Admission controller missing topology spread or pod Anti affinity to avoid scheduling webhook controllers on the same node

[sidewinder12s]

This can cause outages if the node goes down

[blang9238]

Hey @sidewinder12s the deployment template actually has the affinity, we just don't have a placeholder in the values.yaml.

https://github.com/anchore/anchore-charts/blob/main/stable/anchore-admission-controller/templates/deployment.yaml#L81C7-L81C32

https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#more-practical-use-cases

You should be able to assign antiAffinity with something like the following in your values.yaml:

affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    - labelSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - store
      topologyKey: "kubernetes.io/hostname"

[sidewinder12s]

TopologySpreadConstraint is the Kubernetes recommended configuration for this type requirement.