Configurable daemonsets updateStrategy (#212)
* Configure daemonsets updateStrategy This allows more deamonset pods to be rotated in the same time. This speeds up the updates Signed-off-by: Marco Franssen <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Kevin Fox <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
Marco Franssen
co-authored by
Kevin Fox
Faisal Memon
Kevin Fox
Faisal Memon
parent
a539065c02
commit
f512b06419
@@ -25,47 +25,50 @@ A Helm chart to install the SPIFFE CSI driver.
|
|||||||
|
|
||||||
### SPIFFE CSI Driver Chart parameters
|
### SPIFFE CSI Driver Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
|
| --------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
|
||||||
| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` |
|
| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` |
|
| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` |
|
| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` |
|
||||||
| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` |
|
| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` |
|
||||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||||
| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` |
|
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
||||||
| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` |
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||||
| `nameOverride` | Name override for spiffe-csi-driver | `""` |
|
| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` |
|
||||||
| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` |
|
| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` |
|
||||||
| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` |
|
| `nameOverride` | Name override for spiffe-csi-driver | `""` |
|
||||||
| `csiDriverLabels` | Labels to apply to the CSIDriver | `{}` |
|
| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` |
|
||||||
| `initContainers` | Init Containers to apply to the CSI Driver DaemonSet | `[]` |
|
| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` |
|
||||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
| `csiDriverLabels` | Labels to apply to the CSIDriver | `{}` |
|
||||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
| `initContainers` | Init Containers to apply to the CSI Driver DaemonSet | `[]` |
|
||||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` |
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
| `podSecurityContext` | Security context for CSI driver pods | `{}` |
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` |
|
| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` |
|
||||||
| `securityContext.privileged` | Flag for specifying privileged mode | `true` |
|
| `podSecurityContext` | Security context for CSI driver pods | `{}` |
|
||||||
| `nodeSelector` | Node selector for CSI driver pods | `{}` |
|
| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` |
|
||||||
| `tolerations` | Tolerations for CSI driver pods | `[]` |
|
| `securityContext.privileged` | Flag for specifying privileged mode | `true` |
|
||||||
| `affinity` | Node affinity | `{}` |
|
| `nodeSelector` | Node selector for CSI driver pods | `{}` |
|
||||||
| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
| `tolerations` | Tolerations for CSI driver pods | `[]` |
|
||||||
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
|
| `affinity` | Node affinity | `{}` |
|
||||||
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
||||||
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.3` |
|
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
|
||||||
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
|
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.3` |
|
||||||
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
|
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
|
||||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||||
| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` |
|
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
|
||||||
| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` |
|
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||||
| `restrictedScc.version` | Version of the restricted SCC | `2` |
|
| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` |
|
||||||
| `selinux.enabled` | Enable selinux support | `false` |
|
| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` |
|
||||||
| `selinux.context` | Which selinux context to use | `container_file_t` |
|
| `restrictedScc.version` | Version of the restricted SCC | `2` |
|
||||||
| `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` |
|
| `selinux.enabled` | Enable selinux support | `false` |
|
||||||
| `selinux.image.repository` | The repository within the registry | `ubi9` |
|
| `selinux.context` | Which selinux context to use | `container_file_t` |
|
||||||
| `selinux.image.pullPolicy` | The image pull policy | `Always` |
|
| `selinux.image.registry` | The OCI registry to pull the image from | `registry.access.redhat.com` |
|
||||||
| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest` |
|
| `selinux.image.repository` | The repository within the registry | `ubi9` |
|
||||||
|
| `selinux.image.pullPolicy` | The image pull policy | `Always` |
|
||||||
|
| `selinux.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest` |
|
||||||
|
|
||||||
|
|||||||
@@ -9,8 +9,17 @@ spec:
|
|||||||
selector:
|
selector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
{{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }}
|
{{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }}
|
||||||
|
{{- with .Values.updateStrategy }}
|
||||||
updateStrategy:
|
updateStrategy:
|
||||||
type: RollingUpdate
|
{{- if not (has .type (list "RollingUpdate" "OnDelete")) }}
|
||||||
|
{{- fail "updateStrategy.type can only be RollingUpdate or OnDelete"}}
|
||||||
|
{{- end }}
|
||||||
|
type: {{ .type }}
|
||||||
|
{{- if eq .type "RollingUpdate" }}
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: {{ .rollingUpdate.maxUnavailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
template:
|
template:
|
||||||
metadata:
|
metadata:
|
||||||
{{- with .Values.podAnnotations }}
|
{{- with .Values.podAnnotations }}
|
||||||
|
|||||||
@@ -37,6 +37,13 @@ healthChecks:
|
|||||||
## @param healthChecks.port The healthcheck port for spiffe-csi-driver
|
## @param healthChecks.port The healthcheck port for spiffe-csi-driver
|
||||||
port: 9809
|
port: 9809
|
||||||
|
|
||||||
|
## @param updateStrategy.type The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete.
|
||||||
|
## @param updateStrategy.rollingUpdate.maxUnavailable Max unavailable pods during update. Can be a number or a percentage.
|
||||||
|
updateStrategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: 1
|
||||||
|
|
||||||
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||||
## @param livenessProbe.timeoutSeconds Timeout value in seconds for livenessProbe
|
## @param livenessProbe.timeoutSeconds Timeout value in seconds for livenessProbe
|
||||||
##
|
##
|
||||||
|
|||||||
@@ -59,6 +59,8 @@ A Helm chart to install the SPIRE agent.
|
|||||||
| `server.port` | Port number for Spire server | `8081` |
|
| `server.port` | Port number for Spire server | `8081` |
|
||||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||||
|
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||||
|
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
||||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||||
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
|
||||||
|
|||||||
@@ -19,6 +19,17 @@ spec:
|
|||||||
selector:
|
selector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
{{- include "spire-agent.selectorLabels" . | nindent 6 }}
|
{{- include "spire-agent.selectorLabels" . | nindent 6 }}
|
||||||
|
{{- with .Values.updateStrategy }}
|
||||||
|
updateStrategy:
|
||||||
|
{{- if not (has .type (list "RollingUpdate" "OnDelete")) }}
|
||||||
|
{{- fail "updateStrategy.type can only be RollingUpdate or OnDelete"}}
|
||||||
|
{{- end }}
|
||||||
|
type: {{ .type }}
|
||||||
|
{{- if eq .type "RollingUpdate" }}
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: {{ .rollingUpdate.maxUnavailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
template:
|
template:
|
||||||
metadata:
|
metadata:
|
||||||
annotations:
|
annotations:
|
||||||
|
|||||||
@@ -116,6 +116,13 @@ healthChecks:
|
|||||||
## @param healthChecks.port override the host port used for health checking
|
## @param healthChecks.port override the host port used for health checking
|
||||||
port: 9982
|
port: 9982
|
||||||
|
|
||||||
|
## @param updateStrategy.type The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete.
|
||||||
|
## @param updateStrategy.rollingUpdate.maxUnavailable Max unavailable pods during update. Can be a number or a percentage.
|
||||||
|
updateStrategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: 1
|
||||||
|
|
||||||
## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe
|
## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe
|
||||||
## @param livenessProbe.periodSeconds Period seconds for probe
|
## @param livenessProbe.periodSeconds Period seconds for probe
|
||||||
##
|
##
|
||||||
|
|||||||
Reference in New Issue
Block a user