From 86c60b186fa78d39352d3a905a840605860522b2 Mon Sep 17 00:00:00 2001 From: Bronson Mirafuentes <30124037+heybronson@users.noreply.github.com> Date: Thu, 11 Jun 2026 12:12:33 -0700 Subject: [PATCH] feat(spire-server): add terminationGracePeriodSeconds (#835) * feat(spire-server): add terminationGracePeriodSeconds and lifecycle support Adds two new top-level values to the spire-server chart: - `terminationGracePeriodSeconds` (nullable, pod-spec level): overrides the default 30s termination grace period. Useful when the server is behind a load balancer that needs time to deregister the target (e.g. AWS NLB with a deregistration delay > 30s). - `lifecycle` (object, container level): lifecycle hooks for the spire-server container. The primary use case is a preStop hook to hold the pod alive while the load balancer deregisters the target before SIGTERM is sent: lifecycle: preStop: sleep: seconds: 60 Both fields default to their absent/empty equivalents (null and {}) so existing deployments are unaffected. Signed-off-by: Bronson Mirafuentes * Bump docker/login-action from 4.1.0 to 4.2.0 (#836) Bumps [docker/login-action](https://github.com/docker/login-action) from 4.1.0 to 4.2.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v4.1.0...v4.2.0) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Bronson Mirafuentes * feat(spire-server): remove lifecycle hook support Lifecycle hooks are not needed for the terminationGracePeriodSeconds use case; preStop semantics can be handled outside the chart. Signed-off-by: Bronson Mirafuentes * update README Signed-off-by: Bronson Mirafuentes * update README Signed-off-by: Bronson Mirafuentes --------- Signed-off-by: Bronson Mirafuentes Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- charts/spire/charts/spire-server/README.md | 1 + .../spire/charts/spire-server/templates/server-resource.yaml | 3 +++ charts/spire/charts/spire-server/values.yaml | 3 +++ 3 files changed, 7 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index fd5ea7f..42ecb03 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -116,6 +116,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tolerations` | List of tolerations | `[]` | | `affinity` | List of node affinities | `{}` | | `topologySpreadConstraints` | Topology spread constraints for resilience | `[]` | +| `terminationGracePeriodSeconds` | Override the termination grace period for the pod. Increase to allow time for load balancer target deregistration and in-flight gRPC drain before SIGKILL. | `nil` | | `livenessProbe.failureThreshold` | Failure threshold count for livenessProbe | `2` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` | | `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` | diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index 9846b6f..b849916 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -528,6 +528,9 @@ spec: topologySpreadConstraints: {{- toYaml . | nindent 8 }} {{- end }} + {{- if .Values.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} + {{- end }} volumes: - name: server-tmp emptyDir: {} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index b45640d..9577990 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -126,6 +126,9 @@ affinity: {} ## @param topologySpreadConstraints [array] Topology spread constraints for resilience topologySpreadConstraints: [] +## @param terminationGracePeriodSeconds [nullable] Override the termination grace period for the pod. Increase to allow time for load balancer target deregistration and in-flight gRPC drain before SIGKILL. +terminationGracePeriodSeconds: ~ + ## @param livenessProbe.failureThreshold Failure threshold count for livenessProbe ## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param livenessProbe.periodSeconds Period seconds for livenessProbe