Affinity

Pod constraints for this package are implemented following the kubernetes affinity documentation. Gatekeeper pods can be constrained using nodeSelector, nodeAffinity, or the pod Affinity/Anti-affinity feature.

These values are set per component under upstream. The components that accept them are controllerManager, audit, crds, postInstall, postUpgrade, and preUninstall. The examples below use controllerManager.

nodeSelector

in the values.yaml add nodeSelector like:

upstream:
  controllerManager:
    nodeSelector:
      <key>: <value>

nodeAffinity

in the values.yaml, add nodeAffinity like:

upstream:
  controllerManager:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: kubernetes.io/e2e-az-name
              operator: In
              values:
              - e2e-az1
              - e2e-az2
        preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 1
          preference:
            matchExpressions:
            - key: another-node-label-key
              operator: In
              values:
              - another-node-label-value

podAffinity

In values.yaml add pod affinity/anti-affinity like:

upstream:
  controllerManager:
    affinity:
      podAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchExpressions:
            - key: security
              operator: In
              values:
              - S1
          topologyKey: topology.kubernetes.io/zone
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 100
          podAffinityTerm:
            labelSelector:
              matchExpressions:
              - key: security
                operator: In
                values:
                - S2
            topologyKey: topology.kubernetes.io/zone