external-secrets:
  # Fresh install — nothing runs this today, so no adoption gotchas here
  # (unlike gitea/vault/contour). Replaces the Vault Agent Injector as the
  # path for getting secrets into pods (see the injector.enabled: false
  # note in ../vault/custom-values.yaml) — nothing is wired to a
  # SecretStore/ClusterSecretStore backend yet, that's a separate step
  # once this controller itself is up and healthy.
  #
  # installCRDs defaults to true — leaving it, this is a fresh cluster
  # with no existing SecretStore/ExternalSecret CRs whose schema this
  # could clobber.
  #
  # All three components (controller, webhook, cert-controller) default
  # to unbounded resources — every other app in this repo gets trimmed
  # requests/limits for the same reason, staying consistent here.
  resources:
    requests:
      cpu: 25m
      memory: 32Mi
    limits:
      memory: 128Mi

  webhook:
    resources:
      requests:
        cpu: 25m
        memory: 32Mi
      limits:
        memory: 64Mi

  certController:
    resources:
      requests:
        cpu: 25m
        memory: 32Mi
      limits:
        memory: 64Mi