Skip to content

feat(kubescape-operator): add priorityClassName support for deployments #804

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
bl4ko wants to merge 2 commits into from
Closed

feat(kubescape-operator): add priorityClassName support for deployments #804

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
41e136f
feat(kubescape-operator): add priorityClassName support for deployments
bl4ko Mar 25, 2026
af43373
implement priorityClassName support for all components, add test cove…
matthyx Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions charts/kubescape-operator/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,3 +66,15 @@ app.kubernetes.io/name: {{ include "kubescape-operator.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: {{ .app }}
{{- end }}

{{/*
Resolve priorityClassName for a component with customScheduling fallback.
Usage: {{ include "kubescape-operator.priorityClassName" (dict "component" .Values.<component> "global" .Values.customScheduling) }}
*/}}
{{- define "kubescape-operator.priorityClassName" -}}
{{- if .component.priorityClassName }}
priorityClassName: {{ .component.priorityClassName }}
{{- else if .global.priorityClassName }}
priorityClassName: {{ .global.priorityClassName }}
{{- end }}
{{- end }}
1 change: 1 addition & 0 deletions charts/kubescape-operator/templates/autoupdater/cronjob.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,4 +72,5 @@ spec:
{{- else if .Values.customScheduling.tolerations }}
{{- toYaml .Values.customScheduling.tolerations | nindent 12 }}
{{- end }}
{{- include "kubescape-operator.priorityClassName" (dict "component" .Values.helmReleaseUpgrader "global" .Values.customScheduling) | nindent 10 }}
{{ end }}
1 change: 1 addition & 0 deletions charts/kubescape-operator/templates/grype-offline-db/cronjob.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@ spec:
{{- else if .Values.customScheduling.tolerations }}
{{- toYaml .Values.customScheduling.tolerations | nindent 12 }}
{{- end }}
{{- include "kubescape-operator.priorityClassName" (dict "component" .Values.grypeOfflineDB "global" .Values.customScheduling) | nindent 10 }}
{{- if .Values.volumes }}
{{ toYaml .Values.volumes | indent 10 }}
{{- end }}
Expand Down
1 change: 1 addition & 0 deletions charts/kubescape-operator/templates/kubescape-scheduler/cronjob.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@ spec:
{{- else if .Values.customScheduling.tolerations }}
{{- toYaml .Values.customScheduling.tolerations | nindent 12 }}
{{- end }}
{{- include "kubescape-operator.priorityClassName" (dict "component" .Values.kubescapeScheduler "global" .Values.customScheduling) | nindent 10 }}
volumes:
- name: {{ .Values.kubescapeScheduler.name }}
configMap:
Expand Down
1 change: 1 addition & 0 deletions charts/kubescape-operator/templates/kubescape/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -407,4 +407,5 @@ spec:
{{- else if .Values.customScheduling.tolerations }}
{{- toYaml .Values.customScheduling.tolerations | nindent 8 }}
{{- end }}
{{- include "kubescape-operator.priorityClassName" (dict "component" .Values.kubescape "global" .Values.customScheduling) | nindent 6 }}
{{- end }}
1 change: 1 addition & 0 deletions charts/kubescape-operator/templates/kubevuln-scheduler/cronjob.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@ spec:
{{- else if .Values.customScheduling.tolerations }}
{{- toYaml .Values.customScheduling.tolerations | nindent 12 }}
{{- end }}
{{- include "kubescape-operator.priorityClassName" (dict "component" .Values.kubevulnScheduler "global" .Values.customScheduling) | nindent 10 }}
volumes:
- name: {{ .Values.kubevulnScheduler.name }}
configMap:
Expand Down
1 change: 1 addition & 0 deletions charts/kubescape-operator/templates/kubevuln/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -270,4 +270,5 @@ spec:
{{- else if .Values.customScheduling.tolerations }}
{{- toYaml .Values.customScheduling.tolerations | nindent 8 }}
{{- end }}
{{- include "kubescape-operator.priorityClassName" (dict "component" .Values.kubevuln "global" .Values.customScheduling) | nindent 6 }}
{{- end }}
6 changes: 5 additions & 1 deletion charts/kubescape-operator/templates/node-agent/_node-agent.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -443,8 +443,12 @@ imagePullSecrets:
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.configurations.priorityClass.enabled }}
{{- if .Values.nodeAgent.priorityClassName }}
priorityClassName: {{ .Values.nodeAgent.priorityClassName }}
{{- else if .Values.configurations.priorityClass.enabled }}
priorityClassName: kubescape-critical
{{- else if .Values.customScheduling.priorityClassName }}
priorityClassName: {{ .Values.customScheduling.priorityClassName }}
Comment on lines +446 to +451
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Global fallback is effectively masked for node-agent.

