Support hostNetwork mode for EKS custom CNI deployment

saturncloud · Sep 25, 2024 · b94dec8 · b94dec8
1 parent 1f31706
commit b94dec8
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 1 deletion.
diff --git a/deploy/httpreq-webhook/templates/deployment.yaml b/deploy/httpreq-webhook/templates/deployment.yaml
@@ -14,6 +14,11 @@ spec:
     matchLabels:
       app: {{ include "httpreq-webhook.name" . }}
       release: {{ .Release.Name }}
+
+  {{- if .Values.strategy }}
+  strategy:
+    {{ toYaml .Values.strategy | nindent 4 }}
+  {{- end }}
   template:
     metadata:
       labels:
@@ -35,6 +40,7 @@ spec:
             {{- if not (kindIs "invalid" .Values.logLevel) }}
             - --v={{ .Values.logLevel }}
             {{- end }}
+            - --secure-port={{ .securePort }}
           env:
             - name: GROUP_NAME
               value: {{ .Values.groupName | quote }}
@@ -43,7 +49,7 @@ spec:
             {{- end }}
           ports:
             - name: https
-              containerPort: 443
+              containerPort: {{ .Values.securePort }}
               protocol: TCP
           livenessProbe:
             httpGet:
@@ -65,6 +71,12 @@ spec:
         - name: certs
           secret:
             secretName: {{ include "httpreq-webhook.servingCertificate" . }}
+      {{- if .Values.hostNetwork }}
+      hostNetwork: true
+      {{- end }}
+      {{- if or .Values.dnsPolicy .Values.hostNetwork }}
+      dnsPolicy: {{ .Values.dnsPolicy | default "ClusterFirstWithHostNet" }}
+      {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{ toYaml . | nindent 8 }}

diff --git a/deploy/httpreq-webhook/values.yaml b/deploy/httpreq-webhook/values.yaml
@@ -44,6 +44,21 @@ service:
   type: ClusterIP
   port: 443
 
+# Required for EKS with custom CNI
+# https://cert-manager.io/docs/concepts/webhook/#webhook-connection-problems-on-aws-eks
+hostNetwork: false
+dnsPolicy:  # Default to ClusterFirstWithHostNet if hostNetwork is true
+securePort: 12443
+
+# Deployment update strategy
+# With hostNetwork, you may want to set maxUnavailable 1 so pod can rebind to same port on the node
+strategy:
+  # type: RollingUpdate
+  # rollingUpdate:
+  #   maxSurge: 0
+  #   maxUnavailable: 1
+
+
 resources: {}
   # limits:
   #  cpu: 100m