a little easier by far.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: restoring the 6Gi memory limit to prevent node starvation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes deployment YAML memory limits; no Ginkgo test titles were added or modified, so the deterministic-name rule isn’t implicated.
Test Structure And Quality	✅ Passed	Only two deployment YAMLs changed; no Ginkgo test files or test code were modified, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only changes two deployment manifests to add memory limits; no Ginkgo e2e tests or MicroShift-sensitive APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only deployment manifests changed; no It/Describe/Context/When tests were added, so SNO compatibility checks are not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only memory limits changed in the two manifests; no nodeSelector, affinity, anti-affinity, spread constraints, or other topology-sensitive scheduling logic was added.
Ote Binary Stdout Contract	✅ Passed	PR only changes two deployment YAML manifests to add a memory limit; no process-level code or stdout logging paths were modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo/e2e tests were added; the branch only changes deployment manifests to set memory limits.
No-Weak-Crypto	✅ Passed	Touched manifests only change memory limits; no weak-crypto terms or secret-comparison code appears in the PR files.
Container-Privileges	✅ Passed	The changed manifests only add memory: 6Gi; neither file contains privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The only touched lines add a 6Gi memory limit in two manifests; no logging or sensitive-data fields appear in the changed files.
Description check	✅ Passed	The description clearly explains the change, rationale, and related context, though the checklist and manual test steps from the template are missing.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BATMAN-JD

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [BATMAN-JD]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.65%. Comparing base (b5e7e1f) to head (5f1f99a).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1046   +/-   ##
=======================================
  Coverage   46.65%   46.65%           
=======================================
  Files          46       46           
  Lines        7033     7033           
=======================================
  Hits         3281     3281           
  Misses       3414     3414           
  Partials      338      338           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

@BATMAN-JD: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.