From 569412b5d4762806676c9ee6570eabf398b58e1c Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 27 Oct 2022 13:30:04 +0200 Subject: [PATCH] Allow to configure resources per object Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 9 ++- charts/spire/templates/agent-daemonset.yaml | 6 ++ charts/spire/templates/oidc-deployment.yaml | 2 +- .../spire/templates/server-statefulset.yaml | 2 +- charts/spire/values.yaml | 77 ++++++++++++++++--- 5 files changed, 81 insertions(+), 15 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 89fc6ca..55b740d 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -53,10 +53,15 @@ Kubernetes: `>=1.21.0-0` | agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` | | | agent.image.tag | string | `""` | | | agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| agent.resources | object | `{}` | | | autoscaling.enabled | bool | `false` | | | autoscaling.maxReplicas | int | `100` | | | autoscaling.minReplicas | int | `1` | | | autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| csiDriver.image.pullPolicy | string | `"IfNotPresent"` | | +| csiDriver.image.repository | string | `"ghcr.io/spiffe/spiffe-csi-driver"` | | +| csiDriver.image.tag | string | `"0.2.0"` | | +| csiDriver.resources | object | `{}` | | | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | @@ -79,13 +84,13 @@ Kubernetes: `>=1.21.0-0` | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | | oidc.logLevel | string | `"INFO"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| oidc.resources | object | `{}` | | | oidc.service.annotations | object | `{}` | | | oidc.service.port | int | `80` | | | oidc.service.type | string | `"NodePort"` | | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | | replicaCount | int | `1` | | -| resources | object | `{}` | | | securityContext | object | `{}` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | @@ -95,6 +100,7 @@ Kubernetes: `>=1.21.0-0` | server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` | | | server.image.tag | string | `""` | | | server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| server.resources | object | `{}` | | | server.service.port | int | `8081` | | | server.service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | @@ -108,6 +114,7 @@ Kubernetes: `>=1.21.0-0` | workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | | workloadRegistrar.image.repository | string | `"gcr.io/spiffe-io/k8s-workload-registrar"` | | | workloadRegistrar.image.tag | string | `""` | | +| workloadRegistrar.resources | object | `{}` | | ---------------------------------------------- Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index e7d73d3..cdc1eeb 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -59,6 +59,8 @@ spec: port: 8080 initialDelaySeconds: 15 periodSeconds: 60 + resources: + {{- toYaml .Values.agent.resources | nindent 12 }} # This is the container which runs the SPIFFE CSI driver. - name: spiffe-csi-driver image: ghcr.io/spiffe/spiffe-csi-driver:nightly @@ -90,6 +92,8 @@ spec: name: mountpoint-dir securityContext: privileged: true + resources: + {{- toYaml .Values.csiDriver.resources | nindent 12 }} # This container runs the CSI Node Driver Registrar which takes care # of all the little details required to register a CSI driver with # the kubelet. @@ -108,6 +112,8 @@ spec: # directory - name: kubelet-plugin-registration-dir mountPath: /registration + resources: + {{- toYaml .Values.csiDriver.resources | nindent 12 }} volumes: - name: spire-config configMap: diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index 9f4d48e..6f81a76 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -66,7 +66,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 5 resources: - {{- toYaml .Values.resources | nindent 12 }} + {{- toYaml .Values.oidc.resources | nindent 12 }} {{- if .Values.oidc.insecureScheme.enabled }} - name: nginx securityContext: diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index ed97871..81bdc8c 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -76,7 +76,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 5 resources: - {{- toYaml .Values.resources | nindent 12 }} + {{- toYaml .Values.server.resources | nindent 12 }} - name: {{ .Chart.Name }}-workload-registrar securityContext: {{- toYaml .Values.securityContext | nindent 12 }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index e3d24d0..8a85a0b 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -11,6 +11,18 @@ workloadRegistrar: # Overrides the image tag whose default is the chart appVersion. tag: "" + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + server: image: repository: gcr.io/spiffe-io/spire-server @@ -21,6 +33,18 @@ server: nodeSelector: kubernetes.io/arch: amd64 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 200m + # memory: 256Mi + # limits: + # cpu: 200m + # memory: 256Mi + dataStorage: enabled: true size: 1Gi @@ -31,6 +55,23 @@ server: type: ClusterIP port: 8081 +csiDriver: + image: + repository: ghcr.io/spiffe/spiffe-csi-driver + pullPolicy: IfNotPresent + tag: 0.2.0 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + oidc: enabled: false @@ -42,6 +83,18 @@ oidc: nodeSelector: kubernetes.io/arch: amd64 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + logLevel: INFO service: @@ -82,6 +135,18 @@ agent: nodeSelector: kubernetes.io/arch: amd64 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 64Mi + # limits: + # cpu: 100m + # memory: 128Mi + imagePullSecrets: [] # - name: my-docker-registry # username: my-docker-user @@ -113,18 +178,6 @@ securityContext: {} # runAsNonRoot: true # runAsUser: 1000 -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - autoscaling: enabled: false minReplicas: 1