panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Configurable daemonsets updateStrategy (#212)

Browse Source 
* Configure daemonsets updateStrategy

This allows more deamonset pods to be rotated in the same time. This speeds up the updates

Signed-off-by: Marco Franssen <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
Marco Franssen
2024-02-29 14:42:52 -08:00
committed by GitHub
co-authored by Kevin Fox Faisal Memon
parent a539065c02
commit f512b06419
6 changed files with 84 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-csi-driver/README.md
+4 -1
View File
@@ -26,7 +26,7 @@ A Helm chart to install the SPIFFE CSI driver.
### SPIFFE CSI Driver Chart parameters ### SPIFFE CSI Driver Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------- | | --------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | | `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | | `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` |
@@ -34,6 +34,8 @@ A Helm chart to install the SPIFFE CSI driver.
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | | `resources` | Resource requests and limits for spiffe-csi-driver | `{}` |
| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | | `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` |
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | | `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` |
| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | | `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` |
@@ -69,3 +71,4 @@ A Helm chart to install the SPIFFE CSI driver.
| `selinux.image.repository` | The repository within the registry | `ubi9` | | `selinux.image.repository` | The repository within the registry | `ubi9` |
| `selinux.image.pullPolicy` | The image pull policy | `Always` | | `selinux.image.pullPolicy` | The image pull policy | `Always` |
| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest` | | `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest` |
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+10 -1
View File
@@ -9,8 +9,17 @@ spec:
selector: selector:
matchLabels: matchLabels:
{{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }} {{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }}
{{- with .Values.updateStrategy }}
updateStrategy: updateStrategy:
type: RollingUpdate {{- if not (has .type (list "RollingUpdate" "OnDelete")) }}
{{- fail "updateStrategy.type can only be RollingUpdate or OnDelete"}}
{{- end }}
type: {{ .type }}
{{- if eq .type "RollingUpdate" }}
rollingUpdate:
maxUnavailable: {{ .rollingUpdate.maxUnavailable }}
{{- end }}
{{- end }}
template: template:
metadata: metadata:
{{- with .Values.podAnnotations }} {{- with .Values.podAnnotations }}
charts/spire/charts/spiffe-csi-driver/values.yaml
+7
View File
@@ -37,6 +37,13 @@ healthChecks:
## @param healthChecks.port The healthcheck port for spiffe-csi-driver ## @param healthChecks.port The healthcheck port for spiffe-csi-driver
port: 9809 port: 9809
## @param updateStrategy.type The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete.
## @param updateStrategy.rollingUpdate.maxUnavailable Max unavailable pods during update. Can be a number or a percentage.
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
## @param livenessProbe.timeoutSeconds Timeout value in seconds for livenessProbe ## @param livenessProbe.timeoutSeconds Timeout value in seconds for livenessProbe
## ##
charts/spire/charts/spire-agent/README.md
+2
View File
@@ -59,6 +59,8 @@ A Helm chart to install the SPIRE agent.
| `server.port` | Port number for Spire server | `8081` | | `server.port` | Port number for Spire server | `8081` |
| `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` |
| `healthChecks.port` | override the host port used for health checking | `9982` | | `healthChecks.port` | override the host port used for health checking | `9982` |
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | | `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
charts/spire/charts/spire-agent/templates/daemonset.yaml
+11
View File
@@ -19,6 +19,17 @@ spec:
selector: selector:
matchLabels: matchLabels:
{{- include "spire-agent.selectorLabels" . | nindent 6 }} {{- include "spire-agent.selectorLabels" . | nindent 6 }}
{{- with .Values.updateStrategy }}
updateStrategy:
{{- if not (has .type (list "RollingUpdate" "OnDelete")) }}
{{- fail "updateStrategy.type can only be RollingUpdate or OnDelete"}}
{{- end }}
type: {{ .type }}
{{- if eq .type "RollingUpdate" }}
rollingUpdate:
maxUnavailable: {{ .rollingUpdate.maxUnavailable }}
{{- end }}
{{- end }}
template: template:
metadata: metadata:
annotations: annotations:
charts/spire/charts/spire-agent/values.yaml
+7
View File
@@ -116,6 +116,13 @@ healthChecks:
## @param healthChecks.port override the host port used for health checking ## @param healthChecks.port override the host port used for health checking
port: 9982 port: 9982
## @param updateStrategy.type The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete.
## @param updateStrategy.rollingUpdate.maxUnavailable Max unavailable pods during update. Can be a number or a percentage.
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe ## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe
## @param livenessProbe.periodSeconds Period seconds for probe ## @param livenessProbe.periodSeconds Period seconds for probe
## ##