diff --git a/deploy/charts/cert-manager/templates/_helpers.tpl b/deploy/charts/cert-manager/templates/_helpers.tpl index 90db4af26..2b416b2c1 100644 --- a/deploy/charts/cert-manager/templates/_helpers.tpl +++ b/deploy/charts/cert-manager/templates/_helpers.tpl @@ -34,6 +34,21 @@ Create the name of the service account to use {{- end -}} {{- end -}} +{{/* +Create the default PodDisruptionBudget to use +*/}} +{{- define "podDisruptionBudget.spec" -}} +{{- if and .Values.global.podDisruptionBudget.minAvailable .Values.global.podDisruptionBudget.maxUnavailable }} +{{- fail "Cannot set both .Values.global.podDisruptionBudget.minAvailable and .Values.global.podDisruptionBudget.maxUnavailable" -}} +{{- end }} +{{- if not .Values.global.podDisruptionBudget.maxUnavailable }} +minAvailable: {{ default 1 .Values.global.podDisruptionBudget.minAvailable }} +{{- end }} +{{- if .Values.global.podDisruptionBudget.maxUnavailable }} +maxUnavailable: {{ .Values.global.podDisruptionBudget.maxUnavailable }} +{{- end }} +{{- end }} + {{/* Webhook templates */}} diff --git a/deploy/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml b/deploy/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml new file mode 100644 index 000000000..f6bc132cd --- /dev/null +++ b/deploy/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml @@ -0,0 +1,18 @@ +{{- if .Values.global.podDisruptionBudget.enabled }} +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + labels: + app: {{ include "cainjector.name" . }} + app.kubernetes.io/name: {{ include "cainjector.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + helm.sh/chart: {{ template "cert-manager.chart" . }} + name: {{ include "cainjector.fullname" . }} + namespace: {{ .Release.Namespace | quote }} +spec: +{{- include "podDisruptionBudget.spec" . | indent 2 }} + selector: + matchLabels: + app.kubernetes.io/name: {{ include "cainjector.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/deploy/charts/cert-manager/templates/poddisruptionbudget.yaml b/deploy/charts/cert-manager/templates/poddisruptionbudget.yaml new file mode 100644 index 000000000..74ec662b4 --- /dev/null +++ b/deploy/charts/cert-manager/templates/poddisruptionbudget.yaml @@ -0,0 +1,18 @@ +{{- if .Values.global.podDisruptionBudget.enabled }} +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + labels: + app: {{ template "cert-manager.name" . }} + app.kubernetes.io/name: {{ template "cert-manager.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + helm.sh/chart: {{ template "cert-manager.chart" . }} + name: {{ template "cert-manager.fullname" . }} + namespace: {{ .Release.Namespace | quote }} +spec: +{{- include "podDisruptionBudget.spec" . | indent 2 }} + selector: + matchLabels: + app.kubernetes.io/name: {{ template "cert-manager.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/deploy/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml b/deploy/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml new file mode 100644 index 000000000..64be0855e --- /dev/null +++ b/deploy/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml @@ -0,0 +1,18 @@ +{{- if .Values.global.podDisruptionBudget.enabled }} +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + labels: + app: {{ include "webhook.name" . }} + app.kubernetes.io/name: {{ include "webhook.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + helm.sh/chart: {{ template "cert-manager.chart" . }} + name: {{ include "webhook.fullname" . }} + namespace: {{ .Release.Namespace | quote }} +spec: +{{- include "podDisruptionBudget.spec" . | indent 2 }} + selector: + matchLabels: + app.kubernetes.io/name: {{ include "webhook.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/deploy/charts/cert-manager/values.yaml b/deploy/charts/cert-manager/values.yaml index 01169b7c2..eb6962fa2 100644 --- a/deploy/charts/cert-manager/values.yaml +++ b/deploy/charts/cert-manager/values.yaml @@ -24,6 +24,11 @@ global: # Aggregate ClusterRoles to Kubernetes default user-facing roles. Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles aggregateClusterRoles: true + podDisruptionBudget: + enabled: true + # minAvailable: 1 + # maxUnavailable: 1 + podSecurityPolicy: enabled: false useAppArmor: true