Measure the memory reduction in cert-manager with WatchList + ClientWatchList: https://github.com/cert-manager/cert-manager/pull/7175

changes.diff

diff -r -u /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/before/cainjector-binary.memory /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/after/cainjector-binary.memory
--- /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/before/cainjector-binary.memory	2024-09-24 12:55:00.352591089 +0100
+++ /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/after/cainjector-binary.memory	2024-09-24 12:56:18.791011687 +0100
@@ -1,12 +1,12 @@
-VmPeak:	 1278180 kB
-VmSize:	 1278180 kB
+VmPeak:	 1278184 kB
+VmSize:	 1278184 kB
 VmLck:	       0 kB
 VmPin:	       0 kB
-VmHWM:	   46468 kB
-VmRSS:	   46468 kB
+VmHWM:	   44628 kB
+VmRSS:	   44628 kB
 VmData:	   56496 kB
 VmStk:	     132 kB
 VmExe:	   23476 kB
 VmLib:	       8 kB
-VmPTE:	     212 kB
+VmPTE:	     216 kB
 VmSwap:	       0 kB
diff -r -u /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/before/controller-binary.memory /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/after/controller-binary.memory
--- /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/before/controller-binary.memory	2024-09-24 12:55:00.352591089 +0100
+++ /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/after/controller-binary.memory	2024-09-24 12:56:18.781845020 +0100
@@ -1,12 +1,12 @@
-VmPeak:	 1626876 kB
-VmSize:	 1626876 kB
+VmPeak:	 1429808 kB
+VmSize:	 1429808 kB
 VmLck:	       0 kB
 VmPin:	       0 kB
-VmHWM:	  362988 kB
-VmRSS:	  362988 kB
-VmData:	  374000 kB
+VmHWM:	  229256 kB
+VmRSS:	  229256 kB
+VmData:	  226084 kB
 VmStk:	     132 kB
 VmExe:	   32468 kB
 VmLib:	       8 kB
-VmPTE:	     852 kB
+VmPTE:	     580 kB
 VmSwap:	       0 kB
diff -r -u /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/before/etcd.memory /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/after/etcd.memory
--- /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/before/etcd.memory	2024-09-24 12:55:00.342706837 +0100
+++ /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/after/etcd.memory	2024-09-24 12:56:18.781845020 +0100
@@ -1,12 +1,12 @@
-VmPeak:	11940536 kB
-VmSize:	11940536 kB
+VmPeak:	11940600 kB
+VmSize:	11940600 kB
 VmLck:	       0 kB
 VmPin:	       0 kB
-VmHWM:	  366532 kB
-VmRSS:	  366532 kB
-VmData:	  292736 kB
+VmHWM:	  358456 kB
+VmRSS:	  358456 kB
+VmData:	  296896 kB
 VmStk:	     132 kB
 VmExe:	   10660 kB
 VmLib:	       8 kB
-VmPTE:	     860 kB
+VmPTE:	     844 kB
 VmSwap:	       0 kB
diff -r -u /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/before/kube-apiserver.memory /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/after/kube-apiserver.memory
--- /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/before/kube-apiserver.memory	2024-09-24 12:55:00.342706837 +0100
+++ /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/after/kube-apiserver.memory	2024-09-24 12:56:18.772678352 +0100
@@ -1,12 +1,12 @@
-VmPeak:	 2443400 kB
-VmSize:	 2443400 kB
+VmPeak:	 2051540 kB
+VmSize:	 2051540 kB
 VmLck:	       0 kB
 VmPin:	       0 kB
-VmHWM:	 1134700 kB
-VmRSS:	 1134700 kB
-VmData:	 1113620 kB
+VmHWM:	  824916 kB
+VmRSS:	  821504 kB
+VmData:	  832352 kB
 VmStk:	     132 kB
 VmExe:	   42168 kB
 VmLib:	       8 kB
-VmPTE:	    2336 kB
+VmPTE:	    1808 kB
 VmSwap:	       0 kB
diff -r -u /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/before/webhook-binary.memory /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/after/webhook-binary.memory
--- /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/before/webhook-binary.memory	2024-09-24 12:55:00.362475341 +0100
+++ /home/richard/projects/cert-manager/cert-manager/out.test.cert-manager.7175.4HZhPg2/measurements/after/webhook-binary.memory	2024-09-24 12:56:18.791011687 +0100
@@ -2,11 +2,11 @@
 VmSize:	 1286588 kB
 VmLck:	       0 kB
 VmPin:	       0 kB
-VmHWM:	   48304 kB
-VmRSS:	   48304 kB
+VmHWM:	   49364 kB
+VmRSS:	   49364 kB
 VmData:	   52576 kB
 VmStk:	     132 kB
 VmExe:	   27092 kB
 VmLib:	       8 kB
-VmPTE:	     216 kB
+VmPTE:	     224 kB
 VmSwap:	       0 kB

