Skip to content

Commit 332628e

Browse files
tviauddbudziwojskiNR
tviaud
and
dbudziwojskiNR
authored
feat(chart,jobs): Adding resources configuration blocks for AdmissionWebhooks (#657)
* feat(jobs): Adding resources configuration blocks for AdmissionWebhooks * Add README.md * Update CHANGELOG.md * Update CHANGELOG.md Co-authored-by: Daniel Budziwojski <dbudziwojski@newrelic.com> * Update charts/nri-metadata-injection/README.md Co-authored-by: Daniel Budziwojski <dbudziwojski@newrelic.com> * Add job resources tests --------- Co-authored-by: Daniel Budziwojski <dbudziwojski@newrelic.com>
1 parent 7c62688 commit 332628e

File tree

6 files changed

+163
-0
lines changed

6 files changed

+163
-0
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1212

1313
### enhancement
1414
- Propagate global tolerations to webhook jobs @chernetskyi [#668](https://github.com/newrelic/k8s-metadata-injection/pull/668)
15+
- Added `jobImage.admissionCreate.resources` and `jobImage.admissionPatch.resources` configuration block @tviaud [#657](https://github.com/newrelic/k8s-metadata-injection/pull/657).
1516

1617
## v1.38.1 - 2025-10-20
1718

‎charts/nri-metadata-injection/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ Options that can be defined globally include `affinity`, `nodeSelector`, `tolera
4646
| image.pullSecrets | list | `[]` | The secrets that are needed to pull images from a custom registry. |
4747
| injectOnlyLabeledNamespaces | bool | `false` | Enable the metadata decoration only for pods living in namespaces labeled with 'newrelic-metadata-injection=enabled'. |
4848
| jobImage | object | See `values.yaml` | Image for creating the needed certificates of this webhook to work |
49+
| jobImage.admissionCreate.resources | object | `{}` | Resources to set for `admission-create` job |
50+
| jobImage.admissionPatch.resources | object | `{}` | Resources to set for `admission-patch` job |
4951
| jobImage.pullSecrets | list | `[]` | The secrets that are needed to pull images from a custom registry. |
5052
| jobImage.volumeMounts | list | `[]` | Volume mounts to add to the job, you might want to mount tmp if Pod Security Policies Enforce a read-only root. |
5153
| jobImage.volumes | list | `[]` | Volumes to add to the job container |

‎charts/nri-metadata-injection/templates/admission-webhooks/job-patch/job-createSecret.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,10 @@ spec:
3434
securityContext:
3535
{{- . | nindent 12 }}
3636
{{- end }}
37+
{{- if .Values.jobImage.admissionCreate.resources }}
38+
resources:
39+
{{ toYaml .Values.jobImage.admissionCreate.resources | nindent 12 }}
40+
{{- end }}
3741
args:
3842
- create
3943
- --host={{ include "newrelic.common.naming.fullname" . }},{{ include "newrelic.common.naming.fullname" . }}.{{ .Release.Namespace }}.svc

‎charts/nri-metadata-injection/templates/admission-webhooks/job-patch/job-patchWebhook.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,10 @@ spec:
3434
securityContext:
3535
{{- . | nindent 12 }}
3636
{{- end }}
37+
{{- if .Values.jobImage.admissionPatch.resources }}
38+
resources:
39+
{{ toYaml .Values.jobImage.admissionPatch.resources | nindent 12 }}
40+
{{- end }}
3741
args:
3842
- patch
3943
- --webhook-name={{ include "newrelic.common.naming.fullname" . }}

