> [!WARNING]
> **Warning:** Please proceed with caution, and test before using any customizations in production.

## Build Retention

You can control how many Kf Builds are kept before being garbage collected.

> [!NOTE]
> **Note:** This example sets the retention to 1 Build. Change the value as needed.

```
kubectl patch \
kfsystem kfsystem \
--type='json' \
-p="[{'op': 'replace', 'path': '/spec/kf/config/buildRetentionCount', 'value': 1}]"
```

## Enable or Disable the Istio Sidecar

If you do not require the Istio sidecar for the Build pods, then they can be disabled by setting the value to `true`. Enable by setting the value to `false`.

```
kubectl patch \
kfsystem kfsystem \
--type='json' \
-p="[{'op': 'replace', 'path': '/spec/kf/config/buildDisableIstioSidecar', 'value': true}]"
```

## Build Pod Resource Limits

The default pod resource size can be increased from the default to accommodate very large builds. The units for the value are in `Mi` or `Gi`.

> [!NOTE]
> **Note:** This is only applicable for built-in Tasks (which is normal for a `kf push` build). For V2 buildpack builds, this will be set on two steps and one for V3 buildpacks or Dockerfiles. This means that for a V2 build the required Pod size will be double the limit. For example, if the memory limit is 1Gi, then the pod will require 2Gi.

```
kubectl patch \
kfsystem kfsystem \
--type='json' \
-p="[{'op': 'replace', 'path': '/spec/kf/config/buildPodResources', 'value': {'limits': {'memory': '234Mi'}}}]"
```

Read [Kubernetes container resource docs](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for more information about container resource management.

## Self Signed Certificates for Service Brokers

If you want to use self signed certificates for TLS (`https` instead of `http`) for the service broker URL, the Kf controller requires the CA certificate. To configure Kf for this scenario, create an immutable Kubernetes secret in the `kf` namespace and update the `kfsystem.spec.kf.config.secrets.controllerCACerts.name` object to point to it.

1. Create a secret to store the self-signed certificate.

   > [!NOTE]
   > **Note:** Customize the secret name if desired, or leave the default name of `cacerts`. Replace `/path/to/cert/certs.pem` with the path to the self-signed certificate.

   ```
   kubectl create secret generic cacerts -nkf --from-file /path/to/cert/certs.pem
   ```
2. Make the secret immutable.

   ```
   kubectl patch -nkf secret cacerts \
     --type='json' \
     -p="[{'op':'add','path':'/immutable','value':true}]"
   ```
3. Update kfsystem to point to the secret.

   > [!NOTE]
   > **Note:** This will cause the controller pod to be re-deployed with the certs mounted as a volume.

   ```
   kubectl patch \
     kfsystem kfsystem \
     --type='json' \
     -p="[{'op':'add','path':'/spec/kf/config/secrets','value':{'controllerCACerts':{'name':'cacerts'}}}]"
   ```