From 86a806f3c6df5aad8b1b0f8a6a5450582921680d Mon Sep 17 00:00:00 2001
From: Alec Wilson <alec-w@users.noreply.github.com>
Date: Mon, 9 Feb 2026 00:32:56 +0000
Subject: [PATCH] Add tolerations to spire-server hook pods (#742)

Applies the tolerations in the spire-server chart to the pods created
by the hooks. Previously they were only applied to the pods of the
server itself.

Signed-off-by: Alec Wilson <alecw1992@gmail.com>
---
 .../charts/spire-server/templates/post-install-hook.yaml      | 4 ++++
 .../charts/spire-server/templates/post-upgrade-hook.yaml      | 4 ++++
 .../spire/charts/spire-server/templates/pre-delete-hook.yaml  | 4 ++++
 .../spire/charts/spire-server/templates/pre-upgrade-hook.yaml | 4 ++++
 4 files changed, 16 insertions(+)

diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
index 325fbef..e432a52 100644
--- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml
@@ -58,6 +58,10 @@ spec:
     metadata:
       name: {{ include "spire-server.fullname" . }}-post-install
     spec:
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       restartPolicy: Never
       serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install
       securityContext:
diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
index 309b63c..a4583a2 100644
--- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
@@ -58,6 +58,10 @@ spec:
     metadata:
       name: {{ include "spire-server.fullname" . }}-post-upgrade
     spec:
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       restartPolicy: Never
       serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade
       securityContext:
diff --git a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml
index 6af0a89..e06cbd8 100644
--- a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml
@@ -61,6 +61,10 @@ spec:
     metadata:
       name: {{ include "spire-server.fullname" . }}-pre-delete
     spec:
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       restartPolicy: Never
       serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete
       securityContext:
diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
index ee92e0d..84c6760 100644
--- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
@@ -58,6 +58,10 @@ spec:
     metadata:
       name: {{ include "spire-server.fullname" . }}-pre-upgrade
     spec:
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       restartPolicy: Never
       serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
       securityContext: