[K8s Best Practice] Add PDB and missing labels

egress/templates/_helpers.tpl

@@ -36,6 +36,8 @@ Common labels
 {{- define "egress.labels" -}}
 helm.sh/chart: {{ include "egress.chart" . }}
 {{ include "egress.selectorLabels" . }}
+app.kubernetes.io/component: egress
+app.kubernetes.io/part-of: livekit
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}

egress/templates/configmap.yaml

@@ -2,6 +2,8 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "egress.fullname" . }}
+  labels:
+    {{- include "egress.labels" . | nindent 4 }}
 data:
   config.yaml: |
 {{ toYaml .Values.egress | indent 4 }}

egress/templates/deployment.yaml

@@ -20,6 +20,9 @@ spec:
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
       labels:
         {{- include "egress.selectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
     spec:
       serviceAccountName: {{ include "egress.serviceAccountName" . }}
       securityContext:

egress/templates/pdb.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "egress.fullname" . }}
+  labels:
+    {{- include "egress.labels" . | nindent 4 }}
+spec:
+  {{- if .Values.podDisruptionBudget.minAvailable }}
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  {{- end }}
+  {{- if .Values.podDisruptionBudget.maxUnavailable }}
+  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "egress.selectorLabels" . | nindent 6 }}
+{{- end }}

egress/values.yaml

@@ -34,10 +34,20 @@ podAnnotations:
   sidecar.istio.io/inject: "false"
   linkerd.io/inject: disabled
 
+# Extra labels to add to pods. Useful for network policy selectors.
+podLabels: {}
+
 podSecurityContext: {}
 
 securityContext: {}
 
 tolerations: []
 
 affinity: {}
+
+# Pod Disruption Budget ensures minimum availability during voluntary disruptions
+# (node drains, cluster upgrades). Disabled by default — enable when running 2+ replicas.
+podDisruptionBudget:
+  enabled: false
+  # minAvailable: 1
+  # maxUnavailable: 1

ingress/templates/_helpers.tpl

@@ -36,6 +36,8 @@ Common labels
 {{- define "ingress.labels" -}}
 helm.sh/chart: {{ include "ingress.chart" . }}
 {{ include "ingress.selectorLabels" . }}
+app.kubernetes.io/component: ingress
+app.kubernetes.io/part-of: livekit
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}

ingress/templates/configmap.yaml

@@ -2,6 +2,8 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "ingress.fullname" . }}
+  labels:
+    {{- include "ingress.labels" . | nindent 4 }}
 data:
   config.yaml: |
 {{ toYaml .Values.ingress | indent 4 }}

ingress/templates/deployment.yaml

@@ -20,6 +20,9 @@ spec:
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
       labels:
         {{- include "ingress.selectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
     spec:
       serviceAccountName: {{ include "ingress.serviceAccountName" . }}
       securityContext:

ingress/templates/pdb.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "ingress.fullname" . }}
+  labels:
+    {{- include "ingress.labels" . | nindent 4 }}
+spec:
+  {{- if .Values.podDisruptionBudget.minAvailable }}
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  {{- end }}
+  {{- if .Values.podDisruptionBudget.maxUnavailable }}
+  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "ingress.selectorLabels" . | nindent 6 }}
+{{- end }}

ingress/values.yaml

@@ -53,10 +53,23 @@ podAnnotations:
   sidecar.istio.io/inject: "false"
   linkerd.io/inject: disabled
 
+# Extra labels to add to pods. Useful for network policy selectors.
+# Ingress uses host networking, so it typically needs to bypass CNI
+# network policies (Calico, Cilium, etc.).
+podLabels: {}
+  # networking/allow-host-network: "true"
+
 podSecurityContext: {}
 
 securityContext: {}
 
 tolerations: []
 
 affinity: {}
+
+# Pod Disruption Budget ensures minimum availability during voluntary disruptions
+# (node drains, cluster upgrades). Disabled by default — enable when running 2+ replicas.
+podDisruptionBudget:
+  enabled: false
+  # minAvailable: 1
+  # maxUnavailable: 1

livekit-server/templates/_helpers.tpl

@@ -36,6 +36,8 @@ Common labels
 {{- define "livekit-server.labels" -}}
 helm.sh/chart: {{ include "livekit-server.chart" . }}
 {{ include "livekit-server.selectorLabels" . }}
+app.kubernetes.io/component: sfu
+app.kubernetes.io/part-of: livekit
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}

livekit-server/templates/backendconfig.yaml

@@ -3,6 +3,8 @@ apiVersion: cloud.google.com/v1
 kind: BackendConfig
 metadata:
   name: {{ include "livekit-server.fullname" . }}
+  labels:
+    {{- include "livekit-server.labels" . | nindent 4 }}
 spec:
   {{ .Values.gcp.backendConfig | toPrettyJson }}
 {{ end }}

livekit-server/templates/configmap.yaml

@@ -2,6 +2,8 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "livekit-server.fullname" . }}
+  labels:
+    {{- include "livekit-server.labels" . | nindent 4 }}
 data:
   config.yaml: |
 {{ toYaml .Values.livekit | indent 4 }}

livekit-server/templates/deployment.yaml

@@ -28,6 +28,9 @@ spec:
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
       labels:
         {{- include "livekit-server.selectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
     spec:
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:

livekit-server/templates/pdb.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "livekit-server.fullname" . }}
+  labels:
+    {{- include "livekit-server.labels" . | nindent 4 }}
+spec:
+  {{- if .Values.podDisruptionBudget.minAvailable }}
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  {{- end }}
+  {{- if .Values.podDisruptionBudget.maxUnavailable }}
+  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "livekit-server.selectorLabels" . | nindent 6 }}
+{{- end }}

livekit-server/values.yaml

@@ -106,6 +106,12 @@ serviceAccount:
 
 podHostNetwork: true
 
+# Extra labels to add to pods. Useful for network policy selectors.
+# LiveKit uses host networking and wide port ranges, so it typically needs
+# to bypass CNI network policies (Calico, Cilium, etc.).
+podLabels: {}
+  # networking/allow-host-network: "true"
+
 podAnnotations:
   sidecar.istio.io/inject: "false"
   linkerd.io/inject: disabled
@@ -150,3 +156,10 @@ serviceMonitor:
   name: ""
   # The scrape interval
   interval: 30s
+
+# Pod Disruption Budget ensures minimum availability during voluntary disruptions
+# (node drains, cluster upgrades). Disabled by default — enable when running 2+ replicas.
+podDisruptionBudget:
+  enabled: false
+  # minAvailable: 1
+  # maxUnavailable: 1