Skip to content

Commit 9acfbca

Browse files
ab-andrescsalonichf5
ab-andresc
authored and
salonichf5
committed
gives enough time for argocd to verify job has finished (#3487)
Problem: Argocd can never find the job completion as TTL is set to 0 Solution: Sets the default ttl seconds to 30 so that argocd has enough time to verify.
1 parent 179a5ea commit 9acfbca

File tree

13 files changed

+84
-11
lines changed

13 files changed

+84
-11
lines changed

‎charts/nginx-gateway-fabric/README.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -252,11 +252,16 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
252252

253253
| Key | Description | Type | Default |
254254
|-----|-------------|------|---------|
255-
| `certGenerator` | The certGenerator section contains the configuration for the cert-generator Job. | object | `{"agentTLSSecretName":"agent-tls","annotations":{},"overwrite":false,"serverTLSSecretName":"server-tls"}` |
255+
| `certGenerator` | The certGenerator section contains the configuration for the cert-generator Job. | object | `{"affinity":{},"agentTLSSecretName":"agent-tls","annotations":{},"nodeSelector":{},"overwrite":false,"serverTLSSecretName":"server-tls","tolerations":[],"topologySpreadConstraints":[],"ttlSecondsAfterFinished":30}` |
256+
| `certGenerator.affinity` | The affinity of the cert-generator pod. | object | `{}` |
256257
| `certGenerator.agentTLSSecretName` | The name of the base Secret containing TLS CA, certificate, and key for the NGINX Agent to securely communicate with the NGINX Gateway Fabric control plane. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"agent-tls"` |
257258
| `certGenerator.annotations` | The annotations of the cert-generator Job. | object | `{}` |
259+
| `certGenerator.nodeSelector` | The nodeSelector of the cert-generator pod. | object | `{}` |
258260
| `certGenerator.overwrite` | Overwrite existing TLS Secrets on startup. | bool | `false` |
259261
| `certGenerator.serverTLSSecretName` | The name of the Secret containing TLS CA, certificate, and key for the NGINX Gateway Fabric control plane to securely communicate with the NGINX Agent. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"server-tls"` |
262+
| `certGenerator.tolerations` | Tolerations for the cert-generator pod. | list | `[]` |
263+
| `certGenerator.topologySpreadConstraints` | The topology spread constraints for the cert-generator pod. | list | `[]` |
264+
| `certGenerator.ttlSecondsAfterFinished` | How long to wait after the cert generator job has finished before it is removed by the job controller. | int | `30` |
260265
| `clusterDomain` | The DNS cluster domain of your Kubernetes cluster. | string | `"cluster.local"` |
261266
| `gateways` | A list of Gateway objects. View https://gateway-api.sigs.k8s.io/reference/spec/#gateway for full Gateway reference. | list | `[]` |
262267
| `nginx` | The nginx section contains the configuration for all NGINX data plane deployments installed by the NGINX Gateway Fabric control plane. | object | `{"config":{},"container":{},"debug":false,"image":{"pullPolicy":"IfNotPresent","repository":"ghcr.io/nginx/nginx-gateway-fabric/nginx","tag":"2.0.0"},"imagePullSecret":"","imagePullSecrets":[],"kind":"deployment","plus":false,"pod":{},"replicas":1,"service":{"externalTrafficPolicy":"Local","loadBalancerClass":"","loadBalancerIP":"","loadBalancerSourceRanges":[],"nodePorts":[],"type":"LoadBalancer"},"usage":{"caSecretName":"","clientSSLSecretName":"","endpoint":"","resolver":"","secretName":"nplus-license","skipVerify":false}}` |

‎charts/nginx-gateway-fabric/templates/certs-job.yaml

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,4 +153,20 @@ spec:
153153
securityContext:
154154
fsGroup: 1001
155155
runAsNonRoot: true
156-
ttlSecondsAfterFinished: 0
156+
{{- if .Values.certGenerator.topologySpreadConstraints }}
157+
topologySpreadConstraints:
158+
{{- toYaml .Values.certGenerator.topologySpreadConstraints | nindent 6 }}
159+
{{- end }}
160+
{{- if .Values.certGenerator.affinity }}
161+
affinity:
162+
{{- toYaml .Values.certGenerator.affinity | nindent 8 }}
163+
{{- end }}
164+
{{- if .Values.certGenerator.tolerations }}
165+
tolerations:
166+
{{- toYaml .Values.certGenerator.tolerations | nindent 6 }}
167+
{{- end }}
168+
{{- if .Values.certGenerator.nodeSelector }}
169+
nodeSelector:
170+
{{- toYaml .Values.certGenerator.nodeSelector | nindent 8 }}
171+
{{- end }}
172+
ttlSecondsAfterFinished: {{ .Values.certGenerator.ttlSecondsAfterFinished }}

