feat: Add support for priorityClass and make updateStrategy configurable

README.md

@@ -132,6 +132,7 @@ No modules.
 | <a name="input_cluster_shield_requests_cpu"></a> [cluster\_shield\_requests\_cpu](#input\_cluster\_shield\_requests\_cpu) | Specify CPU resource requests for the cluster shield pods. | `string` | `"500m"` | no |
 | <a name="input_cluster_shield_requests_memory"></a> [cluster\_shield\_requests\_memory](#input\_cluster\_shield\_requests\_memory) | Specify memory resource requests for the cluster shield pods. | `string` | `"512Mi"` | no |
 | <a name="input_container_filter"></a> [container\_filter](#input\_container\_filter) | Customize the agent to exclude containers from metrics collection. For more info, see https://cloud.ibm.com/docs/monitoring?topic=monitoring-change_kube_agent#change_kube_agent_filter_data | <pre>list(object({<br/>    type      = string<br/>    parameter = string<br/>    name      = string<br/>  }))</pre> | `[]` | no |
+| <a name="input_create_priority_class"></a> [create\_priority\_class](#input\_create\_priority\_class) | Specify whether or not to create a priority class for the agent daemonset. | `bool` | `true` | no |
 | <a name="input_deployment_tag"></a> [deployment\_tag](#input\_deployment\_tag) | Sets a global tag that will be included in the components. It represents the mechanism from where the components have been installed (terraform, local...). | `string` | `"terraform"` | no |
 | <a name="input_enable_host_scanner"></a> [enable\_host\_scanner](#input\_enable\_host\_scanner) | Enable host scanning to detect vulnerabilities and identify the resolution priority based on available fixed versions and severity. Requires a Security and Compliance Center Workload Protection instance to view results. | `bool` | `true` | no |
 | <a name="input_enable_kspm_analyzer"></a> [enable\_kspm\_analyzer](#input\_enable\_kspm\_analyzer) | Enable Kubernetes Security Posture Management (KSPM) analyzer. Requires a Security and Compliance Center Workload Protection instance to view results. | `bool` | `true` | no |
@@ -143,9 +144,13 @@ No modules.
 | <a name="input_is_vpc_cluster"></a> [is\_vpc\_cluster](#input\_is\_vpc\_cluster) | Specify true if the target cluster is a VPC cluster, false if it is a classic cluster. | `bool` | `true` | no |
 | <a name="input_kernal_module_image_repository"></a> [kernal\_module\_image\_repository](#input\_kernal\_module\_image\_repository) | The image repository to pull the agent kernal module initContainer image from. | `string` | `"agent-kmodule"` | no |
 | <a name="input_kernel_module_image_tag_digest"></a> [kernel\_module\_image\_tag\_digest](#input\_kernel\_module\_image\_tag\_digest) | The image tag or digest to use for the agent kernel module used by the initContainer. If using digest, it must be in the format of `X.Y.Z@sha256:xxxxx` | `string` | `"14.1.1@sha256:339a15d5aec1f1d3a4edd3928e14233f54c1c586f4a45d601a12f8a92da31ae0"` | no |
+| <a name="input_max_surge"></a> [max\_surge](#input\_max\_surge) | Maximum number of nodes that can have an extra DaemonSet pod during a rolling update. Accepts absolute number or percentage (e.g., '1' or '10%'). | `string` | `null` | no |
+| <a name="input_max_unavailable"></a> [max\_unavailable](#input\_max\_unavailable) | Maximum number of pods that can be unavailable during a DaemonSet rolling update. Accepts absolute number or percentage (e.g., '1' or '10%'). | `string` | `1` | no |
 | <a name="input_metrics_filter"></a> [metrics\_filter](#input\_metrics\_filter) | To filter custom metrics you can specify which metrics to include and exclude. For more info, see https://cloud.ibm.com/docs/monitoring?topic=monitoring-change_kube_agent#change_kube_agent_inc_exc_metrics | <pre>list(object({<br/>    include = optional(string)<br/>    exclude = optional(string)<br/>  }))</pre> | `[]` | no |
 | <a name="input_name"></a> [name](#input\_name) | The name to give the agent helm release. | `string` | `"sysdig-agent"` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace to deploy the agent to. | `string` | `"ibm-observe"` | no |
+| <a name="input_priority_class_name"></a> [priority\_class\_name](#input\_priority\_class\_name) | Sets the priority class name for the agent daemonset. | `string` | `"sysdig-daemonset-priority"` | no |
+| <a name="input_priority_class_value"></a> [priority\_class\_value](#input\_priority\_class\_value) | Sets the priority class value for the agent daemonset. | `number` | `10` | no |
 | <a name="input_prometheus_config"></a> [prometheus\_config](#input\_prometheus\_config) | Prometheus configuration for the agent. If you want to enable Prometheus configuration provide the prometheus.yaml file content in `hcl` format. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-monitoring-agent/blob/main/solutions/fully-configurable/DA-types.md#prometheus_config). | `map(any)` | `{}` | no |
 | <a name="input_tolerations"></a> [tolerations](#input\_tolerations) | List of tolerations to apply to the agent. | <pre>list(object({<br/>    key               = optional(string)<br/>    operator          = optional(string)<br/>    value             = optional(string)<br/>    effect            = optional(string)<br/>    tolerationSeconds = optional(number)<br/>  }))</pre> | <pre>[<br/>  {<br/>    "operator": "Exists"<br/>  },<br/>  {<br/>    "effect": "NoSchedule",<br/>    "key": "node-role.kubernetes.io/master",<br/>    "operator": "Exists"<br/>  }<br/>]</pre> | no |
 | <a name="input_use_private_endpoint"></a> [use\_private\_endpoint](#input\_use\_private\_endpoint) | Whether send data over a private endpoint or not. To use a private endpoint, you must enable virtual routing and forwarding (VRF) for your account. See https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint. | `bool` | `true` | no |

