Make the priority class name configurable in the SPOD configuration

api/spod/v1alpha1/spod_types.go

@@ -318,6 +318,11 @@ type SPODSpec struct {
 	// of SPOD daemon.
 	// +optional
 	DaemonResourceRequirements *corev1.ResourceRequirements `json:"daemonResourceRequirements,omitempty"`
+
+	// PriorityClassName if defined, indicates the spod pod priority class.
+	// +optional
+	// +kubebuilder:default="system-node-critical"
+	PriorityClassName string `json:"priorityClassName,omitempty"`
 }
 
 // SPODState defines the state that the spod is in.

bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml

@@ -959,6 +959,11 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              priorityClassName:
+                default: system-node-critical
+                description: PriorityClassName if defined, indicates the spod pod
+                  priority class.
+                type: string
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator

deploy/base-crds/crds/securityprofilesoperatordaemon.yaml

@@ -957,6 +957,11 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              priorityClassName:
+                default: system-node-critical
+                description: PriorityClassName if defined, indicates the spod pod
+                  priority class.
+                type: string
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator

deploy/helm/crds/crds.yaml

@@ -1484,6 +1484,11 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              priorityClassName:
+                default: system-node-critical
+                description: PriorityClassName if defined, indicates the spod pod
+                  priority class.
+                type: string
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator

deploy/namespace-operator.yaml

@@ -1484,6 +1484,11 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              priorityClassName:
+                default: system-node-critical
+                description: PriorityClassName if defined, indicates the spod pod
+                  priority class.
+                type: string
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator

deploy/openshift-dev.yaml

@@ -1484,6 +1484,11 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              priorityClassName:
+                default: system-node-critical
+                description: PriorityClassName if defined, indicates the spod pod
+                  priority class.
+                type: string
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator

deploy/openshift-downstream.yaml

@@ -1484,6 +1484,11 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              priorityClassName:
+                default: system-node-critical
+                description: PriorityClassName if defined, indicates the spod pod
+                  priority class.
+                type: string
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator

deploy/operator.yaml

@@ -1484,6 +1484,11 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              priorityClassName:
+                default: system-node-critical
+                description: PriorityClassName if defined, indicates the spod pod
+                  priority class.
+                type: string
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator

deploy/webhook-operator.yaml

@@ -1660,6 +1660,11 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              priorityClassName:
+                default: system-node-critical
+                description: PriorityClassName if defined, indicates the spod pod
+                  priority class.
+                type: string
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator

installation-usage.md

@@ -11,6 +11,7 @@
   - [Installation using helm](#installation-using-helm)
   - [Installation on AKS](#installation-on-aks)
 - [Configure a custom kubelet root directory](#configure-a-custom-kubelet-root-directory)
+- [Set a custom priority class name for spod daemon pod](#set-a-custom-priority-class-name-for-spod-daemon-pod)
 - [Set logging verbosity](#set-logging-verbosity)
 - [Pull images from private registry](#pull-images-from-private-registry)
 - [Configure the SELinux type](#configure-the-selinux-type)
@@ -206,6 +207,20 @@ kubelet.kubernetes.io/directory-location: mnt-resource-kubelet
 Where the value of the label is the kubelet root directory path, by replacing `/` with `-`. For example the value above is translated
 by the operator from `mnt-resource-kubelet` into path `/mnt/resource/kubelet`.
 
+## Set a custom priority class name for spod daemon pod
+
+The default priority class name of the spod daemon pod is set to `system-node-critical`. A custom priority class name can be configured
+in the SPOD configuration by setting a value in the `priorityClassName` filed.
+
+
+```
+> kubectl -n security-profiles-operator patch spod spod --type=merge -p '{"spec":{"priorityClassName":"my-priority-class"}}'
+securityprofilesoperatordaemon.security-profiles-operator.x-k8s.io/spod patched
+```
+
+This is useful in situations when the spod deamon pod remains in `Pending` state, because there isn't enough capacity on the related
+node to be scheduled.
+
 ## Set logging verbosity
 
 The operator supports the default logging verbosity of `0` and an enhanced `1`.

internal/pkg/manager/spod/bindata/spod.go

@@ -70,6 +70,7 @@ const (
 	NonRootEnablerContainerName                = "non-root-enabler"
 	SelinuxPoliciesCopierContainerName         = "selinux-shared-policies-copier"
 	LocalSeccompProfilePath                    = "security-profiles-operator.json"
+	DefaultPriorityClassName                   = "system-node-critical"
 )
 
 var DefaultSPOD = &spodv1alpha1.SecurityProfilesOperatorDaemon{
@@ -85,6 +86,7 @@ var DefaultSPOD = &spodv1alpha1.SecurityProfilesOperatorDaemon{
 		EnableBpfRecorder:   false,
 		StaticWebhookConfig: false,
 		HostProcVolumePath:  DefaultHostProcPath,
+		PriorityClassName:   DefaultPriorityClassName,
 		SelinuxOpts: spodv1alpha1.SelinuxOptions{
 			AllowedSystemProfiles: []string{
 				"container",

internal/pkg/manager/spod/spod_controller.go

@@ -656,6 +656,7 @@ func (r *ReconcileSPOd) getConfiguredSPOd(
 	templateSpec.Tolerations = cfg.Spec.Tolerations
 	templateSpec.Affinity = cfg.Spec.Affinity
 	templateSpec.ImagePullSecrets = cfg.Spec.ImagePullSecrets
+	templateSpec.PriorityClassName = cfg.Spec.PriorityClassName
 
 	return newSPOd
 }