Parametrize probes (#310)

This PR addresses #307 by parametrizing Probes and moving them to
values.yaml

---------

Signed-off-by: Mariusz Sabath <[email protected]>

charts/spire/README.md

@@ -131,6 +131,8 @@ Now you can interact with the Spire agent socket from your own application. The
 | spiffe-csi-driver.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spiffe-csi-driver.imagePullSecrets | list | `[]` |  |
 | spiffe-csi-driver.kubeletPath | string | `"/var/lib/kubelet"` |  |
+| spiffe-csi-driver.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
+| spiffe-csi-driver.livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe |
 | spiffe-csi-driver.nameOverride | string | `""` |  |
 | spiffe-csi-driver.namespaceOverride | string | `""` |  |
 | spiffe-csi-driver.nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
@@ -187,11 +189,15 @@ Now you can interact with the Spire agent socket from your own application. The
 | spiffe-oidc-discovery-provider.insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag |
 | spiffe-oidc-discovery-provider.insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spiffe-oidc-discovery-provider.insecureScheme.nginx.resources | object | `{}` |  |
+| spiffe-oidc-discovery-provider.livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
+| spiffe-oidc-discovery-provider.livenessProbe.periodSeconds | int | `5` | Period seconds for livenessProbe |
 | spiffe-oidc-discovery-provider.nameOverride | string | `""` |  |
 | spiffe-oidc-discovery-provider.namespaceOverride | string | `""` |  |
 | spiffe-oidc-discovery-provider.nodeSelector | object | `{}` |  |
 | spiffe-oidc-discovery-provider.podAnnotations | object | `{}` |  |
 | spiffe-oidc-discovery-provider.podSecurityContext | object | `{}` |  |
+| spiffe-oidc-discovery-provider.readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
+| spiffe-oidc-discovery-provider.readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
 | spiffe-oidc-discovery-provider.replicaCount | int | `1` |  |
 | spiffe-oidc-discovery-provider.resources | object | `{}` |  |
 | spiffe-oidc-discovery-provider.securityContext | object | `{}` |  |
@@ -229,6 +235,8 @@ Now you can interact with the Spire agent socket from your own application. The
 | spire-agent.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | spire-agent.imagePullSecrets | list | `[]` |  |
 | spire-agent.initContainers | list | `[]` |  |
+| spire-agent.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
+| spire-agent.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
 | spire-agent.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
 | spire-agent.nameOverride | string | `""` |  |
 | spire-agent.namespaceOverride | string | `""` |  |
@@ -236,6 +244,8 @@ Now you can interact with the Spire agent socket from your own application. The
 | spire-agent.podAnnotations | object | `{}` |  |
 | spire-agent.podSecurityContext | object | `{}` |  |
 | spire-agent.priorityClassName | string | `""` | Priority class assigned to daemonset pods |
+| spire-agent.readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe |
+| spire-agent.readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe |
 | spire-agent.resources | object | `{}` |  |
 | spire-agent.securityContext | object | `{}` |  |
 | spire-agent.server.address | string | `""` |  |
@@ -340,6 +350,10 @@ Now you can interact with the Spire agent socket from your own application. The
 | spire-server.ingress.tls | list | `[]` |  |
 | spire-server.initContainers | list | `[]` |  |
 | spire-server.jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
+| spire-server.livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
+| spire-server.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
+| spire-server.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
+| spire-server.livenessProbe.timeoutSeconds | int | `3` | Timeout in seconds for livenessProbe |
 | spire-server.logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
 | spire-server.nameOverride | string | `""` |  |
 | spire-server.namespaceOverride | string | `""` |  |
@@ -352,6 +366,8 @@ Now you can interact with the Spire agent socket from your own application. The
 | spire-server.persistence.storageClass | string | `nil` |  |
 | spire-server.podAnnotations | object | `{}` |  |
 | spire-server.podSecurityContext | object | `{}` |  |
+| spire-server.readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
+| spire-server.readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
 | spire-server.replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
 | spire-server.resources | object | `{}` |  |
 | spire-server.securityContext | object | `{}` |  |
@@ -378,6 +394,11 @@ Now you can interact with the Spire agent socket from your own application. The
 | spire-server.tornjak.service.annotations | object | `{}` |  |
 | spire-server.tornjak.service.port | int | `10000` |  |
 | spire-server.tornjak.service.type | string | `"ClusterIP"` |  |
+| spire-server.tornjak.startupProbe.failureThreshold | int | `3` |  |
+| spire-server.tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for |
+| spire-server.tornjak.startupProbe.periodSeconds | int | `10` |  |
+| spire-server.tornjak.startupProbe.successThreshold | int | `1` |  |
+| spire-server.tornjak.startupProbe.timeoutSeconds | int | `5` |  |
 | spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
 | spire-server.upstreamAuthority.certManager.enabled | bool | `false` |  |
 | spire-server.upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
@@ -416,10 +437,10 @@ Now you can interact with the Spire agent socket from your own application. The
 | tornjak-frontend.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
 | tornjak-frontend.spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator |
 | tornjak-frontend.startupProbe.enabled | bool | `true` | Enable startupProbe on Tornjak frontend container |
-| tornjak-frontend.startupProbe.failureThreshold | int | `6` | Failure threshold for startupProbe |
+| tornjak-frontend.startupProbe.failureThreshold | int | `6` | Failure threshold count for startupProbe |
 | tornjak-frontend.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for startupProbe |
 | tornjak-frontend.startupProbe.periodSeconds | int | `10` | Period seconds for startupProbe |
-| tornjak-frontend.startupProbe.successThreshold | int | `1` | Success threshold for startupProbe |
+| tornjak-frontend.startupProbe.successThreshold | int | `1` | Success threshold count for startupProbe |
 | tornjak-frontend.startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe |
 | tornjak-frontend.tolerations | list | `[]` |  |
 | tornjak-frontend.topologySpreadConstraints | list | `[]` |  |

