Defaulting job's ttlSecondsAfterFinished to work with argocd

Author: ab-andresc

charts/nginx-gateway-fabric/README.md

@@ -252,7 +252,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
 
 | Key | Description | Type | Default |
 |-----|-------------|------|---------|
-| `certGenerator` | The certGenerator section contains the configuration for the cert-generator Job. | object | `{"agentTLSSecretName":"agent-tls","annotations":{},"overwrite":false,"serverTLSSecretName":"server-tls"}` |
+| `certGenerator` | The certGenerator section contains the configuration for the cert-generator Job. | object | `{"agentTLSSecretName":"agent-tls","annotations":{},"overwrite":false,"serverTLSSecretName":"server-tls","ttlSecondsAfterFinished":0}` |
 | `certGenerator.agentTLSSecretName` | The name of the base Secret containing TLS CA, certificate, and key for the NGINX Agent to securely communicate with the NGINX Gateway Fabric control plane. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"agent-tls"` |
 | `certGenerator.annotations` | The annotations of the cert-generator Job. | object | `{}` |
 | `certGenerator.overwrite` | Overwrite existing TLS Secrets on startup. | bool | `false` |

charts/nginx-gateway-fabric/templates/certs-job.yaml

@@ -153,4 +153,4 @@ spec:
       securityContext:
         fsGroup: 1001
         runAsNonRoot: true
-  ttlSecondsAfterFinished: 0
+  ttlSecondsAfterFinished: {{ .Values.certGenerator.ttlSecondsAfterFinished }}

charts/nginx-gateway-fabric/values.schema.json

@@ -30,7 +30,14 @@
           "required": [],
           "title": "serverTLSSecretName",
           "type": "string"
-        }
+        },
+		"ttlSecondsAfterFinished": {
+		  "default": 0,
+		  "description": "The number of seconds after which the cert-generator Job will be deleted after it has finished.\nThis is useful to avoid having a large number of completed Jobs in the cluster. And for allowing argocd to complete pre and post sync hooks.",
+		  "required": [],
+		  "title": "ttlSecondsAfterFinished",
+		  "type": "integer"
+		}
       },
       "required": [],
       "title": "certGenerator",

charts/nginx-gateway-fabric/values.yaml

@@ -479,6 +479,8 @@ certGenerator:
   # -- Overwrite existing TLS Secrets on startup.
   overwrite: false
 
+  ttlSecondsAfterFinished: 0
+
 # -- A list of Gateway objects. View https://gateway-api.sigs.k8s.io/reference/spec/#gateway for full Gateway reference.
 gateways: []
 

deploy/azure/deploy.yaml

@@ -367,7 +367,7 @@ spec:
         fsGroup: 1001
         runAsNonRoot: true
       serviceAccountName: nginx-gateway-cert-generator
-  ttlSecondsAfterFinished: 0
+  ttlSecondsAfterFinished: 90
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass

deploy/default/deploy.yaml

@@ -365,7 +365,7 @@ spec:
         fsGroup: 1001
         runAsNonRoot: true
       serviceAccountName: nginx-gateway-cert-generator
-  ttlSecondsAfterFinished: 0
+  ttlSecondsAfterFinished: 90
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass

deploy/experimental-nginx-plus/deploy.yaml

@@ -373,7 +373,7 @@ spec:
         fsGroup: 1001
         runAsNonRoot: true
       serviceAccountName: nginx-gateway-cert-generator
-  ttlSecondsAfterFinished: 0
+  ttlSecondsAfterFinished: 90
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass

deploy/experimental/deploy.yaml

@@ -370,7 +370,7 @@ spec:
         fsGroup: 1001
         runAsNonRoot: true
       serviceAccountName: nginx-gateway-cert-generator
-  ttlSecondsAfterFinished: 0
+  ttlSecondsAfterFinished: 90
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass

deploy/nginx-plus/deploy.yaml

@@ -368,7 +368,7 @@ spec:
         fsGroup: 1001
         runAsNonRoot: true
       serviceAccountName: nginx-gateway-cert-generator
-  ttlSecondsAfterFinished: 0
+  ttlSecondsAfterFinished: 90
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass

deploy/nodeport/deploy.yaml

@@ -365,7 +365,7 @@ spec:
         fsGroup: 1001
         runAsNonRoot: true
       serviceAccountName: nginx-gateway-cert-generator
-  ttlSecondsAfterFinished: 0
+  ttlSecondsAfterFinished: 90
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass

deploy/openshift/deploy.yaml

@@ -387,7 +387,7 @@ spec:
         fsGroup: 1001
         runAsNonRoot: true
       serviceAccountName: nginx-gateway-cert-generator
-  ttlSecondsAfterFinished: 0
+  ttlSecondsAfterFinished: 90
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass

deploy/snippets-filters-nginx-plus/deploy.yaml

@@ -371,7 +371,7 @@ spec:
         fsGroup: 1001
         runAsNonRoot: true
       serviceAccountName: nginx-gateway-cert-generator
-  ttlSecondsAfterFinished: 0
+  ttlSecondsAfterFinished: 90
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass

deploy/snippets-filters/deploy.yaml

@@ -368,7 +368,7 @@ spec:
         fsGroup: 1001
         runAsNonRoot: true
       serviceAccountName: nginx-gateway-cert-generator
-  ttlSecondsAfterFinished: 0
+  ttlSecondsAfterFinished: 90
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: GatewayClass