US-622676 - helm chart changes for tcp keep alive probe

Jenkinsfile

@@ -28,7 +28,7 @@ node {
             branchName = "${scmVars.GIT_BRANCH}"
             packageName = currentBuild.displayName
             prNumber = "${env.BRANCH_NAME}".split("-")[1]
-            chartVersion = "${prNumber}.${env.BUILD_NUMBER}"
+            chartVersion = "3.11.${env.BUILD_NUMBER}"
             deployConfigsFileName = "deploy-config-${chartVersion}.tgz"
             installerConfigsFileName = "installer-config-${chartVersion}.tgz"
             // Perform Chart packaging

charts/pega/README.md

@@ -333,6 +333,20 @@ tier:
       runAsUser: RUN_AS_USER
       fsGroup: FS_GROUP
 ```
+
+Starting from Kubernetes 1.29 version, kubernetes allows to set OS kernel level setting `net.ipv4.tcp_keepalive_time` using standard sysctls command.
+Please refer below example and if needed, provide the value in seconds as per the cloud provider TCP connections timeout settings.
+
+Example:
+
+```yaml
+tier:
+  - name: my-tier
+    securityContext:
+      sysctls:
+        - name: net.ipv4.tcp_keepalive_time
+          value: "300"
+```
 ### service
 
 Specify the `service` yaml block to expose a Pega tier to other Kubernetes run services, or externally to other systems. The name of the service will be based on the tier's name, so if your tier is "web", your service name will be "pega-web". If you omit service, no Kubernetes service object is created for the tier during the deployment. For more information on services, see the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/services-networking/service).

charts/pega/templates/_pega-deployment.tpl

@@ -117,6 +117,11 @@ spec:
         runAsUser: 9001
         fsGroup: 0
 {{- end }}
+{{- if (.node.tcpKeepAliveProbe) }}
+        sysctls:
+        - name: "net.ipv4.tcp_keepalive_time"
+          value: "{{ .node.tcpKeepAliveProbe }}"
+{{- end }}
 {{- if .node.securityContext }}
 {{ toYaml .node.securityContext | indent 8 }}
 {{- end }}

charts/pega/values.yaml

@@ -257,6 +257,14 @@ global:
       #   runAsUser: 9001
       #   fsGroup: 0
 
+      # To configure net.ipv4.tcp_keepalive_time OS Kernel setting, set the value in seconds.
+      # This setting only works for Kubernetes version 1.29 onwards. For more information, see below,
+      # https://github.com/pegasystems/pega-helm-charts/blob/master/charts/pega/README.md#security-context
+      # securityContext:
+      #   sysctls:
+      #   - name: net.ipv4.tcp_keepalive_time
+      #     value: "300"
+
       # To specify security settings for a Container, include the securityContext field in the Container manifest
       # Security settings that you specify for a Container apply only to the pega container,
       # and they override settings made at the Pod level when there is overlap. Container settings
@@ -328,6 +336,14 @@ global:
       #   runAsUser: 9001
       #   fsGroup: 0
 
+      # To configure net.ipv4.tcp_keepalive_time OS Kernel setting, set the value in seconds.
+      # This setting only works for Kubernetes version 1.29 onwards. For more information, see below,
+      # https://github.com/pegasystems/pega-helm-charts/blob/master/charts/pega/README.md#security-context
+      # securityContext:
+      #   sysctls:
+      #   - name: net.ipv4.tcp_keepalive_time
+      #     value: "300"
+
       # To specify security settings for a Container, include the securityContext field in the Container manifest
       # Security settings that you specify for a Container apply only to the pega container,
       # and they override settings made at the Pod level when there is overlap. Container settings
@@ -399,6 +415,14 @@ global:
       #   runAsUser: 9001
