panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Parametrize probes (#310)

Browse Source 
This PR addresses #307 by parametrizing Probes and moving them to
values.yaml

---------

Signed-off-by: Mariusz Sabath <[email protected]>
This commit is contained in:
Mariusz Sabath
2023-05-25 08:53:44 -04:00
committed by GitHub
parent efdeb2e123
commit 1247b68f4d
15 changed files with 111 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+23 -2
View File
@@ -131,6 +131,8 @@ Now you can interact with the Spire agent socket from your own application. The
| spiffe-csi-driver.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| spiffe-csi-driver.imagePullSecrets | list | `[]` | |
| spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` | |
| spiffe-csi-driver.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
| spiffe-csi-driver.livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe |
| spiffe-csi-driver.nameOverride | string | `""` | |
| spiffe-csi-driver.namespaceOverride | string | `""` | |
| spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
@@ -187,11 +189,15 @@ Now you can interact with the Spire agent socket from your own application. The
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| spiffe-oidc-discovery-provider.insecureScheme.nginx.resources | object | `{}` | |
| spiffe-oidc-discovery-provider.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
| spiffe-oidc-discovery-provider.livenessProbe.periodSeconds | int | `5` | Period seconds for livenessProbe |
| spiffe-oidc-discovery-provider.nameOverride | string | `""` | |
| spiffe-oidc-discovery-provider.namespaceOverride | string | `""` | |
| spiffe-oidc-discovery-provider.nodeSelector | object | `{}` | |
| spiffe-oidc-discovery-provider.podAnnotations | object | `{}` | |
| spiffe-oidc-discovery-provider.podSecurityContext | object | `{}` | |
| spiffe-oidc-discovery-provider.readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
| spiffe-oidc-discovery-provider.readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
| spiffe-oidc-discovery-provider.replicaCount | int | `1` | |
| spiffe-oidc-discovery-provider.resources | object | `{}` | |
| spiffe-oidc-discovery-provider.securityContext | object | `{}` | |
@@ -229,6 +235,8 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-agent.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| spire-agent.imagePullSecrets | list | `[]` | |
| spire-agent.initContainers | list | `[]` | |
| spire-agent.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
| spire-agent.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
| spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| spire-agent.nameOverride | string | `""` | |
| spire-agent.namespaceOverride | string | `""` | |
@@ -236,6 +244,8 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-agent.podAnnotations | object | `{}` | |
| spire-agent.podSecurityContext | object | `{}` | |
| spire-agent.priorityClassName | string | `""` | Priority class assigned to daemonset pods |
| spire-agent.readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe |
| spire-agent.readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe |
| spire-agent.resources | object | `{}` | |
| spire-agent.securityContext | object | `{}` | |
| spire-agent.server.address | string | `""` | |
@@ -340,6 +350,10 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-server.ingress.tls | list | `[]` | |
| spire-server.initContainers | list | `[]` | |
| spire-server.jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
| spire-server.livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
| spire-server.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
| spire-server.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
| spire-server.livenessProbe.timeoutSeconds | int | `3` | Timeout in seconds for livenessProbe |
| spire-server.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| spire-server.nameOverride | string | `""` | |
| spire-server.namespaceOverride | string | `""` | |
@@ -352,6 +366,8 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-server.persistence.storageClass | string | `nil` | |
| spire-server.podAnnotations | object | `{}` | |
| spire-server.podSecurityContext | object | `{}` | |
| spire-server.readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
| spire-server.readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
| spire-server.replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
| spire-server.resources | object | `{}` | |
| spire-server.securityContext | object | `{}` | |
@@ -378,6 +394,11 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-server.tornjak.service.annotations | object | `{}` | |
| spire-server.tornjak.service.port | int | `10000` | |
| spire-server.tornjak.service.type | string | `"ClusterIP"` | |
| spire-server.tornjak.startupProbe.failureThreshold | int | `3` | |
| spire-server.tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for |
| spire-server.tornjak.startupProbe.periodSeconds | int | `10` | |
| spire-server.tornjak.startupProbe.successThreshold | int | `1` | |
| spire-server.tornjak.startupProbe.timeoutSeconds | int | `5` | |
| spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
| spire-server.upstreamAuthority.certManager.enabled | bool | `false` | |
| spire-server.upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | |
@@ -416,10 +437,10 @@ Now you can interact with the Spire agent socket from your own application. The
| tornjak-frontend.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| tornjak-frontend.spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator |
| tornjak-frontend.startupProbe.enabled | bool | `true` | Enable startupProbe on Tornjak frontend container |
| tornjak-frontend.startupProbe.failureThreshold | int | `6` | Failure threshold for startupProbe |
| tornjak-frontend.startupProbe.failureThreshold | int | `6` | Failure threshold count for startupProbe |
| tornjak-frontend.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for startupProbe |
| tornjak-frontend.startupProbe.periodSeconds | int | `10` | Period seconds for startupProbe |
| tornjak-frontend.startupProbe.successThreshold | int | `1` | Success threshold for startupProbe |
| tornjak-frontend.startupProbe.successThreshold | int | `1` | Success threshold count for startupProbe |
| tornjak-frontend.startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe |
| tornjak-frontend.tolerations | list | `[]` | |
| tornjak-frontend.topologySpreadConstraints | list | `[]` | |
charts/spire/charts/spiffe-csi-driver/README.md
+2
View File
@@ -23,6 +23,8 @@ A Helm chart to install the SPIFFE CSI driver.
| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| imagePullSecrets | list | `[]` | |
| kubeletPath | string | `"/var/lib/kubelet"` | |
| livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
| livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe |
| nameOverride | string | `""` | |
| namespaceOverride | string | `""` | |
| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+1 -2
View File
@@ -93,8 +93,7 @@ spec:
httpGet:
path: /healthz
port: healthz
initialDelaySeconds: 5
timeoutSeconds: 5
{{- toYaml .Values.livenessProbe | nindent 12 }}
resources:
{{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }}
volumes:
charts/spire/charts/spiffe-csi-driver/values.yaml
+6
View File
@@ -27,6 +27,12 @@ resources: {}
healthChecks:
port: 9809
livenessProbe:
# -- Initial delay seconds for livenessProbe
initialDelaySeconds: 5
# -- Timeout value in seconds for livenessProbe
timeoutSeconds: 5
imagePullSecrets: []
nameOverride: ""
namespaceOverride: ""
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+4
View File
@@ -51,11 +51,15 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag |
| insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| insecureScheme.nginx.resources | object | `{}` | |
| livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
| livenessProbe.periodSeconds | int | `5` | Period seconds for livenessProbe |
| nameOverride | string | `""` | |
| namespaceOverride | string | `""` | |
| nodeSelector | object | `{}` | |
| podAnnotations | object | `{}` | |
| podSecurityContext | object | `{}` | |
| readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
| readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
| replicaCount | int | `1` | |
| resources | object | `{}` | |
| securityContext | object | `{}` | |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
+2 -4
View File
@@ -61,14 +61,12 @@ spec:
httpGet:
path: /ready
port: healthz
initialDelaySeconds: 5
periodSeconds: 5
{{- toYaml .Values.readinessProbe | nindent 12 }}
livenessProbe:
httpGet:
path: /live
port: healthz
initialDelaySeconds: 5
periodSeconds: 5
{{- toYaml .Values.livenessProbe | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- if .Values.insecureScheme.enabled }}
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+12
View File
@@ -54,6 +54,18 @@ securityContext: {}
# runAsNonRoot: true
# runAsUser: 1000
readinessProbe:
# -- Initial delay seconds for readinessProbe
initialDelaySeconds: 5
# -- Period seconds for readinessProbe
periodSeconds: 5
livenessProbe:
# -- Initial delay seconds for livenessProbe
initialDelaySeconds: 5
# -- Period seconds for livenessProbe
periodSeconds: 5
podAnnotations: {}
insecureScheme:
charts/spire/charts/spire-agent/README.md
+4
View File
@@ -29,6 +29,8 @@ A Helm chart to install the SPIRE agent.
| image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| imagePullSecrets | list | `[]` | |
| initContainers | list | `[]` | |
| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| nameOverride | string | `""` | |
| namespaceOverride | string | `""` | |
@@ -36,6 +38,8 @@ A Helm chart to install the SPIRE agent.
| podAnnotations | object | `{}` | |
| podSecurityContext | object | `{}` | |
| priorityClassName | string | `""` | Priority class assigned to daemonset pods |
| readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe |
| readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe |
| resources | object | `{}` | |
| securityContext | object | `{}` | |
| server.address | string | `""` | |
charts/spire/charts/spire-agent/templates/daemonset.yaml
+2 -4
View File
@@ -79,14 +79,12 @@ spec:
httpGet:
path: /live
port: healthz
initialDelaySeconds: 15
periodSeconds: 60
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
httpGet:
path: /ready
port: healthz
initialDelaySeconds: 15
periodSeconds: 60
{{- toYaml .Values.readinessProbe | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- if gt (len .Values.extraContainers) 0 }}
charts/spire/charts/spire-agent/values.yaml
+12
View File
@@ -80,6 +80,18 @@ healthChecks:
# -- override the host port used for health checking
port: 9980
livenessProbe:
# -- Initial delay seconds for livenessProbe
initialDelaySeconds: 15
# -- Period seconds for livenessProbe
periodSeconds: 60
readinessProbe:
# -- Initial delay seconds for readinessProbe
initialDelaySeconds: 15
# -- Period seconds for readinessProbe
periodSeconds: 60
waitForIt:
image:
# -- The OCI registry to pull the image from
charts/spire/charts/spire-server/README.md
+11
View File
@@ -96,6 +96,10 @@ A Helm chart to install the SPIRE server.