At Line 448, configurations.priorityClass.enabled takes precedence over customScheduling.priorityClassName, so global scheduling won’t apply to node-agent under default settings. This is inconsistent with the component→global fallback model used elsewhere.

💡 Suggested precedence fix 
 {{- if .Values.nodeAgent.priorityClassName }}
 priorityClassName: {{ .Values.nodeAgent.priorityClassName }}
-{{- else if .Values.configurations.priorityClass.enabled }}
-priorityClassName: kubescape-critical
 {{- else if .Values.customScheduling.priorityClassName }}
 priorityClassName: {{ .Values.customScheduling.priorityClassName }}
+{{- else if .Values.configurations.priorityClass.enabled }}
+priorityClassName: kubescape-critical
 {{- end }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
{{- if .Values.nodeAgent.priorityClassName }}
priorityClassName: {{ .Values.nodeAgent.priorityClassName }}
{{- else if .Values.configurations.priorityClass.enabled }}
priorityClassName: kubescape-critical
{{- else if .Values.customScheduling.priorityClassName }}
priorityClassName: {{ .Values.customScheduling.priorityClassName }}
{{- if .Values.nodeAgent.priorityClassName }}
priorityClassName: {{ .Values.nodeAgent.priorityClassName }}
{{- else if .Values.customScheduling.priorityClassName }}
priorityClassName: {{ .Values.customScheduling.priorityClassName }}
{{- else if .Values.configurations.priorityClass.enabled }}
priorityClassName: kubescape-critical
{{- end }}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@charts/kubescape-operator/templates/node-agent/_node-agent.tpl` around lines
446 - 451, The current precedence in the node-agent template uses
.Values.configurations.priorityClass.enabled before
.Values.customScheduling.priorityClassName, which prevents the global fallback
(kubescape-critical) from being masked correctly; update the condition order in
the priorityClassName block so it checks .Values.nodeAgent.priorityClassName
first, then .Values.customScheduling.priorityClassName, and only then
.Values.configurations.priorityClass.enabled to emit "priorityClassName:
kubescape-critical" — adjust the conditional sequence around the
priorityClassName lines to reflect this corrected precedence.

{{- end }}
serviceAccountName: {{ .Values.nodeAgent.name }}
automountServiceAccountToken: true
Expand Down
1 change: 1 addition & 0 deletions charts/kubescape-operator/templates/operator/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -269,4 +269,5 @@ spec:
{{- else if .Values.customScheduling.tolerations }}
{{- toYaml .Values.customScheduling.tolerations | nindent 8 }}
{{- end }}
{{- include "kubescape-operator.priorityClassName" (dict "component" .Values.operator "global" .Values.customScheduling) | nindent 6 }}
{{- end }}
1 change: 1 addition & 0 deletions charts/kubescape-operator/templates/prometheus-exporter/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,4 +126,5 @@ spec:
{{- else if .Values.customScheduling.tolerations }}
{{- toYaml .Values.customScheduling.tolerations | nindent 8 }}
{{- end }}
{{- include "kubescape-operator.priorityClassName" (dict "component" .Values.prometheusExporter "global" .Values.customScheduling) | nindent 6 }}
{{- end }}
1 change: 1 addition & 0 deletions charts/kubescape-operator/templates/storage/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ spec:
{{- else if .Values.customScheduling.tolerations }}
{{- toYaml .Values.customScheduling.tolerations | nindent 8 }}
{{- end }}
{{- include "kubescape-operator.priorityClassName" (dict "component" .Values.storage "global" .Values.customScheduling) | nindent 6 }}
volumes:
- name: "data"
{{- if eq .Values.configurations.persistence "enable" }}
Expand Down
1 change: 1 addition & 0 deletions charts/kubescape-operator/templates/synchronizer/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,4 +250,5 @@ spec:
{{- else if .Values.customScheduling.tolerations }}
{{- toYaml .Values.customScheduling.tolerations | nindent 8 }}
{{- end }}
{{- include "kubescape-operator.priorityClassName" (dict "component" .Values.synchronizer "global" .Values.customScheduling) | nindent 6 }}
{{- end }}
Loading
Loading