       #   fsGroup: 0
 
+      # To configure net.ipv4.tcp_keepalive_time OS Kernel setting, set the value in seconds.
+      # This setting only works for Kubernetes version 1.29 onwards. For more information, see below,
+      # https://github.com/pegasystems/pega-helm-charts/blob/master/charts/pega/README.md#security-context
+      # securityContext:
+      #   sysctls:
+      #   - name: net.ipv4.tcp_keepalive_time
+      #     value: "300"
+
       # To specify security settings for a Container, include the securityContext field in the Container manifest
       # Security settings that you specify for a Container apply only to the pega container,
       # and they override settings made at the Pod level when there is overlap. Container settings

terratest/src/test/pega/pega-tier-deployment_test.go

@@ -75,16 +75,16 @@ func TestPegaTierDeploymentWithPodAffinity(t *testing.T) {
 	for _, vendor := range supportedVendors {
 		var options = &helm.Options{
 			SetValues: map[string]string{
-				"global.provider":                        									vendor,
-				"global.actions.execute":                 									"deploy",
-				"global.deployment.name":                 									"pega",
-				"installer.upgrade.upgradeType":          									"zero-downtime",
-				"global.tier[0].name":                    									"web",
-				"global.tier[1].name":                    									"batch",
-				"global.tier[2].name":                    									"stream",
-				affintiyBasePath + "nodeSelectorTerms[0].matchExpressions[0].key": 			"kubernetes.io/os", 
-				affintiyBasePath + "nodeSelectorTerms[0].matchExpressions[0].operator": 	"In", 
-				affintiyBasePath + "nodeSelectorTerms[0].matchExpressions[0].values[0]": 	"linux", 
+				"global.provider":               vendor,
+				"global.actions.execute":        "deploy",
+				"global.deployment.name":        "pega",
+				"installer.upgrade.upgradeType": "zero-downtime",
+				"global.tier[0].name":           "web",
+				"global.tier[1].name":           "batch",
+				"global.tier[2].name":           "stream",
+				affintiyBasePath + "nodeSelectorTerms[0].matchExpressions[0].key":       "kubernetes.io/os",
+				affintiyBasePath + "nodeSelectorTerms[0].matchExpressions[0].operator":  "In",
+				affintiyBasePath + "nodeSelectorTerms[0].matchExpressions[0].values[0]": "linux",
 			},
 		}
 
@@ -102,7 +102,37 @@ func TestPegaTierDeploymentWithPodAffinity(t *testing.T) {
 		UnmarshalK8SYaml(t, yamlSplit[3], &depObjStream)
 		deploymentAffinityStream := depObjStream.Spec.Template.Spec.Affinity
 		require.Empty(t, deploymentAffinityStream)
-	}	
+	}
+}
+
+func TestPegaTierDeploymentWithTCPProbe(t *testing.T) {
+
+	var supportedVendors = []string{"k8s", "eks", "gke", "aks", "pks"}
+	helmChartPath, err := filepath.Abs(PegaHelmChartPath)
+	require.NoError(t, err)
+
+	var depObj appsv1.Deployment
+
+	for _, vendor := range supportedVendors {
+		var options = &helm.Options{
+			SetValues: map[string]string{
+				"global.provider":                  vendor,
+				"global.actions.execute":           "deploy",
+				"global.deployment.name":           "pega",
+				"global.tier[0].name":              "web",
+				"global.tier[0].tcpKeepAliveProbe": "10",
+			},
+		}
+
+		yamlContent := RenderTemplate(t, options, helmChartPath, []string{"templates/pega-tier-deployment.yaml"})
+		yamlSplit := strings.Split(yamlContent, "---")
+
+		UnmarshalK8SYaml(t, yamlSplit[1], &depObj)
+		require.Equal(t, "net.ipv4.tcp_keepalive_time", *&depObj.Spec.Template.Spec.SecurityContext.Sysctls[0].Name)
+		require.Equal(t, "10", *&depObj.Spec.Template.Spec.SecurityContext.Sysctls[0].Value)
+
+	}
+
 }
 
 func TestPegaTierDeploymentWithFSGroup(t *testing.T) {