From 1f908676bb9d365357f24ce6ecff715c2aeaae31 Mon Sep 17 00:00:00 2001 From: Inverse Integral Date: Tue, 12 Sep 2023 22:31:23 +0200 Subject: [PATCH] Allow configuration of priorityClassName on spire-server statefulset (#480) --- charts/spire/charts/spire-server/README.md | 3 ++- .../spire/charts/spire-server/templates/statefulset.yaml | 3 +++ charts/spire/charts/spire-server/values.yaml | 9 ++++++--- examples/production/values.yaml | 1 + 4 files changed, 12 insertions(+), 4 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index e2d541f..72faf0e 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -81,7 +81,7 @@ curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhos In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above. -## Parameters +## Parameters ### Chart parameters @@ -103,6 +103,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `podAnnotations` | Annotations to add to pods | `{}` | | `podSecurityContext` | Pod security context | `{}` | | `securityContext` | Security context | `{}` | +| `priorityClassName` | Priority class assigned to statefulset pods | `""` | | `service.type` | Type of the Spire server service created | `ClusterIP` | | `service.port` | Port for the created service | `8081` | | `service.annotations` | Annotations to add to the service object | `{}` | diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 151f281..3e95c5a 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -49,6 +49,9 @@ spec: securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} initContainers: {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }} - name: wait diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index bf0fec6..6b2b7a0 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -25,13 +25,13 @@ image: ## @param imagePullSecrets [array] Pull secrets for images imagePullSecrets: [] -## @param nameOverride Name override +## @param nameOverride Name override nameOverride: "" -## @param namespaceOverride Namespace override +## @param namespaceOverride Namespace override namespaceOverride: "" -## @param fullnameOverride Fullname override +## @param fullnameOverride Fullname override fullnameOverride: "" ## @param serviceAccount.create Specifies whether a service account should be created @@ -59,6 +59,9 @@ securityContext: {} # runAsNonRoot: true # runAsUser: 1000 +## @param priorityClassName Priority class assigned to statefulset pods +priorityClassName: "" + ## @param service.type Type of the Spire server service created ## @param service.port Port for the created service ## @param service.annotations [object] Annotations to add to the service object diff --git a/examples/production/values.yaml b/examples/production/values.yaml index 3ee755d..cd2e105 100644 --- a/examples/production/values.yaml +++ b/examples/production/values.yaml @@ -23,6 +23,7 @@ spire-server: drop: [ALL] seccompProfile: type: RuntimeDefault + priorityClassName: system-cluster-critical logLevel: info