helm: Add pod affinity for cilium-envoy

This commit is to avoid cilium-envoy running on the node without cilium agent. Relates: cilium#25081, cilium#30034 Fixes: cilium#31149 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras · Mar 12, 2024 · 62cca9c · 62cca9c
1 parent e6576ec
commit 62cca9c
Show file tree

Hide file tree

Showing 5 changed files with 17 additions and 3 deletions.
diff --git a/Documentation/helm-values.rst b/Documentation/helm-values.rst
diff --git a/install/kubernetes/cilium/README.md b/install/kubernetes/cilium/README.md
diff --git a/install/kubernetes/cilium/templates/cilium-envoy/daemonset.yaml b/install/kubernetes/cilium/templates/cilium-envoy/daemonset.yaml
@@ -229,10 +229,12 @@ spec:
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.envoy.tolerations }}
       tolerations:
+      {{- with .Values.envoy.tolerations }}
         {{- toYaml . | trim | nindent 8 }}
       {{- end }}
+        - key: {{ .Values.agentNotReadyTaintKey | default "node.cilium.io/agent-not-ready" }}
+          effect: NoSchedule
       volumes:
       - name: envoy-sockets
         hostPath:

diff --git a/install/kubernetes/cilium/values.yaml b/install/kubernetes/cilium/values.yaml
diff --git a/install/kubernetes/cilium/values.yaml.tmpl b/install/kubernetes/cilium/values.yaml.tmpl
@@ -1936,6 +1936,12 @@ envoy:
           labelSelector:
             matchLabels:
               k8s-app: cilium-envoy
+    podAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+      - topologyKey: kubernetes.io/hostname
+        labelSelector:
+          matchLabels:
+            k8s-app: cilium
   # -- Node selector for cilium-envoy.
   nodeSelector:
     kubernetes.io/os: linux