Add topologySpreadConstraints to Helm chart

[SgtCoDFish]

This appears to be an oversight - seems this was missed a while back!

Example of it working:

$ cat _bin/a.yaml
image:
  repository: cert-manager.local/cert-manager-istio-csr

app:
  logLevel: 5
  logFormat: json
  runtimeIssuanceConfigMap: runtime-config-map
  certmanager:
    issuer:
      name: ""
      kind: ""
      group: ""
  tls:
    istiodCertificateEnable: "dynamic"
  istio:
    revisions: ["default", "abc"]

topologySpreadConstraints:
- maxSkew: 2
  topologyKey: topology.kubernetes.io/zone
  whenUnsatisfiable: ScheduleAnyway
  labelSelector:
    matchLabels:
      app.kubernetes.io/instance: cert-manager
      app.kubernetes.io/component: controller

$ helm template istio-csr ./deploy/charts/istio-csr --values _bin/a.yaml
...
# Source: cert-manager-istio-csr/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cert-manager-istio-csr
  namespace: default
  labels:
    app.kubernetes.io/name: cert-manager-istio-csr
    helm.sh/chart: cert-manager-istio-csr-v0.0.0
    app.kubernetes.io/instance: istio-csr
    app.kubernetes.io/version: "v0.0.0"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 1
  selector:
    matchLabels:
      app: cert-manager-istio-csr
  template:
    metadata:
      labels:
        app: cert-manager-istio-csr
        app.kubernetes.io/name: cert-manager-istio-csr
        helm.sh/chart: cert-manager-istio-csr-v0.0.0
        app.kubernetes.io/instance: istio-csr
        app.kubernetes.io/version: "v0.0.0"
        app.kubernetes.io/managed-by: Helm
    spec:
      serviceAccountName: cert-manager-istio-csr
      nodeSelector:
        kubernetes.io/os: linux
      topologySpreadConstraints:
        - labelSelector:
            matchLabels:
              app.kubernetes.io/component: controller
              app.kubernetes.io/instance: cert-manager
          maxSkew: 2
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
      containers:
      - name: cert-manager-istio-csr
        image: "cert-manager.local/cert-manager-istio-csr:v0.0.0"
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 6443
        - containerPort: 9402
        readinessProbe:
          httpGet:
            port: 6060
            path: /readyz
          initialDelaySeconds: 3
          periodSeconds: 7
        args:
          - "--log-level=5"
          - "--log-format=json"
          - "--metrics-port=9402"
          - "--readiness-probe-port=6060"
          - "--readiness-probe-path=/readyz"

            # cert-manager
          - "--certificate-namespace=istio-system"
          - "--issuer-name="
          - "--issuer-kind="
          - "--issuer-group="
          - "--preserve-certificate-requests=false"

            # AdditionalAnnotations

            # tls
          - "--root-ca-file="
          - "--serving-certificate-dns-names=cert-manager-istio-csr.cert-manager.svc"
          - "--serving-certificate-duration=1h"
          - "--trust-domain=cluster.local"

          # server
          - "--cluster-id=Kubernetes"
          - "--max-client-certificate-duration=1h"
          - "--serving-address=0.0.0.0:6443"
          - "--serving-certificate-key-size=2048"
          - "--serving-signature-algorithm=RSA"

          # controller
          - "--leader-election-namespace=istio-system"
          - "--disable-kubernetes-client-rate-limiter=false"

          - "--runtime-issuance-config-map-name=runtime-config-map"
          - "--runtime-issuance-config-map-namespace=default"

          # dynamic istiod cert
          - "--istiod-cert-enabled=true"
          - "--istiod-cert-name=istiod-dynamic"
          - "--istiod-cert-namespace=istio-system"
          - "--istiod-cert-duration=1h"
          - "--istiod-cert-renew-before=30m"
          - "--istiod-cert-key-algorithm=RSA"
          - "--istiod-cert-key-size=2048"
          - "--istiod-cert-additional-dns-names="
          - "--istiod-cert-istio-revisions=default,abc"

        resources:
            {}

[wallrj]

This will make istio-csr consistent with the other cert-manager components and the new setting is useful for the reasons given in the documentation, but I think the example is wrong.

/approve
/lgtm
/hold in case you agree that the example is wrong.

[wallrj]

/lgtm

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wallrj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [wallrj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[SgtCoDFish]

/test pull-cert-manager-istio-csr-test-ecc

The tests have been a lot less flaky recently, this is the first I've seen in a while!

[SgtCoDFish]

/unhold