‎charts/nri-metadata-injection/tests/job_resources_test.yaml‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
suite: test job resources configuration
2+
templates:
3+
- templates/admission-webhooks/job-patch/job-createSecret.yaml
4+
- templates/admission-webhooks/job-patch/job-patchWebhook.yaml
5+
release:
6+
name: my-release
7+
namespace: my-namespace
8+
tests:
9+
- it: should not set resources by default for admission-create job
10+
template: templates/admission-webhooks/job-patch/job-createSecret.yaml
11+
set:
12+
cluster: test-cluster
13+
asserts:
14+
- isNull:
15+
path: spec.template.spec.containers[0].resources
16+
17+
- it: should not set resources by default for admission-patch job
18+
template: templates/admission-webhooks/job-patch/job-patchWebhook.yaml
19+
set:
20+
cluster: test-cluster
21+
asserts:
22+
- isNull:
23+
path: spec.template.spec.containers[0].resources
24+
25+
- it: should set resources for admission-create job when configured
26+
template: templates/admission-webhooks/job-patch/job-createSecret.yaml
27+
set:
28+
cluster: test-cluster
29+
jobImage:
30+
admissionCreate:
31+
resources:
32+
requests:
33+
cpu: 100m
34+
memory: 64Mi
35+
limits:
36+
cpu: 200m
37+
memory: 128Mi
38+
asserts:
39+
- equal:
40+
path: spec.template.spec.containers[0].resources
41+
value:
42+
requests:
43+
cpu: 100m
44+
memory: 64Mi
45+
limits:
46+
cpu: 200m
47+
memory: 128Mi
48+
49+
- it: should set resources for admission-patch job when configured
50+
template: templates/admission-webhooks/job-patch/job-patchWebhook.yaml
51+
set:
52+
cluster: test-cluster
53+
jobImage:
54+
admissionPatch:
55+
resources:
56+
requests:
57+
cpu: 50m
58+
memory: 32Mi
59+
limits:
60+
cpu: 100m
61+
memory: 64Mi
62+
asserts:
63+
- equal:
64+
path: spec.template.spec.containers[0].resources
65+
value:
66+
requests:
67+
cpu: 50m
68+
memory: 32Mi
69+
limits:
70+
cpu: 100m
71+
memory: 64Mi
72+
73+
- it: should set different resources for admission-create and admission-patch jobs
74+
set:
75+
cluster: test-cluster
76+
jobImage:
77+
admissionCreate:
78+
resources:
79+
requests:
80+
cpu: 100m
81+
memory: 64Mi
82+
limits:
83+
cpu: 200m
84+
memory: 128Mi
85+
admissionPatch:
86+
resources:
87+
requests:
88+
cpu: 50m
89+
memory: 32Mi
90+
limits:
91+
cpu: 100m
92+
memory: 64Mi
93+
asserts:
94+
- template: templates/admission-webhooks/job-patch/job-createSecret.yaml
95+
equal:
96+
path: spec.template.spec.containers[0].resources.requests.cpu
97+
value: 100m
98+
- template: templates/admission-webhooks/job-patch/job-createSecret.yaml
99+
equal:
100+
path: spec.template.spec.containers[0].resources.requests.memory
101+
value: 64Mi
102+
- template: templates/admission-webhooks/job-patch/job-patchWebhook.yaml
103+
equal:
104+
path: spec.template.spec.containers[0].resources.requests.cpu
105+
value: 50m
106+
- template: templates/admission-webhooks/job-patch/job-patchWebhook.yaml
107+
equal:
108+
path: spec.template.spec.containers[0].resources.requests.memory
109+
value: 32Mi
110+
111+
- it: should set only requests when limits are not specified for admission-create
112+
template: templates/admission-webhooks/job-patch/job-createSecret.yaml
113+
set:
114+
cluster: test-cluster
115+
jobImage:
116+
admissionCreate:
117+
resources:
118+
requests:
119+
cpu: 100m
120+
memory: 64Mi
121+
asserts:
122+
- equal:
123+
path: spec.template.spec.containers[0].resources
124+
value:
125+
requests:
126+
cpu: 100m
127+
memory: 64Mi
128+
129+
- it: should set only limits when requests are not specified for admission-patch
130+
template: templates/admission-webhooks/job-patch/job-patchWebhook.yaml
131+
set:
132+
cluster: test-cluster
133+
jobImage:
134+
admissionPatch:
135+
resources:
136+
limits:
137+
cpu: 100m
138+
memory: 64Mi
139+
asserts:
140+
- equal:
141+
path: spec.template.spec.containers[0].resources
142+
value:
143+
limits:
144+
cpu: 100m
145+
memory: 64Mi

‎charts/nri-metadata-injection/values.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,13 @@ jobImage:
3838
volumes: []
3939
# - name: tmp
4040
# emptyDir: {}
41+
# -- Resources for the job container admission-create
42+
admissionCreate:
43+
resources: {}
44+
# -- Resources for the job container admission-patch
45+
admissionPatch:
46+
resources: {}
47+
4148

4249
rbac:
4350
# rbac.pspEnabled -- Whether the chart should create Pod Security Policy objects.

0 commit comments

Comments
 (0)