spire: add scheduling configurations to helm-chart

Previously, it was not possible to run the spire-agent on nodes with
taints like the cilium-agent does by default. This feature matches
similar behaviour.

Added as well options to define affinity, nodeSelector and tolerations
for spire-server.

Fixes: #27228

Signed-off-by: Thorben von Hacht <tvonhacht@apple.com>

install/kubernetes/cilium/templates/spire/agent/daemonset.yaml

@@ -64,6 +64,10 @@ spec:
               port: 4251
             initialDelaySeconds: 5
             periodSeconds: 5
+      {{- with .Values.authentication.mutual.spire.install.agent.tolerations }}
+      tolerations:
+        {{- toYaml . | trim | nindent 8 }}
+      {{- end }}
       volumes:
         - name: spire-config
           configMap:

install/kubernetes/cilium/templates/spire/server/statefulset.yaml

@@ -72,6 +72,18 @@ spec:
             port: 8080
           initialDelaySeconds: 5
           periodSeconds: 5
+      {{- with .Values.authentication.mutual.spire.install.server.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.authentication.mutual.spire.install.server.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.authentication.mutual.spire.install.server.tolerations }}
+      tolerations:
+        {{- toYaml . | trim | nindent 8 }}
+      {{- end }}
       volumes:
       - name: spire-config
         configMap:

install/kubernetes/cilium/values.yaml.tmpl

@@ -3164,6 +3164,9 @@ authentication:
           labels: { }
           # -- SPIRE Workload Attestor kubelet verification.
           skipKubeletVerification: true
+          # -- SPIRE agent tolerations configuration
+          # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+          tolerations: []
         server:
           # -- SPIRE server image
           image: ghcr.io/spiffe/spire-server:1.6.3@sha256:f4bc49fb0bd1d817a6c46204cc7ce943c73fb0a5496a78e0e4dc20c9a816ad7f
@@ -3185,6 +3188,14 @@ authentication:
             annotations: {}
             # -- Labels to be added to the SPIRE server service
             labels: {}
+          # -- SPIRE server affinity configuration
+          affinity: {}
+          # -- SPIRE server nodeSelector configuration
+          # ref: ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector
+          nodeSelector: {}
+          # -- SPIRE server tolerations configuration
+          # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+          tolerations: []
           # SPIRE server datastorage configuration
           dataStorage:
             # -- Enable SPIRE server data storage