test.cert-manager-PR-7175.sh

#!/usr/bin/env bash
#
# https://github.com/cert-manager/cert-manager/pull/7175
#
# Creates a Kind cluster and installs cert-manager from master and then from the
# bug fix branch containing the fix.

set -o errexit
set -o nounset
set -o pipefail
set -o xtrace

PR=7175
export KO_REGISTRY=ttl.sh/b0c82fa3-22a7-4299-a9c1-57714b6a75e1
export KO_HELM_VALUES_FILES=$PWD/values.cert-manager.yaml

cluster_name="test.cert-manager.${PR}"
out_dir=$(mktemp -d "${PWD}/out.test.cert-manager.${PR}.XXXXXXX")

cat <<EOF > "${out_dir}/kind.config.yaml"
apiVersion: kind.x-k8s.io/v1alpha4
kind: Cluster
featureGates:
  # Enable the WatchList / Streaming Lists feature on the API server.
  #
  # - https://kind.sigs.k8s.io/docs/user/configuration/#feature-gates
  # - https://kubernetes.io/docs/reference/using-api/api-concepts/#streaming-lists
  WatchList: true
kubeadmConfigPatches:
  - |
    kind: ClusterConfiguration
    metadata:
      name: config
    etcd:
      local:
        extraArgs:
          unsafe-no-fsync: "true"
nodes:
  - role: control-plane
EOF

cat <<EOF > "${out_dir}/secret.yaml"
apiVersion: v1
kind: Secret
metadata:
  generateName: s-
  labels:
    # Label the Secret so that the cert-manager controller will cache the data.
    controller.cert-manager.io/fao: "true"
data:
  f1: $(dd if=/dev/zero bs=1048576 count=1 | base64 -w0)
EOF

function measure_memory() {
    name="$1"
    pid="$(pidof $name)"
    xargs -0 < "/proc/${pid}/cmdline"
    cat "/proc/${pid}/status" | grep Vm > "${name}.memory"
}

function measure() {
    results_dir="$1"
    gitref="$2"

    # Create cluster
    kind delete cluster --name "$cluster_name" || true
    kind create cluster --name "$cluster_name" --config="${out_dir}/kind.config.yaml"

    # Create ~100Mi of Secrets, 5 at a time
    echo -n {0..99} | xargs -d ' ' -P5 -I{} kubectl create -f "${out_dir}/secret.yaml"

    git fetch origin "$gitref"
    git checkout FETCH_HEAD
    make -j4 ko-deploy-certmanager

    # Wait long enough for all caches to sync
    sleep 10

    mkdir -p "${out_dir}/measurements/${results_dir}"
    pushd "${out_dir}/measurements/${results_dir}"
    for name in kube-apiserver etcd controller-binary cainjector-binary webhook-binary; do
        measure_memory "$name"
    done
    popd

    mkdir -p "${out_dir}/logs/${results_dir}"
    pushd "${out_dir}/logs/${results_dir}"
    for deployment in cert-manager cert-manager-cainjector cert-manager-webhook; do
        kubectl logs -n cert-manager "deployments/$deployment" > "$deployment.log"
    done
    popd
}

measure before master
measure after pull/${PR}/head

diff -r -u "${out_dir}/measurements/before" "${out_dir}/measurements/after" | tee "${out_dir}/changes.diff"

values.cert-manager.yaml

# values.cert-manager.yaml
global:
  logLevel: 6
config:
  logging:
    format: json
  featureGates:
    AllAlpha: true
    AllBeta: true
cainjector:
  config:
    logging:
      format: json
    featureGates:
      AllAlpha: true
      AllBeta: true
webhook:
  config:
    logging:
      format: json
    featureGates:
      AllAlpha: true
      AllBeta: true