Add optional PodDisruptionBudget to the Helm chart

deploy/charts/approver-policy/templates/NOTES.txt

@@ -0,0 +1,17 @@
+{{- if (lt (int .Values.replicaCount) 2) }}
+⚠️  WARNING: Consider increasing the Helm value `replicaCount` to 2 if you require high availability.
+{{- end }}
+
+{{- if (not .Values.podDisruptionBudget.enabled) }}
+⚠️  WARNING: Consider setting the Helm value `podDisruptionBudget.enabled` to true if you require high availability.
+{{- end }}
+
+CHART NAME: {{ .Chart.Name }}
+CHART VERSION: {{ .Chart.Version }}
+APP VERSION: {{ .Chart.AppVersion }}
+
+{{ .Chart.Name }} is a cert-manager project.
+
+If you're a new user, we recommend that you read the [cert-manager Approval Policy documentation] to learn more.
+
+[cert-manager Approval Policy documentation]: https://cert-manager.io/docs/policy/approval/

deploy/charts/approver-policy/templates/_helpers.tpl

@@ -41,3 +41,19 @@ See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linke
 {{- if .digest -}}{{ printf "@%s" .digest }}{{- else -}}{{ printf ":%s" (default $defaultTag .tag) }}{{- end -}}
 {{- end }}
 {{- end }}
+
+{{/*
+Copied from
+https://github.com/kyverno/kyverno/blob/df5e39c005a78f1ffe6a2eeda3f4497cc9c24384/charts/kyverno/templates/_helpers/_pdb.tpl
+*/}}
+{{- define "cert-manager-approver-policy.pdb.spec" -}}
+{{- if and .minAvailable .maxUnavailable -}}
+  {{- fail "Cannot set both .minAvailable and .maxUnavailable" -}}
+{{- end -}}
+{{- if not .maxUnavailable -}}
+minAvailable: {{ default 1 .minAvailable }}
+{{- end -}}
+{{- if .maxUnavailable -}}
+maxUnavailable: {{ .maxUnavailable }}
+{{- end -}}
+{{- end -}}

deploy/charts/approver-policy/templates/poddisruptionbudget.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.podDisruptionBudget.enabled -}}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "cert-manager-approver-policy.name" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "cert-manager-approver-policy.labels" . | nindent 4 }}
+spec:
+  {{- include "cert-manager-approver-policy.pdb.spec" .Values.podDisruptionBudget | nindent 2 }}
+  selector:
+    matchLabels:
+      app: {{ include "cert-manager-approver-policy.name" . }}
+{{- end -}}

deploy/charts/approver-policy/values.schema.json

@@ -21,6 +21,9 @@
         "podAnnotations": {
           "$ref": "#/$defs/helm-values.podAnnotations"
         },
+        "podDisruptionBudget": {
+          "$ref": "#/$defs/helm-values.podDisruptionBudget"
+        },
         "replicaCount": {
           "$ref": "#/$defs/helm-values.replicaCount"
         },
@@ -358,6 +361,34 @@
       "description": "Allow custom annotations to be placed on cert-manager-approver pod - optional.",
       "type": "object"
     },
+    "helm-values.podDisruptionBudget": {
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "$ref": "#/$defs/helm-values.podDisruptionBudget.enabled"
+        },
+        "maxUnavailable": {
+          "$ref": "#/$defs/helm-values.podDisruptionBudget.maxUnavailable"
+        },
+        "minAvailable": {
+          "$ref": "#/$defs/helm-values.podDisruptionBudget.minAvailable"
+        }
+      },
+      "type": "object"
+    },
+    "helm-values.podDisruptionBudget.enabled": {
+      "default": false,
+      "description": "Enable or disable the PodDisruptionBudget resource.\n\nThis prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget blocks `kubectl drain` if it is used on the Node where the only remaining approver-policy\nPod is currently running.",
+      "type": "boolean"
+    },
+    "helm-values.podDisruptionBudget.maxUnavailable": {
+      "description": "Configures the maximum unavailable pods for disruptions.\nCannot be used if `minAvailable` is set.",
+      "type": "number"
+    },
+    "helm-values.podDisruptionBudget.minAvailable": {
+      "description": "Configures the minimum available pods for disruptions.\nCannot be used if `maxUnavailable` is set.",
+      "type": "number"
+    },
     "helm-values.replicaCount": {
       "default": 1,
       "description": "Number of replicas of approver-policy to run.",

deploy/charts/approver-policy/values.yaml

@@ -50,7 +50,7 @@ app:
 
   # List if signer names that approver-policy will be given permission to
   # approve and deny. CertificateRequests referencing these signer names can be
-  # processed by approver-policy. 
+  # processed by approver-policy.
   #
   # ref: https://cert-manager.io/docs/concepts/certificaterequest/#approval
   # +docs:property
@@ -72,7 +72,7 @@ app:
         # Create Prometheus ServiceMonitor resource for approver-policy.
         enabled: false
         # The value for the "prometheus" label on the ServiceMonitor. This allows
-        # for multiple Prometheus instances selecting difference ServiceMonitors 
+        # for multiple Prometheus instances selecting difference ServiceMonitors
         # using label selectors.
         prometheusInstance: default
         # The interval that the Prometheus will scrape for metrics.
@@ -143,6 +143,26 @@ app:
     #     effect: NoSchedule
     tolerations: []
 
+podDisruptionBudget:
+  # Enable or disable the PodDisruptionBudget resource.
+  #
+  # This prevents downtime during voluntary disruptions such as during a Node upgrade.
+  # For example, the PodDisruptionBudget blocks `kubectl drain`
+  # if it is used on the Node where the only remaining approver-policy
+  # Pod is currently running.
+  enabled: false
+
+  # Configures the minimum available pods for disruptions.
+  # Cannot be used if `maxUnavailable` is set.
+  # +docs:property
+  # minAvailable: 1
+
+  # Configures the maximum unavailable pods for disruptions.
+  # Cannot be used if `minAvailable` is set.
+  # +docs:property
+  # maxUnavailable: 1
+
+
 # Optional extra volume mounts. Useful for mounting custom root CAs.
 #
 # For example: