Skip to content

Commit a2fd84e

Browse files
bryopsidabryopsida
authored
Make job, initContainer, metrics resources configurable (#71)
It is a good practice to configure the ephemeral-storage limits and requests for containers in addition to memory and CPU. Also some containers had hard coded values for the resource limits and requests. Metrics container was not possible to configure separately from the main container. I also need to set the annotations for the pod created by the Job. I hope i set some sane default to the requests, please adjust as You see fit.
2 parents 5d283a3 + dd73c95 commit a2fd84e

File tree

5 files changed

+66
-19
lines changed

5 files changed

+66
-19
lines changed

‎helm/wireguard/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: wireguard
33
description: A Helm chart for managing a wireguard vpn in kubernetes
44
type: application
5-
version: 0.28.0
5+
version: 0.29.0
66
appVersion: "0.0.0"
77
maintainers:
88
- name: bryopsida

‎helm/wireguard/README.md‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# wireguard
22

3-
![Version: 0.28.0](https://img.shields.io/badge/Version-0.28.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.0](https://img.shields.io/badge/AppVersion-0.0.0-informational?style=flat-square)
3+
![Version: 0.29.0](https://img.shields.io/badge/Version-0.29.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.0](https://img.shields.io/badge/AppVersion-0.0.0-informational?style=flat-square)
44

55
A Helm chart for managing a wireguard vpn in kubernetes
66

@@ -38,7 +38,7 @@ A Helm chart for managing a wireguard vpn in kubernetes
3838
| healthSideCar.image.pullPolicy | string | `"Always"` | Pull Policy always to avoid cached rolling tags, if you change this you should use a non rolling tag |
3939
| healthSideCar.image.repository | string | `"ghcr.io/bryopsida/http-healthcheck-sidecar"` | Override repo if you prefer to use your own image |
4040
| healthSideCar.image.tag | string | `"main"` | Rolling tag used by default to take patches automatically |
41-
| healthSideCar.resources | object | `{"limits":{"cpu":"100m","memory":"256Mi"},"requests":{"cpu":"100m","memory":"256Mi"}}` | set resource constraints, set to nil to remove |
41+
| healthSideCar.resources | object | `{"limits":{"cpu":"100m","ephemeral-storage":"256Mi","memory":"256Mi"},"requests":{"cpu":"100m","ephemeral-storage":"8Mi","memory":"256Mi"}}` | set resource constraints, set to nil to remove |
4242
| healthSideCar.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001,"seccompProfile":{"type":"RuntimeDefault"}}` | Secure settings by default, can be overriden to reduce security posture if needed |
4343
| healthSideCar.service.enabled | bool | `true` | Toggle to enable the service, if the pod is a daemonset healthSideCar.useHostPort can be used instead |
4444
| healthSideCar.service.nodePort | int | `31313` | The port for the service exposed on each node |
@@ -51,6 +51,12 @@ A Helm chart for managing a wireguard vpn in kubernetes
5151
| image.tag | string | `"main"` | |
5252
| initContainer.image.repository | string | `"busybox"` | |
5353
| initContainer.image.tag | string | `"latest"` | |
54+
| initContainer.resources.limits.cpu | string | `"100m"` | |
55+
| initContainer.resources.limits.ephemeral-storage | string | `"64Mi"` | |
56+
| initContainer.resources.limits.memory | string | `"64Mi"` | |
57+
| initContainer.resources.requests.cpu | string | `"100m"` | |
58+
| initContainer.resources.requests.ephemeral-storage | string | `"8Mi"` | |
59+
| initContainer.resources.requests.memory | string | `"64Mi"` | |
5460
| keygenJob.command | list | `["/job/entry-point.sh"]` | Specify the script to run to generate the private key |
5561
| keygenJob.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | |
5662
| keygenJob.containerSecurityContext.privileged | bool | `false` | |
@@ -63,9 +69,16 @@ A Helm chart for managing a wireguard vpn in kubernetes
6369
| keygenJob.image.pullPolicy | string | `"Always"` | |
6470
| keygenJob.image.repository | string | `"ghcr.io/curium-rocks/wg-kubectl"` | |
6571
| keygenJob.image.tag | string | `"latest"` | |
72+
| keygenJob.podAnnotations | object | `{}` | |
6673
| keygenJob.podSecurityContext.fsGroup | int | `1000` | |
6774
| keygenJob.podSecurityContext.fsGroupChangePolicy | string | `"Always"` | |
6875
| keygenJob.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
76+
| keygenJob.resources.limits.cpu | string | `"100m"` | |
77+
| keygenJob.resources.limits.ephemeral-storage | string | `"128Mi"` | |
78+
| keygenJob.resources.limits.memory | string | `"256Mi"` | |
79+
| keygenJob.resources.requests.cpu | string | `"100m"` | |
80+
| keygenJob.resources.requests.ephemeral-storage | string | `"8Mi"` | |
81+
| keygenJob.resources.requests.memory | string | `"256Mi"` | |
6982
| keygenJob.useWireguardManager | bool | `false` | when enabled, uses a image with go bindings for k8s and wg to create the secret if it does not exist, on re-runs it it leaves the existing secret in place and exits succesfully |
7083
| keygenJob.wireguardMgrImage | object | `{"pullPolicy":"Always","repository":"ghcr.io/bryopsida/k8s-wireguard-mgr","tag":"main"}` | When useWireguardManager is enabled this image is used instead of the kubectl image |
7184
| labels | object | `{}` | |
@@ -87,6 +100,12 @@ A Helm chart for managing a wireguard vpn in kubernetes
87100
| metrics.prometheusRule.groups | list | `[]` | Groups, containing the alert rules. Example: groups: - name: Wireguard rules: - alert: WireguardInstanceNotAvailable annotations: message: "Wireguard instance in namespace {{ `{{` }} $labels.namespace {{ `}}` }} has not been available for the last 5 minutes." expr: | absent(kube_pod_status_ready{namespace="{{ include "common.names.namespace" . }}", condition="true"} * on (pod) kube_pod_labels{pod=~"{{ include "common.names.fullname" . }}-\\d+", namespace="{{ include "common.names.namespace" . }}"}) != 0 for: 5m labels: severity: critical |
88101
| metrics.prometheusRule.labels | object | `{}` | Additional labels that can be used so PrometheusRule will be discovered by Prometheus |
89102
| metrics.prometheusRule.namespace | string | `""` | Namespace of the ServiceMonitor. If empty, current namespace is used |
103+
| metrics.resources.limits.cpu | string | `"100m"` | |
104+
| metrics.resources.limits.ephemeral-storage | string | `"128Mi"` | |
105+
| metrics.resources.limits.memory | string | `"256Mi"` | |
106+
| metrics.resources.requests.cpu | string | `"100m"` | |
107+
| metrics.resources.requests.ephemeral-storage | string | `"8Mi"` | |
108+
| metrics.resources.requests.memory | string | `"256Mi"` | |
90109
| metrics.service.annotations | object | `{}` | Annotations for enabling prometheus to access the metrics endpoints |
91110
| metrics.service.labels | object | `{}` | Additional service labels |
92111
| metrics.service.port | int | `9586` | Metrics service HTTP port |
@@ -107,8 +126,10 @@ A Helm chart for managing a wireguard vpn in kubernetes
107126
| podAnnotations | object | `{}` | |
108127
| replicaCount | int | `3` | |
109128
| resources.limits.cpu | string | `"100m"` | |
129+
| resources.limits.ephemeral-storage | string | `"128Mi"` | |
110130
| resources.limits.memory | string | `"256Mi"` | |
111131
| resources.requests.cpu | string | `"100m"` | |
132+
| resources.requests.ephemeral-storage | string | `"8Mi"` | |
112133
| resources.requests.memory | string | `"256Mi"` | |
113134
| runPodOnHostNetwork | bool | `false` | Run pod on host network |
114135
| runtimeClassName | string | `nil` | Override the default runtime class of the container, if not provided `runc` will most likely be used |

‎helm/wireguard/templates/deployment.yaml‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -136,13 +136,7 @@ spec:
136136
- -c
137137
- sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv4.conf.all.forwarding=1
138138
securityContext: {{ include "init.securitycontext" . | nindent 12 }}
139-
resources:
140-
requests:
141-
memory: 64Mi
142-
cpu: "100m"
143-
limits:
144-
memory: 64Mi
145-
cpu: "100m"
139+
resources: {{ .Values.initContainer.resources | toYaml | nindent 12 }}
146140
containers:
147141
- name: wireguard
148142
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -218,7 +212,7 @@ spec:
218212
- name: PROMETHEUS_WIREGUARD_EXPORTER_PORT
219213
value: "{{ .Values.metrics.service.port }}"
220214
securityContext: {{ include "wg.securitycontext" . | nindent 12 }}
221-
resources: {{ .Values.resources | toYaml | nindent 12 }}
215+
resources: {{ .Values.metrics.resources | toYaml | nindent 12 }}
222216
startupProbe:
223217
httpGet:
224218
path: /metrics

‎helm/wireguard/templates/privatekey-gen-job.yaml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,13 @@ metadata:
9696
spec:
9797
ttlSecondsAfterFinished: 60
9898
template:
99+
metadata:
100+
{{- if .Values.keygenJob.podAnnotations }}
101+
annotations:
102+
{{- range $key, $value := .Values.keygenJob.podAnnotations }}
103+
{{ $key }}: {{ $value | quote }}
104+
{{- end }}
105+
{{- end }}
99106
spec:
100107
{{- include "wireguard.runtimeClass" . | indent 6 }}
101108
serviceAccountName: {{ .Release.Name }}-pre-install-job-sa
@@ -131,13 +138,7 @@ spec:
131138
imagePullPolicy: "{{ .Values.keygenJob.wireguardMgrImage.pullPolicy }}"
132139
{{- end }}
133140
securityContext: {{ .Values.keygenJob.containerSecurityContext | toYaml | nindent 10 }}
134-
resources:
135-
requests:
136-
memory: 64Mi
137-
cpu: "100m"
138-
limits:
139-
memory: 64Mi
140-
cpu: "100m"
141+
resources: {{ .Values.keygenJob.resources | toYaml | nindent 10 }}
141142
env:
142143
{{- if .Values.keygenJob.useWireguardManager }}
143144
- name: K8S_WG_MGR_SERVER_SECRET_NAME

‎helm/wireguard/values.yaml‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,15 @@ initContainer:
99
image:
1010
repository: busybox
1111
tag: latest
12-
12+
resources:
13+
requests:
14+
memory: 64Mi
15+
cpu: "100m"
16+
ephemeral-storage: 8Mi
17+
limits:
18+
memory: 64Mi
19+
cpu: "100m"
20+
ephemeral-storage: 64Mi
1321
keygenJob:
1422
# -- when enabled, uses a image with go bindings for k8s and wg
1523
# to create the secret if it does not exist, on re-runs it
@@ -24,6 +32,7 @@ keygenJob:
2432
repository: ghcr.io/curium-rocks/wg-kubectl
2533
tag: latest
2634
pullPolicy: Always
35+
podAnnotations: {}
2736
podSecurityContext:
2837
seccompProfile:
2938
type: RuntimeDefault
@@ -36,6 +45,15 @@ keygenJob:
3645
privileged: false
3746
allowPrivilegeEscalation: false
3847
readOnlyRootFilesystem: true
48+
resources:
49+
requests:
50+
memory: 256Mi
51+
cpu: "100m"
52+
ephemeral-storage: 8Mi
53+
limits:
54+
memory: 256Mi
55+
cpu: "100m"
56+
ephemeral-storage: 128Mi
3957
# -- Specify the script to run to generate the private key
4058
command: ["/job/entry-point.sh"]
4159
# -- Inject additional scripts into the key generation job
@@ -101,9 +119,11 @@ resources:
101119
requests:
102120
memory: 256Mi
103121
cpu: "100m"
122+
ephemeral-storage: 8Mi
104123
limits:
105124
memory: 256Mi
106125
cpu: "100m"
126+
ephemeral-storage: 128Mi
107127
# -- Override the default runtime class of the container, if not provided `runc` will most likely be used
108128
runtimeClassName: ~
109129
deploymentStrategy:
@@ -182,6 +202,15 @@ metrics:
182202
repository: docker.io/mindflavor/prometheus-wireguard-exporter
183203
tag: 3.6.6
184204
pullPolicy: IfNotPresent
205+
resources:
206+
requests:
207+
memory: 256Mi
208+
cpu: "100m"
209+
ephemeral-storage: 8Mi
210+
limits:
211+
memory: 256Mi
212+
cpu: "100m"
213+
ephemeral-storage: 128Mi
185214
# @params -- Wireguard Exporter environment variables. See https://mindflavor.github.io/prometheus_wireguard_exporter
186215
extraEnv:
187216
# -- Enable verbose mode
@@ -293,9 +322,11 @@ healthSideCar:
293322
requests:
294323
memory: 256Mi
295324
cpu: "100m"
325+
ephemeral-storage: 8Mi
296326
limits:
297327
memory: 256Mi
298328
cpu: "100m"
329+
ephemeral-storage: 256Mi
299330
image:
300331
# -- Override repo if you prefer to use your own image
301332
repository: ghcr.io/bryopsida/http-healthcheck-sidecar

0 commit comments

Comments
 (0)