panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add PodDisruptionBudget support to spire-server (#909)

Browse Source 
* Add PodDisruptionBudget support to spire-server

Signed-off-by: David Mosyan <[email protected]>

* Revert spire-ha-agent changes and set default pdb value for spire-server

Signed-off-by: David Mosyan <[email protected]>

---------

Signed-off-by: David Mosyan <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
David Mosyan
2026-08-10 12:23:55 -07:00
committed by GitHub
co-authored by kfox1111
parent 0666f56681
commit a481bab3f0
3 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+3
View File
@@ -116,6 +116,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `100` |
| `autoscaling.scaleOnSPIREServerOnly` | Flag to only consider the main SPIRE container for autoscaling purposes | `false` |
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization that triggers autoscaling | `80` |
| `podDisruptionBudget.enabled` | Flag to enable a PodDisruptionBudget for the SPIRE server pods | `false` |
| `podDisruptionBudget.minAvailable` | Minimum number/percentage of pods that must remain available (mutually exclusive with maxUnavailable) | `""` |
| `podDisruptionBudget.maxUnavailable` | Maximum number/percentage of pods that can be unavailable (mutually exclusive with minAvailable) | `""` |
| `nodeSelector` | Select specific nodes to run on (currently only amd64 is supported by Tornjak) | `{}` |
| `tolerations` | List of tolerations | `[]` |
| `affinity` | List of node affinities | `{}` |
charts/spire/charts/spire-server/templates/poddisruptionbudget.yaml
+23
View File
@@ -0,0 +1,23 @@
{{- if not .Values.externalServer }}
{{- if .Values.podDisruptionBudget.enabled }}
{{- if and .Values.podDisruptionBudget.minAvailable .Values.podDisruptionBudget.maxUnavailable }}
{{- fail "podDisruptionBudget.minAvailable and podDisruptionBudget.maxUnavailable are mutually exclusive" }}
{{- end }}
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: {{ include "spire-server.fullname" . }}
namespace: {{ include "spire-server.namespace" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
spec:
{{- if .Values.podDisruptionBudget.maxUnavailable }}
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
{{- else }}
minAvailable: {{ .Values.podDisruptionBudget.minAvailable | default (max 1 (sub .Values.replicaCount 1)) }}
{{- end }}
selector:
matchLabels:
{{- include "spire-server.selectorLabels" . | nindent 6 }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+9
View File
@@ -124,6 +124,15 @@ autoscaling:
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
## @param podDisruptionBudget.enabled Flag to enable a PodDisruptionBudget for the SPIRE server pods
## @param podDisruptionBudget.minAvailable Minimum number/percentage of pods that must remain available (mutually exclusive with maxUnavailable)
## @param podDisruptionBudget.maxUnavailable Maximum number/percentage of pods that can be unavailable (mutually exclusive with minAvailable)
##
podDisruptionBudget:
enabled: false
minAvailable: ""
maxUnavailable: ""
## @param nodeSelector [object] Select specific nodes to run on (currently only amd64 is supported by Tornjak)
nodeSelector: {}