fix: align GOMEMLIMIT with pod memory limits and force fresh image pulls

Go's GC doesn't respect cgroup memory limits on its own, risking OOMKill
under load; set GOMEMLIMIT to ~90% of each deployment's resources.limits.memory.
Also switch imagePullPolicy to Always so :latest tags aren't served stale
from node-local cache after a new push.

k8s/charts/management-service/templates/deployment.yaml

@@ -22,6 +22,9 @@ spec:
               containerPort: {{ .Values.grpcPort }}
             - name: http
               containerPort: {{ .Values.httpPort }}
+          env:
+            - name: GOMEMLIMIT
+              value: {{ .Values.goMemLimit | quote }}
           envFrom:
             - configMapRef:
                 name: management-service-config

k8s/charts/management-service/values.yaml

@@ -4,7 +4,7 @@ replicaCount: 2
 image:
   repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service
   tag: latest
-  pullPolicy: IfNotPresent
+  pullPolicy: Always
 
 grpcPort: 9090
 httpPort: 8080
@@ -23,6 +23,12 @@ resources:
     cpu: "1"
     memory: 512Mi
 
+# Go's GC only reacts to GOGC by default and has no idea about the cgroup
+# memory limit above -- it'll happily grow heap until the kernel OOMKills it.
+# Setting GOMEMLIMIT to ~90% of the container limit makes the GC self-throttle
+# before that happens. Keep this in sync with resources.limits.memory.
+goMemLimit: "460MiB"
+
 hpa:
   enabled: true
   minReplicas: 2

k8s/charts/queue-crd/templates/operator-deployment.yaml

@@ -23,5 +23,7 @@ spec:
               value: {{ .Values.kafkaBrokers | quote }}
             - name: KMSVC_REDIS_ADDR
               value: {{ .Values.redisAddr | quote }}
+            - name: GOMEMLIMIT
+              value: {{ .Values.goMemLimit | quote }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}

k8s/charts/queue-crd/values.yaml

@@ -3,7 +3,7 @@ namespace: sqs
 image:
   repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service-queue-operator
   tag: latest
-  pullPolicy: IfNotPresent
+  pullPolicy: Always
 
 kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
 redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
@@ -15,3 +15,6 @@ resources:
   limits:
     cpu: 500m
     memory: 256Mi
+
+# See management-service/values.yaml's goMemLimit comment -- same reasoning.
+goMemLimit: "230MiB"