diff --git a/apps/container-registry/registry-deployment.yaml b/apps/container-registry/registry-deployment.yaml
index 41589ee..90fbae7 100644
--- a/apps/container-registry/registry-deployment.yaml
+++ b/apps/container-registry/registry-deployment.yaml
@@ -59,6 +59,7 @@ spec:
               cpu: 50m
               memory: 64Mi
             limits:
+              cpu: 200m
               memory: 256Mi
           volumeMounts:
             - name: registry-vol
diff --git a/apps/demos-static/web-app.yaml b/apps/demos-static/web-app.yaml
index a6c7609..241a4a1 100644
--- a/apps/demos-static/web-app.yaml
+++ b/apps/demos-static/web-app.yaml
@@ -51,6 +51,7 @@ spec:
               cpu: 15m
               memory: 32Mi
             limits:
+              cpu: 100m
               memory: 128Mi
           volumeMounts:
             - name: nginx-cache
diff --git a/apps/n8n/web-app.yaml b/apps/n8n/web-app.yaml
index 85692cb..de209d3 100644
--- a/apps/n8n/web-app.yaml
+++ b/apps/n8n/web-app.yaml
@@ -90,6 +90,7 @@ spec:
               cpu: 100m
               memory: 384Mi
             limits:
+              cpu: 500m
               memory: 1Gi
           volumeMounts:
             - name: n8n-data
diff --git a/apps/website/web-app.yaml b/apps/website/web-app.yaml
index 6ad2a15..71e5b04 100644
--- a/apps/website/web-app.yaml
+++ b/apps/website/web-app.yaml
@@ -96,6 +96,7 @@ spec:
               cpu: 100m
               memory: 128Mi
             limits:
+              cpu: 400m
               memory: 384Mi
           volumeMounts:
             - name: apache-run
@@ -184,6 +185,7 @@ spec:
               cpu: 25m
               memory: 64Mi
             limits:
+              cpu: 200m
               memory: 160Mi
           securityContext:
             allowPrivilegeEscalation: false
diff --git a/bootstrap/cluster/main.tf b/bootstrap/cluster/main.tf
index 24146df..91228a1 100644
--- a/bootstrap/cluster/main.tf
+++ b/bootstrap/cluster/main.tf
@@ -411,6 +411,82 @@ EOT
   }
 }
 
+resource "null_resource" "kube_system_resource_policy" {
+  depends_on = [null_resource.kubeadm_control_plane]
+
+  triggers = {
+    kubeconfig_path         = var.kubeconfig_path
+    resource_policy_version = "1"
+  }
+
+  provisioner "local-exec" {
+    interpreter = ["/bin/bash", "-lc"]
+    command     = <<EOT
+set -euo pipefail
+
+patch_static_pod_resources() {
+  name="$1"
+  request_cpu="$2"
+  request_memory="$3"
+  limit_cpu="$4"
+  limit_memory="$5"
+  manifest="/etc/kubernetes/manifests/$${name}.yaml"
+
+  if ! sudo test -f "$manifest"; then
+    echo "Static pod manifest not found, skipping: $manifest"
+    return 0
+  fi
+
+  tmp="$(mktemp)"
+  sudo kubectl set resources -f "$manifest" --local -o yaml \
+    --requests="cpu=$${request_cpu},memory=$${request_memory}" \
+    --limits="cpu=$${limit_cpu},memory=$${limit_memory}" >"$tmp"
+  sudo install -m 0644 "$tmp" "$manifest"
+  rm -f "$tmp"
+}
+
+patch_cluster_workload_resources() {
+  namespace="$1"
+  target="$2"
+  container="$3"
+  request_cpu="$4"
+  request_memory="$5"
+  limit_cpu="$6"
+  limit_memory="$7"
+
+  for _ in $(seq 1 60); do
+    if kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "$namespace" get "$target" >/dev/null 2>&1; then
+      break
+    fi
+    sleep 5
+  done
+
+  kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "$namespace" get "$target" >/dev/null
+  kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "$namespace" set resources "$target" \
+    --containers="$container" \
+    --requests="cpu=$${request_cpu},memory=$${request_memory}" \
+    --limits="cpu=$${limit_cpu},memory=$${limit_memory}"
+}
+
+patch_static_pod_resources etcd 100m 256Mi 500m 1Gi
+patch_static_pod_resources kube-apiserver 100m 256Mi 500m 1Gi
+patch_static_pod_resources kube-controller-manager 50m 128Mi 250m 512Mi
+patch_static_pod_resources kube-scheduler 50m 128Mi 200m 256Mi
+
+for _ in $(seq 1 60); do
+  if kubectl --kubeconfig "${self.triggers.kubeconfig_path}" get --raw=/readyz >/dev/null 2>&1; then
+    break
+  fi
+  sleep 5
+done
+kubectl --kubeconfig "${self.triggers.kubeconfig_path}" get --raw=/readyz >/dev/null
+
+patch_cluster_workload_resources kube-system deployment/coredns coredns 50m 128Mi 200m 256Mi
