feat(charts): add opt-in schedulerName and runtimeClassName to the pods (#6675)

* feat(charts): add opt-in schedulerName and runtimeClassName to the pods

Signed-off-by: somaz <genius5711@gmail.com>

* fix(charts): quote schedulerName and runtimeClassName values

Signed-off-by: somaz <genius5711@gmail.com>

---------

Signed-off-by: somaz <genius5711@gmail.com>
Co-authored-by: Jean-Philippe Evrard <jean-philippe.evrard+rochepub@external.roche.com>

deploy/charts/external-secrets/README.md

@@ -93,6 +93,8 @@ The command removes all the Kubernetes components associated with the chart and
 | certController.requeueInterval | string | `"5m"` |  |
 | certController.resources | object | `{}` |  |
 | certController.revisionHistoryLimit | int | `10` | Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) |
+| certController.runtimeClassName | string | `""` | Pod runtime class name. |
+| certController.schedulerName | string | `""` | Pod scheduler name. |
 | certController.securityContext.allowPrivilegeEscalation | bool | `false` |  |
 | certController.securityContext.capabilities.drop[0] | string | `"ALL"` |  |
 | certController.securityContext.enabled | bool | `true` |  |
@@ -231,6 +233,8 @@ The command removes all the Kubernetes components associated with the chart and
 | replicaCount | int | `1` |  |
 | resources | object | `{}` |  |
 | revisionHistoryLimit | int | `10` | Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) |
+| runtimeClassName | string | `""` | Pod runtime class name. |
+| schedulerName | string | `""` | Pod scheduler name. |
 | scopedNamespace | string | `""` | If set external secrets are only reconciled in the provided namespace |
 | scopedRBAC | bool | `false` | If true, create scoped RBAC roles and implicitly disable cluster-scoped controllers. Scoped to scopedNamespace if set, otherwise to .Release.Namespace. |
 | securityContext.allowPrivilegeEscalation | bool | `false` |  |
@@ -334,6 +338,8 @@ The command removes all the Kubernetes components associated with the chart and
 | webhook.replicaCount | int | `1` |  |
 | webhook.resources | object | `{}` |  |
 | webhook.revisionHistoryLimit | int | `10` | Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) |
+| webhook.runtimeClassName | string | `""` | Pod runtime class name. |
+| webhook.schedulerName | string | `""` | Pod scheduler name. |
 | webhook.secretAnnotations | object | `{}` | Annotations to add to Secret |
 | webhook.securityContext.allowPrivilegeEscalation | bool | `false` |  |
 | webhook.securityContext.capabilities.drop[0] | string | `"ALL"` |  |

deploy/charts/external-secrets/templates/cert-controller-deployment.yaml

@@ -196,4 +196,10 @@ spec:
       {{- if .Values.certController.priorityClassName }}
       priorityClassName: {{ .Values.certController.priorityClassName }}
       {{- end }}
+      {{- if .Values.certController.schedulerName }}
+      schedulerName: {{ .Values.certController.schedulerName | quote }}
+      {{- end }}
+      {{- if .Values.certController.runtimeClassName }}
+      runtimeClassName: {{ .Values.certController.runtimeClassName | quote }}
+      {{- end }}
 {{- end }}

deploy/charts/external-secrets/templates/deployment.yaml

@@ -238,6 +238,12 @@ spec:
       {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
       {{- end }}
+      {{- if .Values.schedulerName }}
+      schedulerName: {{ .Values.schedulerName | quote }}
+      {{- end }}
+      {{- if .Values.runtimeClassName }}
+      runtimeClassName: {{ .Values.runtimeClassName | quote }}
+      {{- end }}
       {{- if .Values.podSpecExtra }}
       {{- toYaml .Values.podSpecExtra | nindent 6 }}
       {{- end }}

