annotations.md

Pod annotations

You can add annotations to kubernetes Pods objects to customize piggy behavior.

Annotations

Name	Type	Default	Location	Notes
piggysec.com/aws-secret-name	string		Pods
piggysec.com/aws-region	string		Pods
piggysec.com/piggy-env-image	string		Pods
piggysec.com/piggy-env-image-pull-policy	string		Pods
piggysec.com/piggy-env-resource-cpu-request	string		Pods
piggysec.com/piggy-env-resource-memory-request	string		Pods
piggysec.com/piggy-env-resource-cpu-limit	string		Pods
piggysec.com/piggy-env-resource-memory-limit	string		Pods
piggysec.com/piggy-psp-allow-privilege-escalation	boolean	false	Pods
piggysec.com/piggy-address	string		Pods
piggysec.com/piggy-skip-verify-tls	boolean	true	Pods
piggysec.com/piggy-ignore-no-env	boolean	false	Pods
piggysec.com/piggy-enforce-integrity	boolean	true	Pods
piggysec.com/debug	boolean	false	Pods
piggysec.com/standalone	boolean	false	Pods
piggysec.com/image-pull-secret	string		Pods
piggysec.com/image-pull-secret-namespace	string		Pods
piggysec.com/image-skip-verify-registry	string		Pods
piggysec.com/piggy-enforce-service-account	bool	false	Pods
piggysec.com/piggy-default-secret-name-prefix	string		Pods
piggysec.com/piggy-default-secret-name-suffix	string		Pods
piggysec.com/piggy-dns-resolver	string		Pods
piggysec.com/piggy-initial-delay	string		Pods
piggysec.com/piggy-number-of-retry	int	0	Pods

AWS Secret Manager

• piggysec.com/aws-secret-name specifies a AWS secret name e.g. "/myapp/name"
• piggysec.com/aws-region specifies a AWS secret manager region e.g. "ap-southeast-1"

piggy-env settings

• piggysec.com/piggy-env-image overrides a piggy-env image location. If no value specifies, the piggy-env image location will be taken from piggy-webhooks settings on helm chart
• piggysec.com/piggy-env-image-pull-policy overrides a piggy-env image pull policy. If no value specifies, the piggy-env image pull policy will be taken from piggy-webhooks settings on helm chart
• piggysec.com/piggy-env-resource-cpu-request overrides a piggy-env init-container resource CPU requests. Default to 50m
• piggysec.com/piggy-env-resource-memory-request overrides a piggy-env init-container resource memory requests. Default to 64Mi
• piggysec.com/piggy-env-resource-cpu-limit overrides a piggy-env init-container resource CPU limit. Default to 200m
• piggysec.com/piggy-env-resource-memory-limit overrides a piggy-env init-container resource memory limit. Default to 64Mi
• piggysec.com/piggy-psp-allow-privilege-escalation allow a piggy-env init-container to run as root. Default to false
• piggysec.com/piggy-address an endpoint of piggy-webhooks. This is required when it is running in proxy mode.
• piggysec.com/piggy-ignore-no-env do not terminate the container if no variable found on secret manager. Default to false. Set this value to false is recommended in most application. The container will not start if environment variable is missing.
• piggysec.com/piggy-enforce-integrity enforce checking command integrity before inject secrets into. Default to true. Set this value to true is recommended in most application. Set to false will allow piggy-env to run on different arguments
• piggysec.com/debug allows to run piggy-env in debug mode. Default to false.
• piggysec.com/standalone allows to run piggy-env in standalone mode. Default to false. If this value is true, the piggysec.com/piggy-address will not be used.
• piggysec.com/piggy-enforce-service-account Force to check PIGGY_ALLOWED_SA env value in AWS secret manager
• piggysec.com/piggy-default-secret-name-prefixSet default prefix string for secret name
• piggysec.com/piggy-default-secret-name-suffixSet default suffix string for secret name
• piggysec.com/piggy-dns-resolverSet Golang DNS resolver such as tcp, udp. See https://pkg.go.dev/net
• piggysec.com/piggy-initial-delaySet delay in n[ns|us|ms|s|m|h] before start retrieving secrets. If you are using Istio Envoy, you may need to set this value to 2s. The Envoy will block all outgoing requests from piggy-env until Envoy is fully started. Add this delay value to allow Envoy to operate before running piggy.
• piggysec.com/piggy-number-of-retrySet number of retry to retrieving secrets before given up. Each retry will wait for 500 milliseconds. You can use this to resolve delay initialize pods setting such as Istio Envoy.

Container image settings

• piggysec.com/image-pull-secret a name of container image pull secret. The piggy will try to read the container image by using secret in the following order
  1. pod.spec.imagePullSecrets
  2. piggysec.com/image-pull-secret annotation
  3. ServiceAccount permission from cloud
• piggysec.com/image-pull-secret-namespace a name of container image pull secret namespace.
• piggysec.com/image-skip-verify-registry skip verify registry when trying to read the image. Default to true