Add recommendation for priorityClass (#124)
* Add a flag to enable recommendations Signed-off-by: Kevin Fox <[email protected]> * Add recommendation for priorityClass Signed-off-by: Kevin Fox <[email protected]> * Fix vars Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs. Fix typo. Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -151,7 +151,7 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
|
||||
| ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
|
||||
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||
| `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` |
|
||||
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||
@@ -159,6 +159,7 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
|
||||
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
|
||||
| `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` |
|
||||
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||
| `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` |
|
||||
| `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` |
|
||||
|
||||
@@ -26,7 +26,7 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
### SPIFFE CSI Driver Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
|
||||
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
|
||||
| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` |
|
||||
@@ -60,7 +60,7 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
|
||||
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods | `""` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` |
|
||||
| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` |
|
||||
| `restrictedScc.version` | Version of the restricted SCC | `2` |
|
||||
|
||||
@@ -33,9 +33,7 @@ spec:
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
|
||||
{{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
|
||||
initContainers:
|
||||
{{- if or (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
|
||||
|
||||
@@ -130,7 +130,7 @@ agentSocketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||
## @param kubeletPath Path to kubelet file
|
||||
kubeletPath: /var/lib/kubelet
|
||||
|
||||
## @param priorityClassName Priority class assigned to daemonset pods
|
||||
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
|
||||
priorityClassName: ""
|
||||
|
||||
restrictedScc:
|
||||
|
||||
@@ -88,7 +88,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods | `""` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
||||
|
||||
@@ -31,9 +31,7 @@ spec:
|
||||
serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
|
||||
{{- if ne (len .Values.hostAliases) 0 }}
|
||||
hostAliases:
|
||||
{{- toYaml .Values.hostAliases | nindent 8 }}
|
||||
|
||||
@@ -204,7 +204,7 @@ kubeletConnectByHostname: ""
|
||||
## @param socketPath The unix socket path to the spire-agent
|
||||
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||
|
||||
## @param priorityClassName Priority class assigned to daemonset pods
|
||||
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
|
||||
priorityClassName: ""
|
||||
|
||||
## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container
|
||||
|
||||
@@ -97,7 +97,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to statefulset pods | `""` |
|
||||
| `priorityClassName` | Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `service.type` | Type of the Spire server service created | `ClusterIP` |
|
||||
| `service.port` | Port for the created service | `8081` |
|
||||
| `service.annotations` | Annotations to add to the service object | `{}` |
|
||||
|
||||
@@ -48,9 +48,7 @@ spec:
|
||||
shareProcessNamespace: true
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }}
|
||||
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
|
||||
initContainers:
|
||||
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
|
||||
|
||||
@@ -59,7 +59,7 @@ securityContext: {}
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
## @param priorityClassName Priority class assigned to statefulset pods
|
||||
## @param priorityClassName Priority class assigned to statefulset pods. Can be auto set with global.recommendations.priorityClassName.
|
||||
priorityClassName: ""
|
||||
|
||||
## @param service.type Type of the Spire server service created
|
||||
|
||||
@@ -247,3 +247,19 @@ to merge in values, but spire needs arrays.
|
||||
{{- $_ := set $config "plugins" $plugins }}
|
||||
{{- $config | toPrettyJson }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-lib.default_node_priority_class_name" }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "priorityClassName" true .Values.global) }}
|
||||
priorityClassName: system-node-critical
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-lib.default_cluster_priority_class_name" }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "priorityClassName" true .Values.global) }}
|
||||
priorityClassName: system-cluster-critical
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -22,8 +22,10 @@ global:
|
||||
upstreamServerAddress: ""
|
||||
|
||||
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
|
||||
## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
|
||||
recommendations:
|
||||
enabled: false
|
||||
priorityClassName: true
|
||||
|
||||
image:
|
||||
## @param global.spire.image.registry Override all Spire image registries at once
|
||||
|
||||
@@ -27,7 +27,6 @@ spire-server:
|
||||
drop: [ALL]
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
priorityClassName: system-cluster-critical
|
||||
|
||||
logLevel: info
|
||||
|
||||
@@ -49,12 +48,10 @@ spire-server:
|
||||
spiffe-csi-driver:
|
||||
enabled: true
|
||||
namespaceOverride: spire-system
|
||||
priorityClassName: system-node-critical
|
||||
|
||||
|
||||
upstream-spiffe-csi-driver:
|
||||
namespaceOverride: spire-system
|
||||
priorityClassName: system-node-critical
|
||||
|
||||
spire-agent:
|
||||
enabled: true
|
||||
@@ -63,7 +60,6 @@ spire-agent:
|
||||
name: spire-agent
|
||||
server:
|
||||
namespaceOverride: spire-server
|
||||
priorityClassName: system-node-critical
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
@@ -81,7 +77,6 @@ spire-agent:
|
||||
|
||||
upstream-spire-agent:
|
||||
namespaceOverride: spire-system
|
||||
priorityClassName: system-node-critical
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
|
||||
Reference in New Issue
Block a user