From 0726faa07670dada923dfa23256a7bba6f4ca3f8 Mon Sep 17 00:00:00 2001 From: Michael Munch Date: Thu, 20 Aug 2026 01:30:25 +0200 Subject: [PATCH] :sparkles: add topologySpreadConstraints support to OIDC discovery provider (#925) Add optional topologySpreadConstraints to the spiffe-oidc-discovery-provider Deployment, matching the pattern used by spire-server and the spike-* charts. Signed-off-by: Michael Munch Co-authored-by: kfox1111 --- charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../spiffe-oidc-discovery-provider/templates/deployment.yaml | 4 ++++ .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 3 +++ 3 files changed, 8 insertions(+) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 9b764bc..be48a7e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -102,6 +102,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `nodeSelector` | Node selector | `{}` | | `tolerations` | iist of tolerations | `[]` | | `affinity` | Node affinity | `{}` | +| `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` | | `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` | | `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 044a3b7..7873ab2 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -220,3 +220,7 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} + {{- with .Values.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 7035bf6..48b3f73 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -267,6 +267,9 @@ tolerations: [] ## @param affinity [object] Node affinity affinity: {} +## @param topologySpreadConstraints [array] Topology spread constraints for resilience +topologySpreadConstraints: [] + ## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers trustDomain: example.org