From a481bab3f00a6b73720399b8b6f6c8708bb1229a Mon Sep 17 00:00:00 2001 From: David Mosyan Date: Mon, 10 Aug 2026 15:23:55 -0400 Subject: [PATCH] Add PodDisruptionBudget support to spire-server (#909) * Add PodDisruptionBudget support to spire-server Signed-off-by: David Mosyan * Revert spire-ha-agent changes and set default pdb value for spire-server Signed-off-by: David Mosyan --------- Signed-off-by: David Mosyan Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/README.md | 3 +++ .../templates/poddisruptionbudget.yaml | 23 +++++++++++++++++++ charts/spire/charts/spire-server/values.yaml | 9 ++++++++ 3 files changed, 35 insertions(+) create mode 100644 charts/spire/charts/spire-server/templates/poddisruptionbudget.yaml diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 55decff..d02aa30 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -116,6 +116,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` | | `autoscaling.scaleOnSPIREServerOnly` | Flag to only consider the main SPIRE container for autoscaling purposes | `false` | | `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` | +| `podDisruptionBudget.enabled` | Flag to enable a PodDisruptionBudget for the SPIRE server pods | `false` | +| `podDisruptionBudget.minAvailable` | Minimum number/percentage of pods that must remain available (mutually exclusive with maxUnavailable) | `""` | +| `podDisruptionBudget.maxUnavailable` | Maximum number/percentage of pods that can be unavailable (mutually exclusive with minAvailable) | `""` | | `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` | | `tolerations` | List of tolerations | `[]` | | `affinity` | List of node affinities | `{}` | diff --git a/charts/spire/charts/spire-server/templates/poddisruptionbudget.yaml b/charts/spire/charts/spire-server/templates/poddisruptionbudget.yaml new file mode 100644 index 0000000..443ae38 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/poddisruptionbudget.yaml @@ -0,0 +1,23 @@ +{{- if not .Values.externalServer }} +{{- if .Values.podDisruptionBudget.enabled }} +{{- if and .Values.podDisruptionBudget.minAvailable .Values.podDisruptionBudget.maxUnavailable }} +{{- fail "podDisruptionBudget.minAvailable and podDisruptionBudget.maxUnavailable are mutually exclusive" }} +{{- end }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "spire-server.fullname" . }} + namespace: {{ include "spire-server.namespace" . }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} +spec: + {{- if .Values.podDisruptionBudget.maxUnavailable }} + maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} + {{- else }} + minAvailable: {{ .Values.podDisruptionBudget.minAvailable | default (max 1 (sub .Values.replicaCount 1)) }} + {{- end }} + selector: + matchLabels: + {{- include "spire-server.selectorLabels" . | nindent 6 }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 151019e..175bb41 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -124,6 +124,15 @@ autoscaling: targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 +## @param podDisruptionBudget.enabled Flag to enable a PodDisruptionBudget for the SPIRE server pods +## @param podDisruptionBudget.minAvailable Minimum number/percentage of pods that must remain available (mutually exclusive with maxUnavailable) +## @param podDisruptionBudget.maxUnavailable Maximum number/percentage of pods that can be unavailable (mutually exclusive with minAvailable) +## +podDisruptionBudget: + enabled: false + minAvailable: "" + maxUnavailable: "" + ## @param nodeSelector [object] Select specific nodes to run on (currently only amd64 is supported by Tornjak) nodeSelector: {}