panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow configuration of priorityClassName on spire-server statefulset (#480)

Browse Source
This commit is contained in:
Inverse Integral
2023-09-12 22:31:23 +02:00
committed by GitHub
parent 9ad2ed59b1
commit 1f908676bb
4 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+2 -1
View File
@@ -81,7 +81,7 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
## Parameters
## Parameters
### Chart parameters
@@ -103,6 +103,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `podAnnotations` | Annotations to add to pods | `{}` |
| `podSecurityContext` | Pod security context | `{}` |
| `securityContext` | Security context | `{}` |
| `priorityClassName` | Priority class assigned to statefulset pods | `""` |
| `service.type` | Type of the Spire server service created | `ClusterIP` |
| `service.port` | Port for the created service | `8081` |
| `service.annotations` | Annotations to add to the service object | `{}` |
charts/spire/charts/spire-server/templates/statefulset.yaml
+3
View File
@@ -49,6 +49,9 @@ spec:
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
{{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }}
{{- end }}
initContainers:
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
- name: wait
charts/spire/charts/spire-server/values.yaml
+6 -3
View File
@@ -25,13 +25,13 @@ image:
## @param imagePullSecrets [array] Pull secrets for images
imagePullSecrets: []
## @param nameOverride Name override
## @param nameOverride Name override
nameOverride: ""
## @param namespaceOverride Namespace override
## @param namespaceOverride Namespace override
namespaceOverride: ""
## @param fullnameOverride Fullname override
## @param fullnameOverride Fullname override
fullnameOverride: ""
## @param serviceAccount.create Specifies whether a service account should be created
@@ -59,6 +59,9 @@ securityContext: {}
# runAsNonRoot: true
# runAsUser: 1000
## @param priorityClassName Priority class assigned to statefulset pods
priorityClassName: ""
## @param service.type Type of the Spire server service created
## @param service.port Port for the created service
## @param service.annotations [object] Annotations to add to the service object
examples/production/values.yaml
+1
View File
@@ -23,6 +23,7 @@ spire-server:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
priorityClassName: system-cluster-critical
logLevel: info