Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add pod antiaffinity to oathkeeper pods (HA/multi-az support) #1463

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Add pod antiaffinity to oathkeeper pods (HA/multi-az support) #1463

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8deed23
Add pod antiaffinity to oathkeeper pods, schedule on different nodes …
videlov Nov 19, 2024
5a37f3b
Only for normal deployment not for light
videlov Nov 19, 2024
8242b2e
Docs and RN
videlov Nov 19, 2024
8f7d516
Merge branch 'main' into oathkeeper-ha-multi-az-support
videlov Nov 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/contributor/04-10-technical-design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
API Gateway Operator consists of two controllers that reconcile different CRs. To understand the reasons for using a single operator with multiple controllers instead of multiple operators, refer to the [Architecture Decision Record](https://github.com/kyma-project/api-gateway/issues/495).
API Gateway Operator has a dependency on [Istio](https://istio.io/) and [Ory Oathkeeper](https://www.ory.sh/docs/oathkeeper), and it installs Ory Oathkeeper itself.

Oathkeeper Deployment configures **PodAntiAffinity** to ensure that its Pods are evenly spread across all nodes and, if possible, across different zones. This guarantees High availability (HA) of the [Ory Oathkeeper](https://www.ory.sh/docs/oathkeeper) installation.

The following diagram illustrates the APIRule reconciliation process and the resources created in the process:

![Kyma API Gateway Overview](../assets/operator-contributor-skr-overview.svg)
Expand Down
3 changes: 3 additions & 0 deletions docs/release-notes/2.11.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
## New Features

- Add zone-based `podAntiAffinity` rules for the `ory-oathkeeper` Deployment. [#1463](https://github.com/kyma-project/api-gateway/pull/1463)
12 changes: 9 additions & 3 deletions internal/reconciliations/oathkeeper/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,12 +179,18 @@ spec:
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
- podAffinityTerm:
labelSelector:
matchLabels:
app: oathkeeper
app.kubernetes.io/name: oathkeeper
topologyKey: "kubernetes.io/hostname"
weight: 100
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/name: oathkeeper
topologyKey: topology.kubernetes.io/zone
weight: 100
volumes:
- configMap:
name: ory-oathkeeper-config
Expand Down
Loading