You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The admission controller requires a `MutatingWebhookConfiguration` and TLS certificates. This chart supports two mutually exclusive modes:
30
+
31
+
### Helm-managed (default)
32
+
```yaml
33
+
admissionController:
34
+
registerWebhook: false
35
+
certGen:
36
+
enabled: true
37
+
```
38
+
In this mode:
39
+
- Helm creates the MutatingWebhookConfiguration
40
+
- The kube-webhook-certgen job generates TLS certificates and stores them in a Secret
41
+
- The certificates are automatically injected into the webhook configuration
42
+
43
+
### Application-managed
44
+
```yaml
45
+
admissionController:
46
+
registerWebhook: true
47
+
certGen:
48
+
enabled: false
49
+
```
50
+
In this mode:
51
+
- The VPA admission controller creates and manages the webhook itself
52
+
Important: You are responsible for creating the TLS secret before or after installing the chart. The admission controller will only create the `MutatingWebhookConfiguration` once the secret exists.
53
+
If the secret is created after the Helm install, you must restart the admission controller pod to trigger webhook registration.
54
+
55
+
## Migration Guides
56
+
57
+
### Migrating from vpa-up.sh script
58
+
TBD
59
+
60
+
### Migrating from Application-managed to Helm-managed webhook
61
+
If you previously deployed with registerWebhook: true and want to switch to Helm-managed:
| admissionController.certGen.env | object | `{}` | Additional environment variables to be added to the certgen container. Format is KEY: Value format |
87
+
| admissionController.certGen.image.pullPolicy | string | `"IfNotPresent"` | The pull policy for the certgen image. Recommend not changing this |
88
+
| admissionController.certGen.image.repository | string | `"registry.k8s.io/ingress-nginx/kube-webhook-certgen"` | An image that contains certgen for creating certificates. |
89
+
| admissionController.certGen.image.tag | string | `"v20231011-8b53cabe0"` | An image tag for the admissionController.certGen.image.repository image. |
| admissionController.certGen.podSecurityContext | object | `{"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | The securityContext block for the certgen pod(s) |
92
+
| admissionController.certGen.resources | object | `{}` | The resources block for the certgen pod |
93
+
| admissionController.certGen.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true}` | The securityContext block for the certgen container(s) |
94
+
| admissionController.certGen.tolerations | list | `[]` | |
| admissionController.mutatingWebhookConfiguration.annotations | object | `{}` | Additional annotations for the MutatingWebhookConfiguration |
102
+
| admissionController.mutatingWebhookConfiguration.failurePolicy | string | `"Ignore"` | The failurePolicy for the mutating webhook. Allowed values are: Ignore, Fail |
103
+
| admissionController.mutatingWebhookConfiguration.namespaceSelector | object | `{}` | The namespaceSelector controls which namespaces are affected by the webhook |
104
+
| admissionController.mutatingWebhookConfiguration.objectSelector | object | `{}` | The objectSelector can filter objects on e.g. labels |
105
+
| admissionController.mutatingWebhookConfiguration.timeoutSeconds | int | `5` | Sets the amount of time the API server will wait on a response from the webhook service |
| admissionController.podDisruptionBudget.maxUnavailable | int or string | `nil` | Maximum number/percentage of pods that can be unavailable after the eviction. IMPORTANT: You can specify either 'minAvailable' or 'maxUnavailable', but not both. |
46
110
| admissionController.podDisruptionBudget.minAvailable | int or string | `1` | Minimum number/percentage of pods that must be available after the eviction. IMPORTANT: You can specify either 'minAvailable' or 'maxUnavailable', but not both. |
The admission controller requires a `MutatingWebhookConfiguration` and TLS certificates. This chart supports two mutually exclusive modes:
27
+
28
+
### Helm-managed (default)
29
+
```yaml
30
+
admissionController:
31
+
registerWebhook: false
32
+
certGen:
33
+
enabled: true
34
+
```
35
+
In this mode:
36
+
- Helm creates the MutatingWebhookConfiguration
37
+
- The kube-webhook-certgen job generates TLS certificates and stores them in a Secret
38
+
- The certificates are automatically injected into the webhook configuration
39
+
40
+
### Application-managed
41
+
```yaml
42
+
admissionController:
43
+
registerWebhook: true
44
+
certGen:
45
+
enabled: false
46
+
```
47
+
In this mode:
48
+
- The VPA admission controller creates and manages the webhook itself
49
+
Important: You are responsible for creating the TLS secret before or after installing the chart. The admission controller will only create the `MutatingWebhookConfiguration` once the secret exists.
50
+
If the secret is created after the Helm install, you must restart the admission controller pod to trigger webhook registration.
51
+
52
+
## Migration Guides
53
+
54
+
### Migrating from vpa-up.sh script
55
+
TBD
56
+
57
+
### Migrating from Application-managed to Helm-managed webhook
58
+
If you previously deployed with registerWebhook: true and want to switch to Helm-managed:
0 commit comments