[AUTH-158] authentik: add pdb

charts/authentik/README.md

@@ -128,6 +128,16 @@ redis:
 | livenessProbe.initialDelaySeconds | int | `5` |  |
 | livenessProbe.periodSeconds | int | `10` |  |
 | nodeSelector | object | `{}` | nodeSelector applied to the deployments |
+| pdb.server.annotations | object | `{}` | Annotations to be added to the server pdb |
+| pdb.server.enabled | bool | `false` | Deploy a PodDistrubtionBudget for the server |
+| pdb.server.labels | object | `{}` | Labels to be added to the server pdb |
+| pdb.server.maxUnavailable | string | `""` | Number of pods that are unavailable after eviction as number or percentage (eg.: 50%) # Has higher precedence over `pdb.server.minAvailable` |
+| pdb.server.minAvailable | string | `""` (defaults to 0 if not specified) | Number of pods that are available after eviction as number or percentage (eg.: 50%) |
+| pdb.worker.annotations | object | `{}` | Annotations to be added to the worker pdb |
+| pdb.worker.enabled | bool | `false` | Deploy a PodDistrubtionBudget for the worker |
+| pdb.worker.labels | object | `{}` | Labels to be added to the worker pdb |
+| pdb.worker.maxUnavailable | string | `""` | Number of pods that are unavailable after eviction as number or percentage (eg.: 50%) # Has higher precedence over `pdb.worker.minAvailable` |
+| pdb.worker.minAvailable | string | `""` (defaults to 0 if not specified) | Number of pods that are available after eviction as number or percentage (eg.: 50%) |
 | podAnnotations | object | `{}` | Annotations to add to the server and worker pods |
 | postgresql.enabled | bool | `false` | enable the bundled bitnami postgresql chart |
 | postgresql.image.tag | string | `"15.4.0-debian-11-r0"` |  |

charts/authentik/ci/ct-values-pdb-max.yaml

@@ -0,0 +1,48 @@
+pdb:
+  server:
+    enabled: true
+    maxUnavailable: 25%
+  worker:
+    enabled: true
+    maxUnavailable: 25%
+
+image:
+  repository: ghcr.io/goauthentik/server
+  tag: 2023.8.3
+  pullPolicy: IfNotPresent
+
+ingress:
+  enabled: true
+  hosts:
+    - host: authentik.domain.tld
+      paths:
+        - path: "/"
+          pathType: Prefix
+
+authentik:
+  log_level: debug
+  secret_key: 5up3r53cr37K3y
+  postgresql:
+    password: au7h3n71k
+  redis:
+    password: au7h3n71k
+
+postgresql:
+  enabled: false
+  postgresqlPassword: au7h3n71k
+  persistence:
+    enabled: false
+
+redis:
+  enabled: false
+  auth:
+    enabled: true
+    password: au7h3n71k
+
+blueprints:
+  - authentik-ci-blueprint
+
+geoip:
+  enabled: true
+  accountId: "foo-account-id"
+  licenseKey: "foo-license-key"

charts/authentik/ci/ct-values-pdb-min.yaml

@@ -0,0 +1,48 @@
+pdb:
+  server:
+    enabled: true
+    minAvailable: 2
+  worker:
+    enabled: true
+    minAvailable: 2
+
+image:
+  repository: ghcr.io/goauthentik/server
+  tag: 2023.8.3
+  pullPolicy: IfNotPresent
+
+ingress:
+  enabled: true
+  hosts:
+    - host: authentik.domain.tld
+      paths:
+        - path: "/"
+          pathType: Prefix
+
+authentik:
+  log_level: debug
+  secret_key: 5up3r53cr37K3y
+  postgresql:
+    password: au7h3n71k
+  redis:
+    password: au7h3n71k
+
+postgresql:
+  enabled: false
+  postgresqlPassword: au7h3n71k
+  persistence:
+    enabled: false
+
+redis:
+  enabled: false
+  auth:
+    enabled: true
+    password: au7h3n71k
+
+blueprints:
+  - authentik-ci-blueprint
+
+geoip:
+  enabled: true
+  accountId: "foo-account-id"
+  licenseKey: "foo-license-key"

charts/authentik/templates/server-pdb.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.pdb.server.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ printf "%s-%s" (include "authentik.names.fullname" $) "server" }}
+  labels:
+    {{- include "authentik.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: "server"
+    {{- with $.Values.pdb.server.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{- toYaml $.Values.pdb.server.annotations | nindent 4 }}
+spec:
+  {{- with $.Values.pdb.server.maxUnavailable }}
+  maxUnavailable: {{ . }}
+  {{- else }}
+  minAvailable: {{ $.Values.pdb.server.minAvailable | default 0 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "authentik.labels" $ | nindent 6 }}
+      app.kubernetes.io/component: server
+{{- end }}

charts/authentik/templates/worker-pdb.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.pdb.worker.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ printf "%s-%s" (include "authentik.names.fullname" $) "worker" }}
+  labels:
+    {{- include "authentik.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: "worker"
+    {{- with $.Values.pdb.worker.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{- toYaml $.Values.pdb.worker.annotations | nindent 4 }}
+spec:
+  {{- with $.Values.pdb.worker.maxUnavailable }}
+  maxUnavailable: {{ . }}
+  {{- else }}
+  minAvailable: {{ $.Values.pdb.worker.minAvailable | default 0 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "authentik.labels" $ | nindent 6 }}
+      app.kubernetes.io/component: worker
+{{- end }}

charts/authentik/values.yaml

@@ -165,6 +165,34 @@ autoscaling:
     maxReplicas: 5
     targetCPUUtilizationPercentage: 80
 
+pdb:
+  server:
+    # -- Deploy a PodDistrubtionBudget for the server
+    enabled: false
+    # -- Labels to be added to the server pdb
+    labels: {}
+    # -- Annotations to be added to the server pdb
+    annotations: {}
+    # -- Number of pods that are available after eviction as number or percentage (eg.: 50%)
+    # @default -- `""` (defaults to 0 if not specified)
+    minAvailable: ""
+    # -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%)
+    ## Has higher precedence over `pdb.server.minAvailable`
+    maxUnavailable: ""
+  worker:
+    # -- Deploy a PodDistrubtionBudget for the worker
+    enabled: false
+    # -- Labels to be added to the worker pdb
+    labels: {}
+    # -- Annotations to be added to the worker pdb
+    annotations: {}
+    # -- Number of pods that are available after eviction as number or percentage (eg.: 50%)
+    # @default -- `""` (defaults to 0 if not specified)
+    minAvailable: ""
+    # -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%)
+    ## Has higher precedence over `pdb.worker.minAvailable`
+    maxUnavailable: ""
+
 livenessProbe:
   # -- enables or disables the livenessProbe
   enabled: true