charts/spire/charts/spiffe-csi-driver/README.md

@@ -23,6 +23,8 @@ A Helm chart to install the SPIFFE CSI driver.
 | image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | imagePullSecrets | list | `[]` |  |
 | kubeletPath | string | `"/var/lib/kubelet"` |  |
+| livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
+| livenessProbe.timeoutSeconds | int | `5` | Timeout value in seconds for livenessProbe |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
 | nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |

charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml

@@ -93,8 +93,7 @@ spec:
             httpGet:
               path: /healthz
               port: healthz
-            initialDelaySeconds: 5
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
-            timeoutSeconds: 5
           resources:
             {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }}
       volumes:

charts/spire/charts/spiffe-csi-driver/values.yaml

@@ -27,6 +27,12 @@ resources: {}
 healthChecks:
   port: 9809
 
+livenessProbe:
+  # -- Initial delay seconds for livenessProbe
+  initialDelaySeconds: 5
+  # -- Timeout value in seconds for livenessProbe
+  timeoutSeconds: 5
+
 imagePullSecrets: []
 nameOverride: ""
 namespaceOverride: ""

charts/spire/charts/spiffe-oidc-discovery-provider/README.md

@@ -51,11 +51,15 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | insecureScheme.nginx.image.tag | string | `"1.24.0-alpine"` | Overrides the image tag |
 | insecureScheme.nginx.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | insecureScheme.nginx.resources | object | `{}` |  |
+| livenessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for livenessProbe |
+| livenessProbe.periodSeconds | int | `5` | Period seconds for livenessProbe |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
+| readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
+| readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
 | replicaCount | int | `1` |  |
 | resources | object | `{}` |  |
 | securityContext | object | `{}` |  |

charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml

@@ -61,14 +61,12 @@ spec:
             httpGet:
               path: /ready
               port: healthz
-            initialDelaySeconds: 5
+            {{- toYaml .Values.readinessProbe | nindent 12 }}
-            periodSeconds: 5
           livenessProbe:
             httpGet:
               path: /live
               port: healthz
-            initialDelaySeconds: 5
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
-            periodSeconds: 5
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
         {{- if .Values.insecureScheme.enabled }}

charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml

@@ -54,6 +54,18 @@ securityContext: {}
   # runAsNonRoot: true
   # runAsUser: 1000
 
+readinessProbe:
+  # -- Initial delay seconds for readinessProbe
+  initialDelaySeconds: 5
+  # -- Period seconds for readinessProbe
+  periodSeconds: 5
+
+livenessProbe:
+  # -- Initial delay seconds for livenessProbe
+  initialDelaySeconds: 5
+  # -- Period seconds for livenessProbe
+  periodSeconds: 5
+
 podAnnotations: {}
 
 insecureScheme:

charts/spire/charts/spire-agent/README.md

@@ -29,6 +29,8 @@ A Helm chart to install the SPIRE agent.
 | image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
 | imagePullSecrets | list | `[]` |  |
 | initContainers | list | `[]` |  |
+| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
+| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
 | logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
@@ -36,6 +38,8 @@ A Helm chart to install the SPIRE agent.
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
 | priorityClassName | string | `""` | Priority class assigned to daemonset pods |
+| readinessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for readinessProbe |
+| readinessProbe.periodSeconds | int | `60` | Period seconds for readinessProbe |
 | resources | object | `{}` |  |
 | securityContext | object | `{}` |  |
 | server.address | string | `""` |  |

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -79,14 +79,12 @@ spec:
             httpGet:
               path: /live
               port: healthz
-            initialDelaySeconds: 15
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
-            periodSeconds: 60
           readinessProbe:
             httpGet:
               path: /ready
               port: healthz
-            initialDelaySeconds: 15
+            {{- toYaml .Values.readinessProbe | nindent 12 }}
-            periodSeconds: 60
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
         {{- if gt (len .Values.extraContainers) 0 }}

charts/spire/charts/spire-agent/values.yaml

@@ -80,6 +80,18 @@ healthChecks:
   # -- override the host port used for health checking
   port: 9980
 
