From 8abac78a15ecf58d889bea3b3a8333a9ed05abda Mon Sep 17 00:00:00 2001 From: Pratik Lotia Date: Wed, 11 Feb 2026 18:58:54 -0500 Subject: [PATCH] Support leaderElection values in controller manager (#740) --- charts/spire/charts/spire-server/README.md | 6 ++++++ .../templates/controller-manager-configmap.yaml | 3 +++ charts/spire/charts/spire-server/values.yaml | 15 +++++++++++++++ 3 files changed, 24 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index aac0279..0294f87 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -276,6 +276,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.addEntryIDPrefix` | If true, prepends the clusterName to the entryID of each entry the controller manager registers. | `true` | | `controllerManager.gcInterval` | How often the SPIRE state is reconciled when the controller is otherwise idle. This impacts how quickly SPIRE state will converge after CRDs are removed or SPIRE state is mutated underneath the controller. Values are in nanoseconds. | `10000000000` | | `controllerManager.logLevel` | The log level for the controller manager. Supported values are info, error, warn and debug. | `info` | +| `controllerManager.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` | +| `controllerManager.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` | +| `controllerManager.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` | | `controllerManager.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | | `controllerManager.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `controllerManager.extraEnv` | Extra environment variables to add to the controller manager | `[]` | @@ -342,6 +345,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `externalControllerManagers.defaults.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `externalControllerManagers.defaults.entryIDPrefixCleanup` | consult the spiffe.io docs about this option before changing. Its unlikely you will need to ever change it. | `false` | | `externalControllerManagers.defaults.parentIDTemplate` | The template that is used to register workloads. | `spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}` | +| `externalControllerManagers.defaults.leaderElection.leaseDuration` | Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. | `15s` | +| `externalControllerManagers.defaults.leaderElection.renewDeadline` | Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. | `10s` | +| `externalControllerManagers.defaults.leaderElection.retryPeriod` | Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. | `2s` | | `externalControllerManagers.defaults.expandEnv` | Set to true to enable environment variable substitution of config file options | `false` | | `externalControllerManagers.defaults.extraEnv` | Extra environment variables to add to the controller manager | `[]` | | `externalControllerManagers.defaults.resources` | Resource requests and limits for controller manager | `{}` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index de33c1b..23906c7 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -54,6 +54,9 @@ leaderElection: leaderElect: true resourceName: {{ printf "%s-%s%s" .Release.Namespace (default .Release.Name .Values.crNameOverride) .suffix | sha256sum | trunc 8 }}.spiffe.io resourceNamespace: {{ include "spire-server.namespace" . }} + leaseDuration: {{ .defaults.leaderElection.leaseDuration }} + renewDeadline: {{ .defaults.leaderElection.renewDeadline }} + retryPeriod: {{ .defaults.leaderElection.retryPeriod }} {{- end }} {{- with .settings.cacheNamespaces }} cacheNamespaces: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index c0cc105..bf093c6 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -570,6 +570,14 @@ controllerManager: ## @param controllerManager.logLevel The log level for the controller manager. Supported values are info, error, warn and debug. logLevel: info + ## @param controllerManager.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. + ## @param controllerManager.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. + ## @param controllerManager.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. + leaderElection: + leaseDuration: "15s" + renewDeadline: "10s" + retryPeriod: "2s" + ## @param controllerManager.parentIDTemplate The template that is used to register workloads. parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" @@ -810,6 +818,13 @@ externalControllerManagers: entryIDPrefixCleanup: false ## @param externalControllerManagers.defaults.parentIDTemplate The template that is used to register workloads. parentIDTemplate: "spiffe://{{ .TrustDomain }}/spire/agent/k8s_psat/{{ .ClusterName }}/{{ .NodeMeta.UID }}" + ## @param externalControllerManagers.defaults.leaderElection.leaseDuration Duration that non-leader candidates will wait to force acquire leadership. Increase this in high-load clusters to reduce API server pressure. + ## @param externalControllerManagers.defaults.leaderElection.renewDeadline Duration the acting leader will retry refreshing leadership before giving up. Must be less than leaseDuration. + ## @param externalControllerManagers.defaults.leaderElection.retryPeriod Duration the LeaderElector clients should wait between tries of actions. Must be less than renewDeadline. + leaderElection: + leaseDuration: "15s" + renewDeadline: "10s" + retryPeriod: "2s" ## @param externalControllerManagers.defaults.expandEnv Set to true to enable environment variable substitution of config file options expandEnv: false ## @param externalControllerManagers.defaults.extraEnv [array] Extra environment variables to add to the controller manager