[stable/opa] Add affinity settings to OPA deployment (#20628)

Signed-off-by: Igor Belikov <mail@igorbelikov.com>

stable/opa/Chart.yaml

@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.13.3
+version: 1.13.4
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:

stable/opa/README.md

@@ -75,6 +75,7 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `logLevel` | Log level that OPA outputs at, (`debug`, `info` or `error`) | `info` |
 | `logFormat` | Log format that OPA produces (`text` or `json`) | `text` |
 | `replicas` | Number of admission controller replicas to deploy. | `1` |
+| `affinity` | Pod/Node affinity and anti-affinity | `{}` |
 | `tolerations` | List of node taint tolerations. | `[]` |
 | `nodeSelector` | Node labels for pod assignment. | `{}` |
 | `resources` | CPU and memory limits for OPA container. | `{}` |

stable/opa/templates/deployment.yaml

@@ -188,6 +188,8 @@ spec:
         - name: bootstrap
           emptyDir: {}
 {{- end }}
+      affinity:
+{{ toYaml .Values.affinity | indent 8 }}
       nodeSelector:
 {{ toYaml .Values.nodeSelector | indent 8 }}
       tolerations:

stable/opa/values.yaml

@@ -146,11 +146,27 @@ logFormat: text
 # or more replicas.
 replicas: 1
 
-# To control how the OPA is scheduled on the cluster, set the tolerations and
-# nodeSelector values below. For example, to deploy OPA onto the master nodes:
+# To control how the OPA is scheduled on the cluster, set the affinity,
+# tolerations and nodeSelector values below. For example, to deploy OPA onto
+# the master nodes, 1 replica per node:
 #
-# tolerations: [{key: "node-role.kubernetes.io/master", effect: NoSchedule, operator: Exists}]
-# nodeSelector: {"kubernetes.io/role": "master"}
+# affinity:
+#   podAntiAffinity:
+#     requiredDuringSchedulingIgnoredDuringExecution:
+#     - labelSelector:
+#         matchExpressions:
+#         - key: "app"
+#           operator: In
+#           values:
+#           - opa
+#       topologyKey: "kubernetes.io/hostname"
+# tolerations:
+# - key: "node-role.kubernetes.io/master"
+#   effect: NoSchedule
+#   operator: Exists
+# nodeSelector:
+#   kubernetes.io/role: "master"
+affinity: {}
 tolerations: []
 nodeSelector: {}