fix(shield): drop the default CPU limit on the host shield

charts/shield/Chart.yaml

@@ -13,5 +13,5 @@ maintainers:
   - name: mavimo
     email: marcovito.moscaritolo@sysdig.com
 type: application
-version: 1.49.3
+version: 1.50.0
 appVersion: "1.0.0"

charts/shield/tests/host/daemonset_test.yaml

@@ -1057,3 +1057,31 @@ tests:
             mountPath: /opt/draios/etc/local_forwarder_config.yaml
             subPath: local_forwarder_config.yaml
         template: host/daemonset.yaml
+
+  - it: No CPU limit on the host shield by default
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name == "sysdig-host-shield")].resources
+          value:
+            limits:
+              memory: 1Gi
+            requests:
+              cpu: 250m
+              memory: 384Mi
+        template: host/daemonset.yaml
+      - notExists:
+          path: spec.template.spec.containers[?(@.name == "sysdig-host-shield")].resources.limits.cpu
+        template: host/daemonset.yaml
+
+  - it: CPU limit is applied when explicitly set
+    set:
+      host:
+        resources:
+          shield:
+            limits:
+              cpu: 4000m
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[?(@.name == "sysdig-host-shield")].resources.limits.cpu
+          value: 4000m
+        template: host/daemonset.yaml

charts/shield/values.yaml

@@ -360,9 +360,14 @@ host:
         # The memory request for the kmodule
         memory: 384Mi
     shield:
+      # No CPU limit is set by default. The host shield sits in the syscall path and drains one
+      # ring buffer per CPU, so its work scales with the node's vCPU count and with container
+      # churn. A fixed CPU limit throttles the drain without reducing the per-syscall cost that
+      # is charged to the calling container, and on large or high-churn nodes the resulting
+      # event drops and container-runtime query backlog can degrade the node as a whole.
+      # Set a CPU limit only if your policy requires one, and size it to the node rather than
+      # to a flat value: `host.resources.shield.limits.cpu: 4000m`.
       limits:
-        # The CPU limit for the host shield
-        cpu: 1000m
         # The memory limit for the host shield
         memory: 1Gi
       requests: