feat: add helm values for affinity and ns on fabric ds

Author: fra98

deployments/liqo/README.md

@@ -12,12 +12,12 @@
 | authentication.awsConfig.useExistingSecret | bool | `false` | Use an existing secret to configure the AWS credentials. |
 | authentication.enabled | bool | `true` | Enable/Disable the authentication module. |
 | authentication.tlsCompatibilityMode | bool | `false` | Enable TLS compatibility mode for client certificates and keys. If set to true, Liqo will use widely supported algorithm (RSA) instead of Ed25519 (default) for generating private keys and CSRs. Enable this option to ensure compatibility with systems that do not yet support Ed25519 as signature algorithm. |
-| common.affinity | object | `{}` | Affinity for all liqo pods, excluding virtual kubelet. |
+| common.affinity | object | `{}` | Affinity for all liqo pods, excluding virtual kubelet pod and fabric daemonset. |
 | common.extraArgs | list | `[]` | Extra arguments for all liqo pods, excluding virtual kubelet. |
 | common.globalAnnotations | object | `{}` | Global annotations to be added to all resources created by Liqo controllers |
 | common.globalLabels | object | `{"liqo.io/managed":"true"}` | Global labels to be added to all resources created by Liqo controllers |
-| common.nodeSelector | object | `{}` | NodeSelector for all liqo pods, excluding virtual kubelet. |
-| common.tolerations | list | `[]` | Tolerations for all liqo pods, excluding virtual kubelet. |
+| common.nodeSelector | object | `{}` | NodeSelector for all liqo pods, excluding virtual kubelet pod and fabric daemonset. |
+| common.tolerations | list | `[]` | Tolerations for all liqo pods, excluding virtual kubelet pod and fabric daemonset. |
 | controllerManager.config.defaultLimitsEnforcement | string | `"None"` | Defines how strict is the enforcement of the quota offered by the remote cluster. enableResourceEnforcement must be enabled to use this feature. Possible values are: None, Soft, Hard. None: the offloaded pods might not have the resource `requests` or `limits`. Soft: it forces the offloaded pods to have `requests` set. If the pods go over the requests, the total used resources might go over the quota. Hard: it forces the offloaded pods to have `limits` and `requests` set, with `requests` == `limits`. This is the safest mode as the consumer cluster cannot go over the quota. |
 | controllerManager.config.enableNodeFailureController | bool | `false` | Ensure offloaded pods running on a failed node are evicted and rescheduled on a healthy node, preventing them to remain in a terminating state indefinitely. This feature can be useful in case of remote node failure to guarantee better service continuity and to have the expected pods workload on the remote cluster. However, enabling this feature could produce zombies in the worker node, in case the node returns Ready again without a restart. |
 | controllerManager.config.enableResourceEnforcement | bool | `true` | It enforces offerer-side that offloaded pods do not exceed offered resources (based on container limits). This feature is suggested to be enabled when consumer-side enforcement is not sufficient. It makes sure that the sum of the requests of the offloaded pods never exceeds the quota offered by the remote cluster. The quota can be still exceeded if no limits and requests are defined in the offloaded pods or if the limits are larger than the requests. For a stricter enforcement, the defaultLimitsEnforcement can be set to Hard. |
@@ -93,12 +93,14 @@
 | networking.fabric.config.nftablesMonitor | bool | `false` | Enable/Disable the nftables monitor for the fabric pod. It means that the fabric pod will monitor the nftables rules and will restore them in case of changes. In some cases (like K3S), this monitor can cause a huge amount of CPU usage. If you are experiencing high CPU usage, you can disable this feature. |
 | networking.fabric.image.name | string | `"ghcr.io/liqotech/fabric"` | Image repository for the fabric pod. |
 | networking.fabric.image.version | string | `""` | Custom version for the fabric image. If not specified, the global tag is used. |
+| networking.fabric.pod.affinity | object | `{}` | Affinity for the fabric pod. |
 | networking.fabric.pod.annotations | object | `{}` | Annotations for the fabric pod. |
 | networking.fabric.pod.extraArgs | list | `[]` | Extra arguments for the fabric pod. |
 | networking.fabric.pod.labels | object | `{}` | Labels for the fabric pod. |
+| networking.fabric.pod.nodeSelector | object | `{}` | NodeSelector for the fabric pod. |
 | networking.fabric.pod.priorityClassName | string | `""` | PriorityClassName (https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority) for the fabric pod. |
 | networking.fabric.pod.resources | object | `{"limits":{},"requests":{}}` | Resource requests and limits (https://kubernetes.io/docs/user-guide/compute-resources/) for the fabric pod. |
-| networking.fabric.tolerations | list | `[]` | Extra tolerations for the fabric daemonset. |
+| networking.fabric.pod.tolerations | list | `[]` | Extra tolerations for the fabric pod. |
 | networking.gatewayTemplates | object | `{"container":{"gateway":{"image":{"name":"ghcr.io/liqotech/gateway","version":""}},"geneve":{"image":{"name":"ghcr.io/liqotech/gateway/geneve","version":""}},"wireguard":{"image":{"name":"ghcr.io/liqotech/gateway/wireguard","version":""}}},"ping":{"interval":"2s","lossThreshold":5,"updateStatusInterval":"10s"},"replicas":1,"server":{"service":{"allocateLoadBalancerNodePorts":"","annotations":{}}},"wireguard":{"implementation":"kernel"}}` | Set the options for the default gateway (server/client) templates. The default templates use a WireGuard implementation to connect the gateway of the clusters. These options are used to configure only the default templates and should not be considered if a custom template is used. |
 | networking.gatewayTemplates.container.gateway.image.name | string | `"ghcr.io/liqotech/gateway"` | Image repository for the gateway container. |
 | networking.gatewayTemplates.container.gateway.image.version | string | `""` | Custom version for the gateway image. If not specified, the global tag is used. |

deployments/liqo/templates/liqo-fabric-daemonset.yaml

@@ -25,6 +25,14 @@ spec:
           {{- toYaml .Values.networking.fabric.pod.labels | nindent 8 }}
         {{- end }}
     spec:
+      {{- if .Values.networking.fabric.pod.nodeSelector }}
+      nodeSelector:
+      {{- toYaml .Values.networking.fabric.pod.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.networking.fabric.pod.affinity }}
+      affinity:
+      {{- toYaml .Values.networking.fabric.pod.affinity | nindent 8 }}
+      {{- end }}
       tolerations:
         - key: CriticalAddonsOnly
           operator: Exists
@@ -34,11 +42,11 @@ spec:
           key: node-role.kubernetes.io/infra
         - effect: NoSchedule
           key: node-role.kubernetes.io/control-plane
-        {{- if .Values.networking.fabric.tolerations }}
-        {{- toYaml .Values.networking.fabric.tolerations | nindent 8 }}
+        {{- if .Values.networking.fabric.pod.tolerations }}
+        {{- toYaml .Values.networking.fabric.pod.tolerations | nindent 8 }}
         {{- end }}
       serviceAccountName: {{ include "liqo.prefixedName" $fabricConfig }}
-      {{- include "liqo.imagePullSecrets" . | nindent 6 }}
+      {{- include "liqo.imagePullSecrets" . | nindent 6 -}}
       containers:
         - image: {{ .Values.networking.fabric.image.name }}{{ include "liqo.suffix" $fabricConfig }}:{{ include "liqo.version" $fabricConfig }}
           imagePullPolicy: {{ .Values.pullPolicy }}
@@ -98,5 +106,4 @@ spec:
       {{- if .Values.networking.fabric.pod.priorityClassName }}
       priorityClassName: {{ .Values.networking.fabric.pod.priorityClassName }}
       {{- end }}
-
 {{- end }}

deployments/liqo/values.yaml

@@ -101,6 +101,12 @@ networking:
       labels: {}
       # -- Extra arguments for the fabric pod.
       extraArgs: []
+      # -- NodeSelector for the fabric pod.
+      nodeSelector: {}
+      # -- Extra tolerations for the fabric pod.
+      tolerations: []
+      # -- Affinity for the fabric pod.
+      affinity: {}
       # -- Resource requests and limits (https://kubernetes.io/docs/user-guide/compute-resources/) for the fabric pod.
       resources:
         limits: {}
@@ -112,8 +118,6 @@ networking:
       name: "ghcr.io/liqotech/fabric"
       # -- Custom version for the fabric image. If not specified, the global tag is used.
       version: ""
-    # -- Extra tolerations for the fabric daemonset.
-    tolerations: []
     config:
       # -- Enabe/Disable the full masquerade mode for the fabric pod.
       # It means that all traffic will be masquerade using the first external cidr IP, instead of using the pod IP.
@@ -304,11 +308,11 @@ storage:
   storageNamespace: liqo-storage
 
 common:
-  # -- NodeSelector for all liqo pods, excluding virtual kubelet.
+  # -- NodeSelector for all liqo pods, excluding virtual kubelet pod and fabric daemonset.
   nodeSelector: {}
-  # -- Tolerations for all liqo pods, excluding virtual kubelet.
+  # -- Tolerations for all liqo pods, excluding virtual kubelet pod and fabric daemonset.
   tolerations: []
-  # -- Affinity for all liqo pods, excluding virtual kubelet.
+  # -- Affinity for all liqo pods, excluding virtual kubelet pod and fabric daemonset.
   affinity: {}
   # -- Extra arguments for all liqo pods, excluding virtual kubelet.
   extraArgs: []