main.tf

@@ -259,6 +259,17 @@ resource "helm_release" "cloud_monitoring_agent" {
 %{for line in split("\n", yamlencode(var.prometheus_config))~}
       ${line}
 %{endfor~}
+  "createPriorityClass": ${var.create_priority_class}
+  "priorityClassName": ${var.priority_class_name}
+  "priorityClassValue": ${var.priority_class_value}
+  "daemonset":
+    "updateStrategy":
+      "type": "RollingUpdate"
+      "rollingUpdate":
+        "maxUnavailable": ${var.max_unavailable}
+%{ if var.max_surge != null }
+        "maxSurge": ${var.max_surge}
+%{ endif }
 EOT
   ]
 

variables.tf

@@ -246,6 +246,37 @@ variable "deployment_tag" {
   default     = "terraform"
 }
 
+variable "max_unavailable" {
+  type        = string
+  description = "Maximum number of pods that can be unavailable during a DaemonSet rolling update. Accepts absolute number or percentage (e.g., '1' or '10%')."
+  default     = "1"
+}
+
+variable "max_surge" {
+  type        = string
+  description = "Maximum number of nodes that can have an extra DaemonSet pod during a rolling update. Accepts absolute number or percentage (e.g., '1' or '10%')."
+  default     = null
+}
+
+
+variable "create_priority_class" {
+  type        = bool
+  description = "Specify whether or not to create a priority class for the agent daemonset."
+  default     = true
+}
+
+variable "priority_class_name" {
+  type        = string
+  description = "Sets the priority class name for the agent daemonset."
+  default     = "sysdig-daemonset-priority"
+}
+
+variable "priority_class_value" {
+  type        = number
+  description = "Sets the priority class value for the agent daemonset."
+  default     = 10
+}
+
 ##############################################################################
 # Metrics related variables
 ##############################################################################