panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow to configure resources per object

Browse Source 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-02-18 13:04:03 +01:00
committed by Marco Franssen
parent fb5985ada4
commit 569412b5d4
5 changed files with 81 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+8 -1
View File
@@ -53,10 +53,15 @@ Kubernetes: `>=1.21.0-0`
| agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` | |
| agent.image.tag | string | `""` | |
| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
| agent.resources | object | `{}` | |
| autoscaling.enabled | bool | `false` | |
| autoscaling.maxReplicas | int | `100` | |
| autoscaling.minReplicas | int | `1` | |
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
| csiDriver.image.pullPolicy | string | `"IfNotPresent"` | |
| csiDriver.image.repository | string | `"ghcr.io/spiffe/spiffe-csi-driver"` | |
| csiDriver.image.tag | string | `"0.2.0"` | |
| csiDriver.resources | object | `{}` | |
| fullnameOverride | string | `""` | |
| imagePullSecrets | list | `[]` | |
| nameOverride | string | `""` | |
@@ -79,13 +84,13 @@ Kubernetes: `>=1.21.0-0`
| oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | |
| oidc.logLevel | string | `"INFO"` | |
| oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
| oidc.resources | object | `{}` | |
| oidc.service.annotations | object | `{}` | |
| oidc.service.port | int | `80` | |
| oidc.service.type | string | `"NodePort"` | |
| podAnnotations | object | `{}` | |
| podSecurityContext | object | `{}` | |
| replicaCount | int | `1` | |
| resources | object | `{}` | |
| securityContext | object | `{}` | |
| server.dataStorage.accessMode | string | `"ReadWriteOnce"` | |
| server.dataStorage.enabled | bool | `true` | |
@@ -95,6 +100,7 @@ Kubernetes: `>=1.21.0-0`
| server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` | |
| server.image.tag | string | `""` | |
| server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
| server.resources | object | `{}` | |
| server.service.port | int | `8081` | |
| server.service.type | string | `"ClusterIP"` | |
| serviceAccount.annotations | object | `{}` | |
@@ -108,6 +114,7 @@ Kubernetes: `>=1.21.0-0`
| workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | |
| workloadRegistrar.image.repository | string | `"gcr.io/spiffe-io/k8s-workload-registrar"` | |
| workloadRegistrar.image.tag | string | `""` | |
| workloadRegistrar.resources | object | `{}` | |
----------------------------------------------
Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
charts/spire/templates/agent-daemonset.yaml
+6
View File
@@ -59,6 +59,8 @@ spec:
port: 8080
initialDelaySeconds: 15
periodSeconds: 60
resources:
{{- toYaml .Values.agent.resources | nindent 12 }}
# This is the container which runs the SPIFFE CSI driver.
- name: spiffe-csi-driver
image: ghcr.io/spiffe/spiffe-csi-driver:nightly
@@ -90,6 +92,8 @@ spec:
name: mountpoint-dir
securityContext:
privileged: true
resources:
{{- toYaml .Values.csiDriver.resources | nindent 12 }}
# This container runs the CSI Node Driver Registrar which takes care
# of all the little details required to register a CSI driver with
# the kubelet.
@@ -108,6 +112,8 @@ spec:
# directory
- name: kubelet-plugin-registration-dir
mountPath: /registration
resources:
{{- toYaml .Values.csiDriver.resources | nindent 12 }}
volumes:
- name: spire-config
configMap:
charts/spire/templates/oidc-deployment.yaml
+1 -1
View File
@@ -66,7 +66,7 @@ spec:
initialDelaySeconds: 5
periodSeconds: 5
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- toYaml .Values.oidc.resources | nindent 12 }}
{{- if .Values.oidc.insecureScheme.enabled }}
- name: nginx
securityContext:
charts/spire/templates/server-statefulset.yaml
+1 -1
View File
@@ -76,7 +76,7 @@ spec:
initialDelaySeconds: 5
periodSeconds: 5
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- toYaml .Values.server.resources | nindent 12 }}
- name: {{ .Chart.Name }}-workload-registrar
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
charts/spire/values.yaml
+65 -12
View File
@@ -11,6 +11,18 @@ workloadRegistrar:
# Overrides the image tag whose default is the chart appVersion.
tag: ""
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 50m
# memory: 32Mi
# limits:
# cpu: 100m
# memory: 64Mi
server:
image:
repository: gcr.io/spiffe-io/spire-server
@@ -21,6 +33,18 @@ server:
nodeSelector:
kubernetes.io/arch: amd64
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 200m
# memory: 256Mi
# limits:
# cpu: 200m
# memory: 256Mi
dataStorage:
enabled: true
size: 1Gi
@@ -31,6 +55,23 @@ server:
type: ClusterIP
port: 8081
csiDriver:
image:
repository: ghcr.io/spiffe/spiffe-csi-driver
pullPolicy: IfNotPresent
tag: 0.2.0
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 50m
# memory: 32Mi
# limits:
# cpu: 100m
# memory: 64Mi
oidc:
enabled: false
@@ -42,6 +83,18 @@ oidc:
nodeSelector:
kubernetes.io/arch: amd64
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 50m
# memory: 32Mi
# limits:
# cpu: 100m
# memory: 64Mi
logLevel: INFO
service:
@@ -82,6 +135,18 @@ agent:
nodeSelector:
kubernetes.io/arch: amd64
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 50m
# memory: 64Mi
# limits:
# cpu: 100m
# memory: 128Mi
imagePullSecrets: []
# - name: my-docker-registry
# username: my-docker-user
@@ -113,18 +178,6 @@ securityContext: {}
# runAsNonRoot: true
# runAsUser: 1000
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# limits:
# cpu: 100m
# memory: 128Mi
# requests:
# cpu: 100m
# memory: 128Mi
autoscaling:
enabled: false
minReplicas: 1