fix(ory): re-enable hydra-maester, fix namespace, add memory limit

base/ory/hydra-values.yaml

@@ -2,11 +2,6 @@
 # DOMAIN_SUFFIX is replaced by overlay patches.
 # DSN and system secrets come from the overlay-specific Secret.
 
-# Disable the maester controller — it manages OAuth2Client CRDs which we don't use locally.
-# OAuth2 clients are registered directly via the Hydra admin API.
-maester:
-  enabled: false
-
 hydra:
   config:
     dsn: "postgresql://hydra:$(HYDRA_DB_PASSWORD)@postgres-rw.data.svc.cluster.local:5432/hydra_db"

base/ory/kustomization.yaml

@@ -7,6 +7,16 @@ resources:
   - namespace.yaml
   - login-ui-deployment.yaml
 
+# The hydra-maester sub-chart does not set .Release.Namespace in its Deployment template.
+patches:
+  - patch: |
+      - op: add
+        path: /metadata/namespace
+        value: ory
+    target:
+      kind: Deployment
+      name: hydra-hydra-maester
+
 helmCharts:
   # helm repo add ory https://k8s.ory.sh/helm/charts
   - name: kratos

overlays/local/values-resources.yaml

@@ -93,6 +93,21 @@ spec:
             limits:
               memory: 256Mi
 
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hydra-hydra-maester
+  namespace: ory
+spec:
+  template:
+    spec:
+      containers:
+        - name: hydra-maester
+          resources:
+            limits:
+              memory: 64Mi
+
 ---
 apiVersion: apps/v1
 kind: Deployment