+livenessProbe:
+  # -- Initial delay seconds for livenessProbe
+  initialDelaySeconds: 15
+  # -- Period seconds for livenessProbe
+  periodSeconds: 60
+
+readinessProbe:
+  # -- Initial delay seconds for readinessProbe
+  initialDelaySeconds: 15
+  # -- Period seconds for readinessProbe
+  periodSeconds: 60
+
 waitForIt:
   image:
     # -- The OCI registry to pull the image from

charts/spire/charts/spire-server/README.md

@@ -96,6 +96,10 @@ A Helm chart to install the SPIRE server.
 | ingress.tls | list | `[]` |  |
 | initContainers | list | `[]` |  |
 | jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
+| livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
+| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
+| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
+| livenessProbe.timeoutSeconds | int | `3` | Timeout in seconds for livenessProbe |
 | logLevel | string | `"info"` | The log level, valid values are "debug", "info", "warn", and "error" |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
@@ -108,6 +112,8 @@ A Helm chart to install the SPIRE server.
 | persistence.storageClass | string | `nil` |  |
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
+| readinessProbe.initialDelaySeconds | int | `5` | Initial delay seconds for readinessProbe |
+| readinessProbe.periodSeconds | int | `5` | Period seconds for readinessProbe |
 | replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
 | resources | object | `{}` |  |
 | securityContext | object | `{}` |  |
@@ -134,6 +140,11 @@ A Helm chart to install the SPIRE server.
 | tornjak.service.annotations | object | `{}` |  |
 | tornjak.service.port | int | `10000` |  |
 | tornjak.service.type | string | `"ClusterIP"` |  |
+| tornjak.startupProbe.failureThreshold | int | `3` |  |
+| tornjak.startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for |
+| tornjak.startupProbe.periodSeconds | int | `10` |  |
+| tornjak.startupProbe.successThreshold | int | `1` |  |
+| tornjak.startupProbe.timeoutSeconds | int | `5` |  |
 | trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
 | upstreamAuthority.certManager.enabled | bool | `false` |  |
 | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -87,16 +87,12 @@ spec:
             httpGet:
               path: /live
               port: healthz
-            failureThreshold: 2
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
-            initialDelaySeconds: 15
-            periodSeconds: 60
-            timeoutSeconds: 3
           readinessProbe:
             httpGet:
               path: /ready
               port: healthz
-            initialDelaySeconds: 5
+            {{- toYaml .Values.readinessProbe | nindent 12 }}
-            periodSeconds: 5
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           volumeMounts:
@@ -168,11 +164,7 @@ spec:
             httpGet:
               scheme: HTTP
               port: 10000
-            failureThreshold: 3
+            {{- toYaml .Values.tornjak.startupProbe | nindent 12 }}
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
           args:
             - --spire-config
             - /run/spire/config/server.conf

charts/spire/charts/spire-server/values.yaml

@@ -81,6 +81,22 @@ affinity: {}
 
 topologySpreadConstraints: []
 
+livenessProbe:
+  # -- Failure threshold count for livenessProbe
+  failureThreshold: 2
+  # -- Initial delay seconds for livenessProbe
+  initialDelaySeconds: 15
+  # -- Period seconds for livenessProbe
+  periodSeconds: 60
+  # -- Timeout in seconds for livenessProbe
+  timeoutSeconds: 3
+
+readinessProbe:
+  # -- Initial delay seconds for readinessProbe
+  initialDelaySeconds: 5
+  # -- Period seconds for readinessProbe
+  periodSeconds: 5
+
 persistence:
   size: 1Gi
   accessMode: ReadWriteOnce
@@ -326,6 +342,15 @@ tornjak:
     type: ClusterIP
     port: 10000
     annotations: {}
+
+  startupProbe:
+    failureThreshold: 3
+    # -- Initial delay seconds for
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    successThreshold: 1
+    timeoutSeconds: 5
+
   config:
     # -- persistent DB for storing Tornjak specific information
     dataStore:

charts/spire/charts/tornjak-frontend/README.md

@@ -72,10 +72,10 @@ port forwarding. See the chart NOTES output for more details.
 | serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
 | spireHealthCheck.enabled | bool | `true` | Enables the SPIRE Healthchecker indicator |
 | startupProbe.enabled | bool | `true` | Enable startupProbe on Tornjak frontend container |
-| startupProbe.failureThreshold | int | `6` | Failure threshold for startupProbe |
+| startupProbe.failureThreshold | int | `6` | Failure threshold count for startupProbe |
 | startupProbe.initialDelaySeconds | int | `5` | Initial delay seconds for startupProbe |
 | startupProbe.periodSeconds | int | `10` | Period seconds for startupProbe |
-| startupProbe.successThreshold | int | `1` | Success threshold for startupProbe |
+| startupProbe.successThreshold | int | `1` | Success threshold count for startupProbe |
 | startupProbe.timeoutSeconds | int | `5` | Timeout seconds for startupProbe |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |

charts/spire/charts/tornjak-frontend/values.yaml

@@ -84,7 +84,7 @@ startupProbe:
   periodSeconds: 10
   # -- Timeout seconds for startupProbe
   timeoutSeconds: 5
-  # -- Failure threshold for startupProbe
+  # -- Failure threshold count for startupProbe
   failureThreshold: 6
-  # -- Success threshold for startupProbe
+  # -- Success threshold count for startupProbe
   successThreshold: 1