‎charts/nginx-gateway-fabric/values.schema.json

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@
44
"certGenerator": {
55
"description": "The certGenerator section contains the configuration for the cert-generator Job.",
66
"properties": {
7+
"affinity": {
8+
"description": "The affinity of the cert-generator pod.",
9+
"required": [],
10+
"title": "affinity",
11+
"type": "object"
12+
},
713
"agentTLSSecretName": {
814
"default": "agent-tls",
915
"description": "The name of the base Secret containing TLS CA, certificate, and key for the NGINX Agent to securely\ncommunicate with the NGINX Gateway Fabric control plane. Must exist in the same namespace that the\nNGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).",
@@ -17,6 +23,12 @@
1723
"title": "annotations",
1824
"type": "object"
1925
},
26+
"nodeSelector": {
27+
"description": "The nodeSelector of the cert-generator pod.",
28+
"required": [],
29+
"title": "nodeSelector",
30+
"type": "object"
31+
},
2032
"overwrite": {
2133
"default": false,
2234
"description": "Overwrite existing TLS Secrets on startup.",
@@ -30,6 +42,31 @@
3042
"required": [],
3143
"title": "serverTLSSecretName",
3244
"type": "string"
45+
},
46+
"tolerations": {
47+
"description": "Tolerations for the cert-generator pod.",
48+
"items": {
49+
"required": []
50+
},
51+
"required": [],
52+
"title": "tolerations",
53+
"type": "array"
54+
},
55+
"topologySpreadConstraints": {
56+
"description": "The topology spread constraints for the cert-generator pod.",
57+
"items": {
58+
"required": []
59+
},
60+
"required": [],
61+
"title": "topologySpreadConstraints",
62+
"type": "array"
63+
},
64+
"ttlSecondsAfterFinished": {
65+
"default": 30,
66+
"description": "How long to wait after the cert generator job has finished before it is removed by the job controller.",
67+
"required": [],
68+
"title": "ttlSecondsAfterFinished",
69+
"type": "integer"
3370
}
3471
},
3572
"required": [],

‎charts/nginx-gateway-fabric/values.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -479,6 +479,21 @@ certGenerator:
479479
# -- Overwrite existing TLS Secrets on startup.
480480
overwrite: false
481481

482+
# -- How long to wait after the cert generator job has finished before it is removed by the job controller.
483+
ttlSecondsAfterFinished: 30
484+
485+
# -- Tolerations for the cert-generator pod.
486+
tolerations: []
487+
488+
# -- The nodeSelector of the cert-generator pod.
489+
nodeSelector: {}
490+
491+
# -- The affinity of the cert-generator pod.
492+
affinity: {}
493+
494+
# -- The topology spread constraints for the cert-generator pod.
495+
topologySpreadConstraints: []
496+
482497
# -- A list of Gateway objects. View https://gateway-api.sigs.k8s.io/reference/spec/#gateway for full Gateway reference.
483498
gateways: []
484499

‎deploy/azure/deploy.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -367,7 +367,7 @@ spec:
367367
fsGroup: 1001
368368
runAsNonRoot: true
369369
serviceAccountName: nginx-gateway-cert-generator
370-
ttlSecondsAfterFinished: 0
370+
ttlSecondsAfterFinished: 30
371371
---
372372
apiVersion: gateway.networking.k8s.io/v1
373373
kind: GatewayClass

‎deploy/default/deploy.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -365,7 +365,7 @@ spec:
365365
fsGroup: 1001
366366
runAsNonRoot: true
367367
serviceAccountName: nginx-gateway-cert-generator
368-
ttlSecondsAfterFinished: 0
368+
ttlSecondsAfterFinished: 30
369369
---
370370
apiVersion: gateway.networking.k8s.io/v1
371371
kind: GatewayClass

‎deploy/experimental-nginx-plus/deploy.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -373,7 +373,7 @@ spec:
373373
fsGroup: 1001
374374
runAsNonRoot: true
375375
serviceAccountName: nginx-gateway-cert-generator
376-
ttlSecondsAfterFinished: 0
376+
ttlSecondsAfterFinished: 30
377377
---
378378
apiVersion: gateway.networking.k8s.io/v1
379379
kind: GatewayClass

‎deploy/experimental/deploy.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -370,7 +370,7 @@ spec:
370370
fsGroup: 1001
371371
runAsNonRoot: true
372372
serviceAccountName: nginx-gateway-cert-generator
373-
ttlSecondsAfterFinished: 0
373+
ttlSecondsAfterFinished: 30
374374
---
375375
apiVersion: gateway.networking.k8s.io/v1
376376
kind: GatewayClass

‎deploy/nginx-plus/deploy.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -368,7 +368,7 @@ spec:
368368
fsGroup: 1001
369369
runAsNonRoot: true
370370
serviceAccountName: nginx-gateway-cert-generator
371-
ttlSecondsAfterFinished: 0
371+
ttlSecondsAfterFinished: 30
372372
---
373373
apiVersion: gateway.networking.k8s.io/v1
374374
kind: GatewayClass

‎deploy/nodeport/deploy.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -365,7 +365,7 @@ spec:
365365
fsGroup: 1001
366366
runAsNonRoot: true
367367
serviceAccountName: nginx-gateway-cert-generator
368-
ttlSecondsAfterFinished: 0
368+
ttlSecondsAfterFinished: 30
369369
---
370370
apiVersion: gateway.networking.k8s.io/v1
371371
kind: GatewayClass

0 commit comments

Comments
 (0)