when resource quota is defined in a project (best practice for tenant-owned namespaces) all the pods/containers deployed in the namespace need to define the resource they need.
Fro example with this very large quota:

 kind: ResourceQuota
 apiVersion: v1
 metadata:
  name: example
  namespace: rs-sm
 spec:
  hard:
   requests.cpu: '200'
   requests.memory: 1000Gi

all the pods need to specify `request.[cpu,memory]`.

When deploying the service mesh control plane there doesn't seem to be a way to specify resources for all the containers.
In particular we found that the `oauth-proxy` container for Prometheus and Grafana do not get that setting (but we might have missed some). See the attached ServiceMeshControlPlane object that we used.