Merge pull request istio-ecosystem#160 from istio-ecosystem/periodic-reconcile-change-default-1

Make all options configurable via helm values

Author: hercynium

ARCHITECTURE.md

@@ -218,7 +218,7 @@ flowchart TD
 | `--compare-hub` | false | Require container image registry to match ConfigMap hub when detecting outdated pods |
 | `--restart-delay` | 0 | Delay between restarting each workload (e.g., 5s) |
 | `--istiod-config-read-delay` | 10s | Wait for Istiod to read updated ConfigMap before scanning |
-| `--reconcile-period` | 1h | Period between full reconciliations; 0 disables periodic reconcile |
+| `--reconcile-period` | 0 | Period between full reconciliations; 0 disables periodic reconcile |
 | `--annotation-cooldown` | 5m | Skip re-annotating if workload was annotated within this duration |
 | `--skip-namespaces` | kube-system,istio-system | Comma-separated namespaces to skip when scanning pods |
 

cmd/main.go

@@ -131,7 +131,7 @@ func main() {
 		"Delay between restarting each workload (e.g. 5s). Use 0 for no delay.")
 	pflag.DurationVar(&istiodConfigReadDelay, "istiod-config-read-delay", 10*time.Second,
 		"Wait for Istiod to read the updated ConfigMap before scanning (e.g. 10s). Use 0 to skip.")
-	pflag.DurationVar(&reconcilePeriod, "reconcile-period", 1*time.Hour,
+	pflag.DurationVar(&reconcilePeriod, "reconcile-period", 0,
 		"Period between full reconciliations of all istio-sidecar-injector ConfigMaps. "+
 			"Use 0 to disable periodic reconciliation.")
 	pflag.DurationVar(&annotationCooldown, "annotation-cooldown", 5*time.Minute,

helm/src/chart/templates/manager/manager.yaml

@@ -44,6 +44,13 @@ spec:
                     - --metrics-bind-address=0
                     {{- end }}
                     - --health-probe-bind-address=:8081
+                    - --reconcile-period={{ (.Values.fortsaOptions).reconcilePeriod | default "10h" }}
+                    - --dry-run={{ (.Values.fortsaOptions).dryRun | default false }}
+                    - --compare-hub={{ (.Values.fortsaOptions).compareHub | default false }}
+                    - --restart-delay={{ (.Values.fortsaOptions).restartDelay | default "10s" }}
+                    - --istiod-config-read-delay={{ (.Values.fortsaOptions).istiodConfigReadDelay | default "10s" }}
+                    - --annotation-cooldown={{ (.Values.fortsaOptions).annotationCooldown | default "5m" }}
+                    - --skip-namespaces={{ (.Values.fortsaOptions).skipNamespaces | default "kube-system,istio-system" }}
                     {{- range .Values.manager.args }}
                     - {{ . }}
                     {{- end }}

helm/src/chart/values.yaml

@@ -6,6 +6,26 @@
 ##
 # fullnameOverride: ""
 
+## Fortsa controller options
+##
+fortsaOptions:
+  ## Period between full reconciliations of all istio-sidecar-injector ConfigMaps.
+  ## Use "0" to disable periodic reconciliation.
+  reconcilePeriod: "10h"
+  ## If true, log what would be done without annotating workloads.
+  dryRun: false
+  ## If true, require container image registry to match ConfigMap hub when detecting outdated pods.
+  ## This is useful if something mutates the registry part of pod images
+  compareHub: false
+  ## Delay between restarting each workload (e.g. 5s). Use "0" for no delay.
+  restartDelay: "10s"
+  ## Wait for Istiod to read the updated ConfigMap before scanning (e.g. 10s). Use "0" to skip.
+  istiodConfigReadDelay: "10s"
+  ## Skip re-annotating a workload if it was annotated within this duration. Use "0" to disable.
+  annotationCooldown: "5m"
+  ## Comma-separated list of namespaces to skip when scanning pods for outdated sidecars.
+  skipNamespaces: "kube-system,istio-system"
+
 ## Configure the controller manager deployment
 ##
 manager:
@@ -18,7 +38,6 @@ manager:
   ##
   args:
     - --leader-elect
-    - --annotation-cooldown=5m
   ## Environment variables
   ##
   env: []