Added support for configuring utillity pods

Author: SlyngDK

dist/chart/values.yaml

@@ -53,6 +53,15 @@ controllerManager:
 #          level: debug
 #    reboot:
 #      checkInterval: 5m
+#    pod:
+#      podPriorityClassName: ""
+#      containerResources:
+#        requests:
+#          cpu: 10m
+#          memory: 16Mi
+#        limits:
+#          cpu: 100m
+#          memory: 32Mi
 #
 #    plugins:
 #      example-plugin:

internal/config/config.go

@@ -16,6 +16,8 @@ import (
 	"github.com/knadh/koanf/providers/rawbytes"
 	"github.com/knadh/koanf/v2"
 	pluginv1 "github.com/slyngdk/node-drain/api/plugins/proto/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
 )
 
 //go:embed default-config.yaml
@@ -37,9 +39,45 @@ type Config struct {
 	Reboot struct {
 		CheckInterval time.Duration `koanf:"checkInterval"`
 	}
+	Pod struct {
+		PriorityClassName  string             `koanf:"priorityClassName"`
+		ContainerResources ContainerResources `koanf:"containerResources"`
+	} `koanf:"pod"`
 	ContainerNode bool `koanf:"containerNode"`
 }
 
+type ContainerResources struct {
+	Requests ResourceList `koanf:"requests"`
+	Limits   ResourceList `koanf:"limits"`
+}
+
+func (c *ContainerResources) ToResourceRequirement() corev1.ResourceRequirements {
+	requirements := corev1.ResourceRequirements{
+		Requests: c.Requests.toKubernetes(),
+		Limits:   c.Limits.toKubernetes(),
+	}
+	return requirements
+}
+
+type ResourceList struct {
+	Memory string `koanf:"memory"`
+	CPU    string `koanf:"cpu"`
+}
+
+func (c *ResourceList) toKubernetes() corev1.ResourceList {
+	if c.CPU != "" && c.Memory != "" {
+		list := corev1.ResourceList{}
+		if c.CPU != "" {
+			list[corev1.ResourceCPU] = resource.MustParse(c.CPU)
+		}
+		if c.Memory != "" {
+			list[corev1.ResourceMemory] = resource.MustParse(c.Memory)
+		}
+		return list
+	}
+	return nil
+}
+
 func (c *Config) GetLogger(name string) Logger {
 	if logger, ok := c.Log.Loggers[name]; ok {
 		if logger.Level == "" {

internal/config/default-config.yaml

@@ -4,3 +4,11 @@ log:
   format: json
 reboot:
   checkInterval: 12h
+pod:
+  containerResources:
+    requests:
+      cpu: 10m
+      memory: 16Mi
+    limits:
+      cpu: 100m
+      memory: 32Mi

internal/utils/reboot-manager.go

@@ -115,6 +115,7 @@ func (r *RebootManager) rebootRequiredPod(nodeName string) *corev1.Pod {
 					ReadOnly:  true,
 					MountPath: "/host/var/run",
 				}},
+				Resources: config.GetConfig().Pod.ContainerResources.ToResourceRequirement(),
 			}},
 			RestartPolicy:                 "Never",
 			TerminationGracePeriodSeconds: PtrTo(int64(1)),
@@ -133,6 +134,7 @@ func (r *RebootManager) rebootRequiredPod(nodeName string) *corev1.Pod {
 				Operator: corev1.TolerationOpExists,
 				Effect:   corev1.TaintEffectNoSchedule,
 			}},
+			PriorityClassName: config.GetConfig().Pod.PriorityClassName,
 		},
 	}
 }
@@ -169,7 +171,6 @@ func (r *RebootManager) rebootNodePod(nodeName string) *corev1.Pod {
 			GenerateName: "reboot-",
 			Namespace:    r.namespace,
 			Labels:       map[string]string{LabelComponent: "reboot"},
-			Annotations:  map[string]string{"container.apparmor.security.beta.kubernetes.io/shell": "unconfined"},
 		},
 		Spec: corev1.PodSpec{
 			Tolerations: []corev1.Toleration{{
@@ -196,8 +197,15 @@ func (r *RebootManager) rebootNodePod(nodeName string) *corev1.Pod {
 					Privileged:               PtrTo(false),
 					ReadOnlyRootFilesystem:   PtrTo(true),
 				},
+				Resources: config.GetConfig().Pod.ContainerResources.ToResourceRequirement(),
 			}},
-			RestartPolicy: "Never",
+			RestartPolicy:     "Never",
+			PriorityClassName: config.GetConfig().Pod.PriorityClassName,
+			SecurityContext: &corev1.PodSecurityContext{
+				AppArmorProfile: &corev1.AppArmorProfile{
+					Type: corev1.AppArmorProfileTypeUnconfined,
+				},
+			},
 		},
 	}
 }