+patch_cluster_workload_resources kube-system daemonset/kube-proxy kube-proxy 50m 64Mi 200m 256Mi
+EOT
+  }
+}
+
 resource "null_resource" "worker_nodes_required" {
   triggers = {
     worker_count = tostring(length(var.worker_nodes))
@@ -429,6 +505,7 @@ resource "null_resource" "kubeadm_worker" {
 
   depends_on = [
     null_resource.kubeadm_control_plane,
+    null_resource.kube_system_resource_policy,
     null_resource.worker_nodes_required,
   ]
 
diff --git a/bootstrap/platform/main.tf b/bootstrap/platform/main.tf
index 93288ed..1c49611 100644
--- a/bootstrap/platform/main.tf
+++ b/bootstrap/platform/main.tf
@@ -332,6 +332,16 @@ resource "helm_release" "calico" {
         "kubernetes.io/os"       = "linux"
         "kubernetes.io/hostname" = var.calico_operator_node_name
       }
+      resources = {
+        requests = {
+          cpu    = "50m"
+          memory = "128Mi"
+        }
+        limits = {
+          cpu    = "200m"
+          memory = "256Mi"
+        }
+      }
       apiServer = {
         enabled = false
       }
@@ -343,6 +353,52 @@ resource "helm_release" "calico" {
       }
       installation = {
         controlPlaneReplicas = 1
+        calicoKubeControllersDeployment = {
+          spec = {
+            template = {
+              spec = {
+                containers = [
+                  {
+                    name = "calico-kube-controllers"
+                    resources = {
+                      requests = {
+                        cpu    = "50m"
+                        memory = "128Mi"
+                      }
+                      limits = {
+                        cpu    = "200m"
+                        memory = "256Mi"
+                      }
+                    }
+                  },
+                ]
+              }
+            }
+          }
+        }
+        calicoNodeDaemonSet = {
+          spec = {
+            template = {
+              spec = {
+                containers = [
+                  {
+                    name = "calico-node"
+                    resources = {
+                      requests = {
+                        cpu    = "50m"
+                        memory = "128Mi"
+                      }
+                      limits = {
+                        cpu    = "200m"
+                        memory = "256Mi"
+                      }
+                    }
+                  },
+                ]
+              }
+            }
+          }
+        }
         cni = {
           type = "Calico"
         }
@@ -359,6 +415,29 @@ resource "helm_release" "calico" {
             }
           ]
         }
+        typhaDeployment = {
+          spec = {
+            template = {
+              spec = {
+                containers = [
+                  {
+                    name = "calico-typha"
+                    resources = {
+                      requests = {
+                        cpu    = "50m"
+                        memory = "128Mi"
+                      }
+                      limits = {
+                        cpu    = "200m"
+                        memory = "256Mi"
+                      }
+                    }
+                  },
+                ]
+              }
+            }
+          }
+        }
       }
     })
   ]
@@ -450,6 +529,7 @@ resource "helm_release" "metrics_server" {
           memory = "128Mi"
         }
         limits = {
+          cpu    = "200m"
           memory = "256Mi"
         }
       }
@@ -793,9 +873,33 @@ resource "helm_release" "metallb" {
 
   values = [
     yamlencode({
+      controller = {
+        resources = {
+          requests = {
+            cpu    = "50m"
+            memory = "128Mi"
+          }
+          limits = {
+            cpu    = "200m"
+            memory = "256Mi"
+          }
+        }
+      }
       frrk8s = {
         enabled = false
       }
+      speaker = {
+        resources = {
+          requests = {
+            cpu    = "50m"
+            memory = "128Mi"
+          }
+          limits = {
+            cpu    = "200m"
+            memory = "256Mi"
+          }
+        }
+      }
     })
   ]
 }
@@ -894,6 +998,7 @@ resource "helm_release" "traefik" {
           memory = "96Mi"
         }
         limits = {
+          cpu    = "200m"
           memory = "256Mi"
         }
       }
@@ -913,6 +1018,20 @@ resource "helm_release" "openebs" {
 
   values = [
     yamlencode({
+      "localpv-provisioner" = {
+        localpv = {
+          resources = {
+            requests = {
+              cpu    = "50m"
+              memory = "128Mi"
+            }
+            limits = {
+              cpu    = "200m"
+              memory = "256Mi"
+            }
+          }
+        }
+      }
       engines = {
         local = {
           lvm = {
@@ -989,36 +1108,106 @@ resource "helm_release" "argocd" {
         nodeSelector              = local.argocd_node_selector
         affinity                  = local.argocd_component_affinity.application_set
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.application_set
+        resources = {
+          requests = {
+            cpu    = "100m"
+            memory = "256Mi"
+          }
+          limits = {
+            cpu    = "300m"
+            memory = "512Mi"
+          }
+        }
       }
       controller = {
         nodeSelector              = local.argocd_node_selector
         affinity                  = local.argocd_component_affinity.controller
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.controller
+        resources = {
+          requests = {
+            cpu    = "100m"
+            memory = "256Mi"
+          }
+          limits = {
+            cpu    = "300m"
+            memory = "512Mi"
+          }
+        }
       }
       dex = {
         nodeSelector              = local.argocd_node_selector
         affinity                  = local.argocd_component_affinity.dex
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.dex
+        resources = {
+          requests = {
+            cpu    = "100m"
+            memory = "256Mi"
+          }
+          limits = {
+            cpu    = "300m"
+            memory = "512Mi"
+          }
+        }
       }
       notifications = {
         nodeSelector              = local.argocd_node_selector
         affinity                  = local.argocd_component_affinity.notifications
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.notifications
+        resources = {
+          requests = {
+            cpu    = "100m"
+            memory = "256Mi"
+          }
+          limits = {
+            cpu    = "300m"
+            memory = "512Mi"
+          }
+        }
       }
       redis = {
         nodeSelector              = local.argocd_node_selector
         affinity                  = local.argocd_component_affinity.redis
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.redis
+        resources = {
+          requests = {
+            cpu    = "100m"
+            memory = "256Mi"
+          }
+          limits = {
+            cpu    = "300m"
+            memory = "512Mi"
+          }
+        }
       }
       repoServer = {
         nodeSelector              = local.argocd_node_selector
         affinity                  = local.argocd_component_affinity.repo_server
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.repo_server
+        resources = {
+          requests = {
+            cpu    = "100m"
+            memory = "256Mi"
+          }
+          limits = {
+            cpu    = "300m"
+            memory = "512Mi"
+          }
+        }
       }
       server = {
         nodeSelector              = local.argocd_node_selector
         affinity                  = local.argocd_component_affinity.server
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.server
+        resources = {
+          requests = {
+            cpu    = "100m"
+            memory = "256Mi"
+          }
+          limits = {
+            cpu    = "300m"
+            memory = "512Mi"
+          }
+        }
       }
     })
   ]
@@ -1162,6 +1351,7 @@ resource "helm_release" "kyverno" {
             memory = "128Mi"
           }
           limits = {
+            cpu    = "200m"
             memory = "384Mi"
           }
         }
@@ -1177,6 +1367,7 @@ resource "helm_release" "kyverno" {
             memory = "96Mi"
           }
           limits = {
+            cpu    = "100m"
             memory = "256Mi"
           }
         }
@@ -1192,6 +1383,7 @@ resource "helm_release" "kyverno" {
             memory = "64Mi"
