✨ add topologySpreadConstraints support to OIDC discovery provider (#925)

Add optional topologySpreadConstraints to the spiffe-oidc-discovery-provider Deployment, matching the pattern used by spire-server and the spike-* charts. Signed-off-by: Michael Munch <[email protected]> Co-authored-by: kfox1111 <[email protected]>
2026-08-19 16:30:25 -07:00
parent f1dddf2e85
commit 0726faa076
3 changed files with 8 additions and 0 deletions
@@ -102,6 +102,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | `nodeSelector`                                        | Node selector                                                                                                                                                                                                                          | `{}`                                                                             |
 | `tolerations`                                         | iist of tolerations                                                                                                                                                                                                                    | `[]`                                                                             |
 | `affinity`                                            | Node affinity                                                                                                                                                                                                                          | `{}`                                                                             |
+| `topologySpreadConstraints`                           | Topology spread constraints for resilience                                                                                                                                                                                             | `[]`                                                                             |
 | `trustDomain`                                         | Set the trust domain to be used for the SPIFFE identifiers                                                                                                                                                                             | `example.org`                                                                    |
 | `clusterDomain`                                       | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)                                                                                                                                                               | `cluster.local`                                                                  |
 | `telemetry.prometheus.enabled`                        | Flag to enable prometheus monitoring                                                                                                                                                                                                   | `false`                                                                          |
@@ -220,3 +220,7 @@ spec:
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
@@ -267,6 +267,9 @@ tolerations: []
 ## @param affinity [object] Node affinity
 affinity: {}

+## @param topologySpreadConstraints [array] Topology spread constraints for resilience
+topologySpreadConstraints: []
+
 ## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers
 trustDomain: example.org