anchore-admission-controller: adding topologySpreadConstraints

[HN23]

without setting:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: blah-anchore-admission-controller
  labels:
    app.kubernetes.io/name: anchore-admission-controller
    helm.sh/chart: anchore-admission-controller-0.6.3
    app.kubernetes.io/instance: blah
    app.kubernetes.io/version: "0.6.2"
    app.kubernetes.io/managed-by: Helm
  annotations:
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: anchore-admission-controller
      app.kubernetes.io/instance: blah
  template:
    metadata:
      labels:
        app.kubernetes.io/name: anchore-admission-controller
        helm.sh/chart: anchore-admission-controller-0.6.3
        app.kubernetes.io/instance: blah
        app.kubernetes.io/version: "0.6.2"
        app.kubernetes.io/managed-by: Helm
      annotations:
    spec:
      serviceAccountName: blah-anchore-admission-controller
      volumes:
      - name: serving-cert
        secret:
          defaultMode: 420
          secretName: anchore-admission-controller-certs
      - name: controller-config
        configMap:
          name: blah-controller-config
      - name: anchore-auth
        secret:
          secretName: blah-anchore-admission-controller
      containers:
      - name: anchore-admission-controller
        image: "anchore/kubernetes-admission-controller:v0.6.2"
        imagePullPolicy: IfNotPresent
        command:
        - "/ko-app/kubernetes-admission-controller"
        - "--audit-log-path=-"
        - "--tls-cert-file=/var/serving-cert/tls.crt"
        - "--tls-private-key-file=/var/serving-cert/tls.key"
        - "-v3"
        - "--secure-port=8443"
        ports:
        - containerPort: 8443
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8443
            scheme: HTTPS
        volumeMounts:
        - mountPath: /var/serving-cert
          name: serving-cert
          readOnly: true
        - mountPath: /config
          name: controller-config
        - mountPath: /credentials
          name: anchore-auth
        env:
        - name: CONFIG_FILE_PATH
          value: /config/config.json
        - name: CREDENTIALS_FILE_PATH
          value: /credentials/credentials.json
        resources:
            {}

setting example:

kind: Deployment
metadata:
  name: blah-anchore-admission-controller
  labels:
    app.kubernetes.io/name: anchore-admission-controller
    helm.sh/chart: anchore-admission-controller-0.6.3
    app.kubernetes.io/instance: blah
    app.kubernetes.io/version: "0.6.2"
    app.kubernetes.io/managed-by: Helm
  annotations:
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: anchore-admission-controller
      app.kubernetes.io/instance: blah
  template:
    metadata:
      labels:
        app.kubernetes.io/name: anchore-admission-controller
        helm.sh/chart: anchore-admission-controller-0.6.3
        app.kubernetes.io/instance: blah
        app.kubernetes.io/version: "0.6.2"
        app.kubernetes.io/managed-by: Helm
      annotations:
    spec:
      serviceAccountName: blah-anchore-admission-controller
      volumes:
      - name: serving-cert
        secret:
          defaultMode: 420
          secretName: anchore-admission-controller-certs
      - name: controller-config
        configMap:
          name: blah-controller-config
      - name: anchore-auth
        secret:
          secretName: blah-anchore-admission-controller
      containers:
      - name: anchore-admission-controller
        image: "anchore/kubernetes-admission-controller:v0.6.2"
        imagePullPolicy: IfNotPresent
        command:
        - "/ko-app/kubernetes-admission-controller"
        - "--audit-log-path=-"
        - "--tls-cert-file=/var/serving-cert/tls.crt"
        - "--tls-private-key-file=/var/serving-cert/tls.key"
        - "-v3"
        - "--secure-port=8443"
        ports:
        - containerPort: 8443
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8443
            scheme: HTTPS
        volumeMounts:
        - mountPath: /var/serving-cert
          name: serving-cert
          readOnly: true
        - mountPath: /config
          name: controller-config
        - mountPath: /credentials
          name: anchore-auth
        env:
        - name: CONFIG_FILE_PATH
          value: /config/config.json
        - name: CREDENTIALS_FILE_PATH
          value: /credentials/credentials.json
        resources:
            {}
      topologySpreadConstraints:
        - labelSelector:
            matchLabels:
              foo: bar
          maxSkew: 1
          topologyKey: zone
          whenUnsatisfiable: DoNotSchedule

[blang9238]

LGTM!

[InfraInnovator]

LGTM!