diff --git a/charts/kyverno/README.md b/charts/kyverno/README.md index c0e2bfcdfd..a947736915 100644 --- a/charts/kyverno/README.md +++ b/charts/kyverno/README.md @@ -352,6 +352,7 @@ The chart values are organised per component. | admissionController.nodeAffinity | object | `{}` | Node affinity constraints. | | admissionController.topologySpreadConstraints | list | `[]` | Topology spread constraints. | | admissionController.podSecurityContext | object | `{}` | Security context for the pod | +| admissionController.podDisruptionBudget.enabled | bool | `false` | Enable PodDisruptionBudget. Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. | | admissionController.podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for disruptions. Cannot be used if `maxUnavailable` is set. | | admissionController.podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for disruptions. Cannot be used if `minAvailable` is set. | | admissionController.tufRootMountPath | string | `"/.sigstore"` | A writable volume to use for the TUF root initialization. | @@ -443,6 +444,7 @@ The chart values are organised per component. | backgroundController.topologySpreadConstraints | list | `[]` | Topology spread constraints. | | backgroundController.podSecurityContext | object | `{}` | Security context for the pod | | backgroundController.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers | +| backgroundController.podDisruptionBudget.enabled | bool | `false` | Enable PodDisruptionBudget. Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. | | backgroundController.podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for disruptions. Cannot be used if `maxUnavailable` is set. | | backgroundController.podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for disruptions. Cannot be used if `minAvailable` is set. | | backgroundController.metricsService.create | bool | `true` | Create service. | @@ -510,6 +512,7 @@ The chart values are organised per component. | cleanupController.topologySpreadConstraints | list | `[]` | Topology spread constraints. | | cleanupController.podSecurityContext | object | `{}` | Security context for the pod | | cleanupController.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers | +| cleanupController.podDisruptionBudget.enabled | bool | `false` | Enable PodDisruptionBudget. Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. | | cleanupController.podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for disruptions. Cannot be used if `maxUnavailable` is set. | | cleanupController.podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for disruptions. Cannot be used if `minAvailable` is set. | | cleanupController.service.port | int | `443` | Service port. | @@ -579,6 +582,7 @@ The chart values are organised per component. | reportsController.topologySpreadConstraints | list | `[]` | Topology spread constraints. | | reportsController.podSecurityContext | object | `{}` | Security context for the pod | | reportsController.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers | +| reportsController.podDisruptionBudget.enabled | bool | `false` | Enable PodDisruptionBudget. Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. | | reportsController.podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for disruptions. Cannot be used if `maxUnavailable` is set. | | reportsController.podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for disruptions. Cannot be used if `minAvailable` is set. | | reportsController.tufRootMountPath | string | `"/.sigstore"` | A writable volume to use for the TUF root initialization. | diff --git a/charts/kyverno/templates/admission-controller/poddisruptionbudget.yaml b/charts/kyverno/templates/admission-controller/poddisruptionbudget.yaml index c9ef079da9..d1bfbeba2a 100644 --- a/charts/kyverno/templates/admission-controller/poddisruptionbudget.yaml +++ b/charts/kyverno/templates/admission-controller/poddisruptionbudget.yaml @@ -1,4 +1,4 @@ -{{- if (gt (int .Values.admissionController.replicas) 1) -}} +{{- if or .Values.admissionController.podDisruptionBudget.enabled (gt (int .Values.admissionController.replicas) 1) -}} apiVersion: {{ template "kyverno.pdb.apiVersion" . }} kind: PodDisruptionBudget metadata: diff --git a/charts/kyverno/templates/background-controller/poddisruptionbudget.yaml b/charts/kyverno/templates/background-controller/poddisruptionbudget.yaml index 7808aed3f4..201f7cbb8c 100644 --- a/charts/kyverno/templates/background-controller/poddisruptionbudget.yaml +++ b/charts/kyverno/templates/background-controller/poddisruptionbudget.yaml @@ -1,5 +1,5 @@ {{- if .Values.backgroundController.enabled -}} -{{- if (gt (int .Values.backgroundController.replicas) 1) -}} +{{- if or .Values.backgroundController.podDisruptionBudget.enabled (gt (int .Values.backgroundController.replicas) 1) -}} apiVersion: {{ template "kyverno.pdb.apiVersion" . }} kind: PodDisruptionBudget metadata: diff --git a/charts/kyverno/templates/cleanup-controller/poddisruptionbudget.yaml b/charts/kyverno/templates/cleanup-controller/poddisruptionbudget.yaml index 4cf02be138..b640ad3073 100644 --- a/charts/kyverno/templates/cleanup-controller/poddisruptionbudget.yaml +++ b/charts/kyverno/templates/cleanup-controller/poddisruptionbudget.yaml @@ -1,5 +1,5 @@ {{- if .Values.cleanupController.enabled -}} -{{- if (gt (int .Values.cleanupController.replicas) 1) -}} +{{- if or .Values.cleanupController.podDisruptionBudget.enabled (gt (int .Values.cleanupController.replicas) 1) -}} apiVersion: {{ template "kyverno.pdb.apiVersion" . }} kind: PodDisruptionBudget metadata: diff --git a/charts/kyverno/templates/reports-controller/poddisruptionbudget.yaml b/charts/kyverno/templates/reports-controller/poddisruptionbudget.yaml index b1fdc7a505..de6b6248b2 100644 --- a/charts/kyverno/templates/reports-controller/poddisruptionbudget.yaml +++ b/charts/kyverno/templates/reports-controller/poddisruptionbudget.yaml @@ -1,5 +1,5 @@ {{- if .Values.reportsController.enabled -}} -{{- if (gt (int .Values.reportsController.replicas) 1) -}} +{{- if or .Values.reportsController.podDisruptionBudget.enabled (gt (int .Values.reportsController.replicas) 1) -}} apiVersion: {{ template "kyverno.pdb.apiVersion" . }} kind: PodDisruptionBudget metadata: diff --git a/charts/kyverno/values.yaml b/charts/kyverno/values.yaml index 87921a0b15..a27a51c292 100644 --- a/charts/kyverno/values.yaml +++ b/charts/kyverno/values.yaml @@ -781,6 +781,9 @@ admissionController: podSecurityContext: {} podDisruptionBudget: + # -- Enable PodDisruptionBudget. + # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. + enabled: false # -- Configures the minimum available pods for disruptions. # Cannot be used if `maxUnavailable` is set. minAvailable: 1 @@ -1161,6 +1164,9 @@ backgroundController: type: RuntimeDefault podDisruptionBudget: + # -- Enable PodDisruptionBudget. + # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. + enabled: false # -- Configures the minimum available pods for disruptions. # Cannot be used if `maxUnavailable` is set. minAvailable: 1 @@ -1426,6 +1432,9 @@ cleanupController: type: RuntimeDefault podDisruptionBudget: + # -- Enable PodDisruptionBudget. + # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. + enabled: false # -- Configures the minimum available pods for disruptions. # Cannot be used if `maxUnavailable` is set. minAvailable: 1 @@ -1669,6 +1678,9 @@ reportsController: type: RuntimeDefault podDisruptionBudget: + # -- Enable PodDisruptionBudget. + # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. + enabled: false # -- Configures the minimum available pods for disruptions. # Cannot be used if `maxUnavailable` is set. minAvailable: 1