diff --git a/docs/pages/kubernetes-access/helm/reference.mdx b/docs/pages/kubernetes-access/helm/reference.mdx index 41ca5493bba7e..45f101380aeee 100644 --- a/docs/pages/kubernetes-access/helm/reference.mdx +++ b/docs/pages/kubernetes-access/helm/reference.mdx @@ -408,6 +408,58 @@ Teleport pods must not be scheduled on the same physical host. +## `highAvailability.podDisruptionBudget` + +### `highAvailability.podDisruptionBudget.enabled` + +| Type | Default value | Can be used in `custom` mode? | +| - | - | - | +| `bool` | `false` | ✅ (when using HA storage) | + +[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) + +Enable a Pod Disruption Budget for the Teleport Pod to ensure HA during voluntary disruptions. + + + + ```yaml + highAvailability: + podDisruptionBudget: + enabled: true + ``` + + + ```shell + --set highAvailability.podDisruptionBudget.enabled=true + ``` + + + +### `highAvailability.podDisruptionBudget.minAvailable` + +| Type | Default value | Can be used in `custom` mode? | +| - | - | - | +| `int` | `1` | ✅ (when using HA storage) | + +[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) + +Ensures that this number of replicas is available during voluntary disruptions, can be a number of replicas or a percentage. + + + + ```yaml + highAvailability: + podDisruptionBudget: + minAvailable: 1 + ``` + + + ```shell + --set highAvailability.podDisruptionBudget.minAvailable=1 + ``` + + + ## `highAvailability.certManager` See the [cert-manager](https://cert-manager.io/docs/) docs for more information. diff --git a/examples/chart/teleport-cluster/.lint/pdb.yaml b/examples/chart/teleport-cluster/.lint/pdb.yaml new file mode 100644 index 0000000000000..f3105c5766eb0 --- /dev/null +++ b/examples/chart/teleport-cluster/.lint/pdb.yaml @@ -0,0 +1,7 @@ +clusterName: helm-lint +chartMode: custom +highAvailability: + replicaCount: 3 + podDisruptionBudget: + enabled: true + minAvailable: 2 diff --git a/examples/chart/teleport-cluster/templates/pdb.yaml b/examples/chart/teleport-cluster/templates/pdb.yaml new file mode 100644 index 0000000000000..6e3f5c3f117a4 --- /dev/null +++ b/examples/chart/teleport-cluster/templates/pdb.yaml @@ -0,0 +1,18 @@ +{{- if .Values.highAvailability.podDisruptionBudget.enabled }} +{{- if .Capabilities.APIVersions.Has "policy/v1" }} +apiVersion: policy/v1 +{{- else }} +apiVersion: policy/v1beta1 +{{- end }} +kind: PodDisruptionBudget +metadata: + name: {{ .Release.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Release.Name }} +spec: + minAvailable: {{ .Values.highAvailability.podDisruptionBudget.minAvailable }} + selector: + matchLabels: + app: {{ .Release.Name }} +{{- end }} diff --git a/examples/chart/teleport-cluster/values.schema.json b/examples/chart/teleport-cluster/values.schema.json index b2477286d9ea0..66b2b99acb49f 100644 --- a/examples/chart/teleport-cluster/values.schema.json +++ b/examples/chart/teleport-cluster/values.schema.json @@ -166,7 +166,8 @@ "required": [ "replicaCount", "requireAntiAffinity", - "certManager" + "certManager", + "podDisruptionBudget" ], "properties": { "replicaCount": { @@ -204,6 +205,26 @@ "default": "Issuer" } } + }, + "podDisruptionBudget": { + "$id": "#/properties/highAvailability/properties/podDisruptionBudget", + "type": "object", + "required": [ + "enabled", + "minAvailable" + ], + "properties": { + "enabled": { + "$id": "#/properties/highAvailability/properties/podDisruptionBudget/properties/enabled", + "type": "boolean", + "default": false + }, + "minAvailable": { + "$id": "#/properties/highAvailability/properties/podDisruptionBudget/properties/minAvailable", + "type": "integer", + "default": 1 + } + } } } }, diff --git a/examples/chart/teleport-cluster/values.yaml b/examples/chart/teleport-cluster/values.yaml index db4f531eb9c99..892fac1deff82 100644 --- a/examples/chart/teleport-cluster/values.yaml +++ b/examples/chart/teleport-cluster/values.yaml @@ -120,6 +120,11 @@ highAvailability: # Setting 'requireAntiAffinity' to false (the default) uses 'preferredDuringSchedulingIgnoredDuringExecution' to make this a soft requirement. # This setting only has any effect when replicaCount is greater than 1. requireAntiAffinity: false + # If enabled will create a Pod Disruption Budget + # https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ + podDisruptionBudget: + enabled: false + minAvailable: 1 # Settings for cert-manager (can be used for provisioning TLS certs in HA mode) certManager: # If set to true, use cert-manager to get certificates for Teleport to use for TLS termination