secureCodeBox · J12934 · Sep 28, 2022 · Sep 10, 2022 · Sep 19, 2022
diff --git a/docs/api/crds/parse-definition.md b/docs/api/crds/parse-definition.md
@@ -43,6 +43,42 @@ See the [Scope HowTo](/docs/how-tos/scope) for more information.
 [`affinity`](https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) and [`tolerations`](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) can be used to control which nodes the parser is executed on.
 The values should be set via Helm values (during install) or by specifying `affinity` and/or `tolerations` in the `Scan` specification.
 
+### Resources (Optional)
+
+`resources` lets you overwrite the resource limits and requests for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+
+```yaml
+resources:
+  requests:
+    cpu: 42mi
+    memory: 256Mi
+  limits:
+    cpu: 4
+    memory: 4Gi
+```
+
+If no resources are set the following defaults are applied:
+
+```yaml
+resources:
+  requests:
+    cpu: 200m
+    memory: 100Mi
+  limits:
+    cpu: 400m
+    memory: 200Mi
+```
+
+When you only want to set either requests or limits, you will have to set the other one explicitly to null to avoid the defaulting applied via the Kubernetes API, e.g. to disable the resource limits:
+
+```yaml
+resources:
+  requests:
+    cpu: 200m
+    memory: 100Mi
+  limits: null
+```
+
 ## Example
 
 ```yaml
@@ -57,6 +93,13 @@ spec:
   ttlSecondsAfterFinished: 60
   scopeLimiterAliases:
     domain: "{{attributes.host}}"
+  resources:
+    requests:
+      cpu: 42mi
+      memory: 256Mi
+    limits:
+      cpu: 4
+      memory: 4Gi
 ```
 
 The Parse definition is different when integrating a new scanner. We use specific conventions when adding new ParseDefinitions to the secureCodeBox repository.

diff --git a/docs/api/crds/scan-completion-hook.md b/docs/api/crds/scan-completion-hook.md
@@ -92,6 +92,42 @@ The service account should have at least `get` rights on `scans.execution.secure
 `ttlSecondsAfterFinished` can be used to automatically delete the completed Kubernetes job used to run the hook.
 This sets the `ttlSecondsAfterFinished` field on the created job. This requires your cluster to have the [TTLAfterFinished](https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) feature gate enabled in your cluster.
 
+### Resources (Optional)
+
+`resources` lets you overwrite the resource limits and requests for the hook container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+
+```yaml
+resources:
+  requests:
+    cpu: 42mi
+    memory: 256Mi
+  limits:
+    cpu: 4
+    memory: 4Gi
+```
+
+If no resources are set the following defaults are applied:
+
+```yaml
+resources:
+  requests:
+    cpu: 200m
+    memory: 100Mi
+  limits:
+    cpu: 400m
+    memory: 200Mi
+```
+
+When you only want to set either requests or limits, you will have to set the other one explicitly to null to avoid the defaulting applied via the Kubernetes API, e.g. to disable the resource limits:
+
+```yaml
+resources:
+  requests:
+    cpu: 200m
+    memory: 100Mi
+  limits: null
+```
+
 ## Example
 
 ```yaml
@@ -120,4 +156,11 @@ spec:
           key: password
           name: elastic-persistence-credentials
   ttlSecondsAfterFinished: 60
+  resources:
+    requests:
+      cpu: 42mi
+      memory: 256Mi
+    limits:
+      cpu: 4
+      memory: 4Gi
 ```
diff --git a/docs/api/crds/scan.md b/docs/api/crds/scan.md
@@ -326,6 +326,20 @@ The cascading scan hook, as well as any future core secureCodeBox features imple
 
 For more examples on how this field can be used, see the [Hook HowTo](/docs/how-tos/hooks).
 
+### Resources (Optional)
+
+`resources` lets you overwrite the resource limits and requests for the primary scanner container from the values defined in the [ScanType](./scan-type). See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+
+```yaml
+resources:
+  requests:
+    cpu: 42mi
+    memory: 256Mi
+  limits:
+    cpu: 4
+    memory: 4Gi
+```
+
 ## Metadata
 
 Metadata is a standard field on Kubernetes resources. It contains multiple relevant fields, e.g. the name of the resource, its namespace and a `creationTimestamp` of the resource. See more on the [Kubernetes Docs](https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/) and the [Kubernetes API Reference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#objectmeta-v1-meta).
@@ -389,4 +403,11 @@ spec:
         - key: "scope.cascading.securecodebox.io/domain"
           operator: "SubdomainOf"
           values: ["{{attributes.hostname}}"]
+  resources:
+    requests:
+      cpu: 42mi
+      memory: 256Mi
+    limits:
+      cpu: 4
+      memory: 4Gi
 ```