| ingress.tls | list | `[]` | |
| initContainers | list | `[]` | |
| jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
| livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
| livenessProbe.timeoutSeconds | int | `3` | Timeout in seconds for livenessProbe |
| logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
| nameOverride | string | `""` | |
| namespaceOverride | string | `""` | |
@@ -108,6 +112,8 @@ A Helm chart to install the SPIRE server.
| persistence.storageClass | string | `nil` | |
| podAnnotations | object | `{}` | |
| podSecurityContext | object | `{}` | |
| readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
| readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
| resources | object | `{}` | |
| securityContext | object | `{}` | |
@@ -134,6 +140,11 @@ A Helm chart to install the SPIRE server.
| tornjak.service.annotations | object | `{}` | |
| tornjak.service.port | int | `10000` | |
| tornjak.service.type | string | `"ClusterIP"` | |
| tornjak.startupProbe.failureThreshold | int | `3` | |
| tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for |
| tornjak.startupProbe.periodSeconds | int | `10` | |
| tornjak.startupProbe.successThreshold | int | `1` | |
| tornjak.startupProbe.timeoutSeconds | int | `5` | |
| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
| upstreamAuthority.certManager.enabled | bool | `false` | |
| upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` | |
charts/spire/charts/spire-server/templates/statefulset.yaml
+3 -11
View File
@@ -87,16 +87,12 @@ spec:
httpGet:
path: /live
port: healthz
failureThreshold: 2
initialDelaySeconds: 15
periodSeconds: 60
timeoutSeconds: 3
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
httpGet:
path: /ready
port: healthz
initialDelaySeconds: 5
periodSeconds: 5
{{- toYaml .Values.readinessProbe | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
volumeMounts:
@@ -168,11 +164,7 @@ spec:
httpGet:
scheme: HTTP
port: 10000
failureThreshold: 3
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
{{- toYaml .Values.tornjak.startupProbe | nindent 12 }}
args:
- --spire-config
- /run/spire/config/server.conf
charts/spire/charts/spire-server/values.yaml
+25
View File
@@ -81,6 +81,22 @@ affinity: {}
topologySpreadConstraints: []
livenessProbe:
# -- Failure threshold count for livenessProbe
failureThreshold: 2
# -- Initial delay seconds for livenessProbe
initialDelaySeconds: 15
# -- Period seconds for livenessProbe
periodSeconds: 60
# -- Timeout in seconds for livenessProbe
timeoutSeconds: 3
readinessProbe:
# -- Initial delay seconds for readinessProbe
initialDelaySeconds: 5
# -- Period seconds for readinessProbe
periodSeconds: 5
persistence:
size: 1Gi
accessMode: ReadWriteOnce
@@ -326,6 +342,15 @@ tornjak:
type: ClusterIP
port: 10000
annotations: {}
startupProbe:
failureThreshold: 3
# -- Initial delay seconds for
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
config:
# -- persistent DB for storing Tornjak specific information
dataStore:
charts/spire/charts/tornjak-frontend/README.md
+2 -2
View File
@@ -72,10 +72,10 @@ port forwarding. See the chart NOTES output for more details.
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
| spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator |
| startupProbe.enabled | bool | `true` | Enable startupProbe on Tornjak frontend container |
| startupProbe.failureThreshold | int | `6` | Failure threshold for startupProbe |
| startupProbe.failureThreshold | int | `6` | Failure threshold count for startupProbe |
| startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for startupProbe |
| startupProbe.periodSeconds | int | `10` | Period seconds for startupProbe |
| startupProbe.successThreshold | int | `1` | Success threshold for startupProbe |
| startupProbe.successThreshold | int | `1` | Success threshold count for startupProbe |
| startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe |
| tolerations | list | `[]` | |
| topologySpreadConstraints | list | `[]` | |
charts/spire/charts/tornjak-frontend/values.yaml
+2 -2
View File
@@ -84,7 +84,7 @@ startupProbe:
periodSeconds: 10
# -- Timeout seconds for startupProbe
timeoutSeconds: 5
# -- Failure threshold for startupProbe
# -- Failure threshold count for startupProbe
failureThreshold: 6
# -- Success threshold for startupProbe
# -- Success threshold count for startupProbe
successThreshold: 1