           }
           limits = {
+            cpu    = "50m"
             memory = "192Mi"
           }
         }
@@ -1207,6 +1399,7 @@ resource "helm_release" "kyverno" {
             memory = "96Mi"
           }
           limits = {
+            cpu    = "100m"
             memory = "256Mi"
           }
         }
@@ -1302,10 +1495,23 @@ resource "helm_release" "loki" {
             memory = "256Mi"
           }
           limits = {
+            cpu    = "500m"
             memory = "768Mi"
           }
         }
       }
+      sidecar = {
+        resources = {
+          requests = {
+            cpu    = "25m"
+            memory = "64Mi"
+          }
+          limits = {
+            cpu    = "100m"
+            memory = "128Mi"
+          }
+        }
+      }
       read = {
         replicas = 0
       }
@@ -1473,6 +1679,7 @@ resource "helm_release" "promtail" {
           memory = "64Mi"
         }
         limits = {
+          cpu    = "100m"
           memory = "128Mi"
         }
       }
@@ -1521,13 +1728,36 @@ resource "helm_release" "prometheus_stack" {
             memory = "128Mi"
           }
           limits = {
+            cpu    = "200m"
             memory = "384Mi"
           }
         }
+        prometheusConfigReloader = {
+          resources = {
+            requests = {
+              cpu    = "25m"
+              memory = "64Mi"
+            }
+            limits = {
+              cpu    = "100m"
+              memory = "128Mi"
+            }
+          }
+        }
       }
       alertmanager = {
         alertmanagerSpec = {
           nodeSelector = local.prometheus_stack_node_selector
+          resources = {
+            requests = {
+              cpu    = "50m"
+              memory = "128Mi"
+            }
+            limits = {
+              cpu    = "200m"
+              memory = "256Mi"
+            }
+          }
           storage = {
             volumeClaimTemplate = {
               spec = {
@@ -1553,6 +1783,7 @@ resource "helm_release" "prometheus_stack" {
               memory = "512Mi"
             }
             limits = {
+              cpu    = "500m"
               memory = "1Gi"
             }
           }
@@ -1579,6 +1810,16 @@ resource "helm_release" "prometheus_stack" {
       grafana = {
         nodeSelector = local.prometheus_stack_node_selector
         sidecar = {
+          resources = {
+            requests = {
+              cpu    = "25m"
+              memory = "64Mi"
+            }
+            limits = {
+              cpu    = "100m"
+              memory = "128Mi"
+            }
+          }
           dashboards = {
             enabled          = true
             label            = "grafana_dashboard"
@@ -1620,6 +1861,7 @@ resource "helm_release" "prometheus_stack" {
             memory = "128Mi"
           }
           limits = {
+            cpu    = "200m"
             memory = "384Mi"
           }
         }
@@ -1628,6 +1870,28 @@ resource "helm_release" "prometheus_stack" {
         affinity                  = local.kube_state_metrics_affinity
         nodeSelector              = local.prometheus_stack_node_selector
         topologySpreadConstraints = local.kube_state_metrics_topology_spread_constraints
+        resources = {
+          requests = {
+            cpu    = "50m"
+            memory = "128Mi"
+          }
+          limits = {
+            cpu    = "200m"
+            memory = "256Mi"
+          }
+        }
+      }
+      "prometheus-node-exporter" = {
+        resources = {
+          requests = {
+            cpu    = "25m"
+            memory = "64Mi"
+          }
+          limits = {
+            cpu    = "100m"
+            memory = "128Mi"
+          }
+        }
       }
     })
   ]
diff --git a/bootstrap/platform/variables.tf b/bootstrap/platform/variables.tf
index 283208a..2861b2d 100644
--- a/bootstrap/platform/variables.tf
+++ b/bootstrap/platform/variables.tf
@@ -287,7 +287,16 @@ variable "extra_helm_releases" {
               cpu: 100m
               memory: 128Mi
             limits:
+              cpu: 500m
               memory: 512Mi
+        export:
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
       EOT
       set_values       = {}
     }