annotations.md

Pod annotations

You can add annotations to Kubernetes Pod objects to customize Piggy's behavior.

Annotations

Name	Type	Default	Location	Notes
piggysec.com/aws-secret-name	string		Pods
piggysec.com/aws-region	string		Pods
piggysec.com/aws-secret-version	string	AWS_CURRENT	Pods
piggysec.com/piggy-env-image	string		Pods
piggysec.com/piggy-env-image-pull-policy	string		Pods
piggysec.com/piggy-env-resource-cpu-request	string		Pods
piggysec.com/piggy-env-resource-memory-request	string		Pods
piggysec.com/piggy-env-resource-cpu-limit	string		Pods
piggysec.com/piggy-env-resource-memory-limit	string		Pods
piggysec.com/piggy-psp-allow-privilege-escalation	boolean	false	Pods
piggysec.com/piggy-address	string		Pods
piggysec.com/piggy-skip-verify-tls	boolean	true	Pods
piggysec.com/piggy-ignore-no-env	boolean	false	Pods
piggysec.com/piggy-enforce-integrity	boolean	true	Pods
piggysec.com/debug	boolean	false	Pods
piggysec.com/standalone	boolean	false	Pods
piggysec.com/image-pull-secret	string		Pods
piggysec.com/image-pull-secret-namespace	string		Pods
piggysec.com/image-skip-verify-registry	string		Pods
piggysec.com/piggy-enforce-service-account	bool	false	Pods
piggysec.com/piggy-default-secret-name-prefix	string		Pods
piggysec.com/piggy-default-secret-name-suffix	string		Pods
piggysec.com/piggy-dns-resolver	string		Pods
piggysec.com/piggy-initial-delay	string		Pods
piggysec.com/piggy-number-of-retry	int	0	Pods

AWS Secret Manager

• piggysec.com/aws-secret-name specifies an AWS secret name, e.g., "/myapp/name".
• piggysec.com/aws-region specifies an AWS Secrets Manager region, e.g., "ap-southeast-1".
• piggysec.com/aws-secret-version specifies an AWS secret version. The default value is AWS_CURRENT.

piggy-env settings

• piggysec.com/piggy-env-image overrides the piggy-env image location. If no value is specified, the piggy-env image location will be taken from the Piggy Webhooks settings in the Helm chart.
• piggysec.com/piggy-env-image-pull-policy overrides the piggy-env image pull policy. If no value is specified, the piggy-env image pull policy will be taken from the Piggy Webhooks settings in the Helm chart.
• piggysec.com/piggy-env-resource-cpu-request overrides the piggy-env init-container resource CPU requests. Defaults to 50m.
• piggysec.com/piggy-env-resource-memory-request overrides the piggy-env init-container resource memory requests. Defaults to 64Mi.
• piggysec.com/piggy-env-resource-cpu-limit overrides the piggy-env init-container resource CPU limit. Defaults to 200m.
• piggysec.com/piggy-env-resource-memory-limit overrides the piggy-env init-container resource memory limit. Defaults to 64Mi.
• piggysec.com/piggy-psp-allow-privilege-escalation allow a piggy-env init-container to run as root. Default to false
• piggysec.com/piggy-address an endpoint of piggy-webhooks. This is required when it is running in proxy mode.
• piggysec.com/piggy-skip-verify-tls Do not verify TLS certificate between application and piggy-webhooks.
• piggysec.com/piggy-ignore-no-env does not terminate the container if no variables are found in Secrets Manager. Defaults to false. Setting this value to false (the default) is recommended for most applications; the container will not start if required environment variables are missing.
• piggysec.com/piggy-enforce-integrity enforces checking command integrity before injecting secrets. Defaults to true. Setting this value to true is recommended for most applications. Setting it to false will allow piggy-env to run with different arguments.
• piggysec.com/debug allows to run piggy-env in debug mode. Default to false.
• piggysec.com/standalone allows to run piggy-env in standalone mode. Default to false. If this value is true, the piggysec.com/piggy-address will not be used.
• piggysec.com/piggy-enforce-service-account Force to check PIGGY_ALLOWED_SA env value in AWS secret manager
• piggysec.com/piggy-default-secret-name-prefixSet default prefix string for secret name
• piggysec.com/piggy-default-secret-name-suffixSet default suffix string for secret name
• piggysec.com/piggy-dns-resolverSet Go DNS resolver such as tcp, udp. See https://pkg.go.dev/net
• piggysec.com/piggy-initial-delay sets a delay in n[ns|us|ms|s|m|h] before starting to retrieve secrets. If you are using Istio/Envoy, you may need to set this value to 2s. Envoy will block all outgoing requests from piggy-env until it is fully started. This delay allows Envoy to become operational before Piggy runs.
• piggysec.com/piggy-number-of-retry sets the number of retries for retrieving secrets before giving up. Each retry will wait for 500 milliseconds. You can use this to resolve issues with delayed pod initialization, such as with Istio/Envoy.

Container image settings

• piggysec.com/image-pull-secret specifies the name of the container image pull secret. Piggy will try to read the container image configuration by using secrets in the following order:
  1. pod.spec.imagePullSecrets
  2. piggysec.com/image-pull-secret annotation
  3. ServiceAccount permissions from the cloud provider
• piggysec.com/image-pull-secret-namespace specifies the namespace of the container image pull secret.
• piggysec.com/image-skip-verify-registry skips registry verification when trying to read the image. Defaults to true.