Add support for PDB with the teleport-cluster helm chart

docs/pages/kubernetes-access/helm/reference.mdx

@@ -408,6 +408,58 @@ Teleport pods must not be scheduled on the same physical host.
   </TabItem>
 </Tabs>
 
+## `highAvailability.podDisruptionBudget`
+
+### `highAvailability.podDisruptionBudget.enabled`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `bool` | `false` | ✅ (when using HA storage) |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+
+Enable a Pod Disruption Budget for the Teleport Pod to ensure HA during voluntary disruptions.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    podDisruptionBudget:
+      enabled: true
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.podDisruptionBudget.enabled=true
+  ```
+  </TabItem>
+</Tabs>
+
+### `highAvailability.podDisruptionBudget.minAvailable`
+
+| Type | Default value | Can be used in `custom` mode? |
+| - | - | - |
+| `int` | `1` | ✅ (when using HA storage) |
+
+[Kubernetes reference](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+
+Ensures that this number of replicas is available during voluntary disruptions, can be a number of replicas or a percentage.
+
+<Tabs>
+  <TabItem label="values.yaml">
+  ```yaml
+  highAvailability:
+    podDisruptionBudget:
+      minAvailable: 1
+  ```
+  </TabItem>
+  <TabItem label="--set">
+  ```shell
+  --set highAvailability.podDisruptionBudget.minAvailable=1
+  ```
+  </TabItem>
+</Tabs>
+
 ## `highAvailability.certManager`
 
 See the [cert-manager](https://cert-manager.io/docs/) docs for more information.

examples/chart/teleport-cluster/.lint/pdb.yaml

@@ -0,0 +1,7 @@
+clusterName: helm-lint
+chartMode: custom
+highAvailability:
+  replicaCount: 3
+  podDisruptionBudget:
+    enabled: true
+    minAvailable: 2

examples/chart/teleport-cluster/templates/pdb.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.highAvailability.podDisruptionBudget.enabled }}
+{{- if .Capabilities.APIVersions.Has "policy/v1" }}
+apiVersion: policy/v1
+{{- else }}
+apiVersion: policy/v1beta1
+{{- end }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ .Release.Name }}
+spec:
+  minAvailable: {{ .Values.highAvailability.podDisruptionBudget.minAvailable }}
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+{{- end }}

examples/chart/teleport-cluster/values.schema.json

@@ -166,7 +166,8 @@
             "required": [
                 "replicaCount",
                 "requireAntiAffinity",
-                "certManager"
+                "certManager",
+                "podDisruptionBudget"
             ],
             "properties": {
                 "replicaCount": {
@@ -204,6 +205,26 @@
                             "default": "Issuer"
                         }
                     }
+                },
+                "podDisruptionBudget": {
+                    "$id": "#/properties/highAvailability/properties/podDisruptionBudget",
+                    "type": "object",
+                    "required": [
+                        "enabled",
+                        "minAvailable"
+                    ],
+                    "properties": {
+                        "enabled": {
+                            "$id": "#/properties/highAvailability/properties/podDisruptionBudget/properties/enabled",
+                            "type": "boolean",
+                            "default": false
+                        },
+                        "minAvailable": {
+                            "$id": "#/properties/highAvailability/properties/podDisruptionBudget/properties/minAvailable",
+                            "type": "integer",
+                            "default": 1
+                        }
+                    }
                 }
             }
         },

examples/chart/teleport-cluster/values.yaml

@@ -120,6 +120,11 @@ highAvailability:
   # Setting 'requireAntiAffinity' to false (the default) uses 'preferredDuringSchedulingIgnoredDuringExecution' to make this a soft requirement.
   # This setting only has any effect when replicaCount is greater than 1.
   requireAntiAffinity: false
+  # If enabled will create a Pod Disruption Budget
+  # https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
+  podDisruptionBudget:
+    enabled: false
+    minAvailable: 1
   # Settings for cert-manager (can be used for provisioning TLS certs in HA mode)
   certManager:
     # If set to true, use cert-manager to get certificates for Teleport to use for TLS termination