deploy/charts/external-secrets/templates/webhook-deployment.yaml

@@ -197,4 +197,10 @@ spec:
       {{- if .Values.webhook.priorityClassName }}
       priorityClassName: {{ .Values.webhook.priorityClassName }}
       {{- end }}
+      {{- if .Values.webhook.schedulerName }}
+      schedulerName: {{ .Values.webhook.schedulerName | quote }}
+      {{- end }}
+      {{- if .Values.webhook.runtimeClassName }}
+      runtimeClassName: {{ .Values.webhook.runtimeClassName | quote }}
+      {{- end }}
 {{- end }}

deploy/charts/external-secrets/tests/runtime_class_name_test.yaml

@@ -0,0 +1,20 @@
+---
+suite: test runtimeClassName
+templates:
+  - cert-controller-deployment.yaml
+  - deployment.yaml
+  - webhook-deployment.yaml
+tests:
+  - it: should set runtimeClassName to set value if given
+    set:
+      runtimeClassName: my-runtime-class
+      webhook.runtimeClassName: my-runtime-class
+      certController.runtimeClassName: my-runtime-class
+    asserts:
+      - equal:
+          path: spec.template.spec.runtimeClassName
+          value: my-runtime-class
+  - it: should not set runtimeClassName by default
+    asserts:
+      - notExists:
+          path: spec.template.spec.runtimeClassName

deploy/charts/external-secrets/tests/scheduler_name_test.yaml

@@ -0,0 +1,20 @@
+---
+suite: test schedulerName
+templates:
+  - cert-controller-deployment.yaml
+  - deployment.yaml
+  - webhook-deployment.yaml
+tests:
+  - it: should set schedulerName to set value if given
+    set:
+      schedulerName: my-scheduler
+      webhook.schedulerName: my-scheduler
+      certController.schedulerName: my-scheduler
+    asserts:
+      - equal:
+          path: spec.template.spec.schedulerName
+          value: my-scheduler
+  - it: should not set schedulerName by default
+    asserts:
+      - notExists:
+          path: spec.template.spec.schedulerName

deploy/charts/external-secrets/values.schema.json

@@ -292,6 +292,12 @@
                 "revisionHistoryLimit": {
                     "type": "integer"
                 },
+                "runtimeClassName": {
+                    "type": "string"
+                },
+                "schedulerName": {
+                    "type": "string"
+                },
                 "securityContext": {
                     "type": "object",
                     "properties": {
@@ -886,6 +892,12 @@
         "revisionHistoryLimit": {
             "type": "integer"
         },
+        "runtimeClassName": {
+            "type": "string"
+        },
+        "schedulerName": {
+            "type": "string"
+        },
         "scopedNamespace": {
             "type": "string"
         },
@@ -1359,6 +1371,12 @@
                 "revisionHistoryLimit": {
                     "type": "integer"
                 },
+                "runtimeClassName": {
+                    "type": "string"
+                },
+                "schedulerName": {
+                    "type": "string"
+                },
                 "secretAnnotations": {
                     "type": "object"
                 },

deploy/charts/external-secrets/values.yaml

@@ -447,6 +447,12 @@ affinity: {}
 # -- Pod priority class name.
 priorityClassName: ""
 
+# -- Pod scheduler name.
+schedulerName: ""
+
+# -- Pod runtime class name.
+runtimeClassName: ""
+
 # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
 podDisruptionBudget:
   enabled: false
@@ -618,6 +624,12 @@ webhook:
     # -- Pod priority class name.
   priorityClassName: ""
 
+    # -- Pod scheduler name.
+  schedulerName: ""
+
+    # -- Pod runtime class name.
+  runtimeClassName: ""
+
   # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
   podDisruptionBudget:
     enabled: false
@@ -825,6 +837,12 @@ certController:
     # -- Pod priority class name.
   priorityClassName: ""
 
+    # -- Pod scheduler name.
+  schedulerName: ""
+
+    # -- Pod runtime class name.
+  runtimeClassName: ""
+
   # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
   podDisruptionBudget:
     enabled: false