From fe73b2eae37d444f18110c6f84c682edcb478b03 Mon Sep 17 00:00:00 2001
From: Piotr Reszke <piotr@reducto.ai>
Date: Tue, 10 Nov 2026 10:26:37 +0100
Subject: [PATCH] feat: control.podAnnotations

Extra annotations on the control pods (Deployment, or the raft
StatefulSet), e.g. karpenter.sh/do-not-disrupt, without a post-renderer.
Empty by default: unset renders as before.
---
 Chart.yaml                       |  2 +-
 templates/deployment.yaml        |  3 +++
 test/test.sh                     | 15 +++++++++++++++
 test/values-pod-annotations.yaml |  4 ++++
 values.yaml                      |  2 ++
 5 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 test/values-pod-annotations.yaml

diff --git a/Chart.yaml b/Chart.yaml
index d5c21c4..3583690 100644
--- a/Chart.yaml
+++ b/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: pgdog-control
 description: PgDog Control
 type: application
-version: 0.4.1
+version: 0.4.2
 appVersion: "main-ent"
diff --git a/templates/deployment.yaml b/templates/deployment.yaml
index 1795aa2..f1a5994 100644
--- a/templates/deployment.yaml
+++ b/templates/deployment.yaml
@@ -59,6 +59,9 @@ spec:
         # pods.
         checksum/aws-creds: {{ include (print $.Template.BasePath "/aws-secret.yaml") . | sha256sum }}
         {{- end }}
+        {{- with .Values.control.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       labels:
         {{- include "pgdog-control.selectorLabels" . | nindent 8 }}
     spec:
diff --git a/test/test.sh b/test/test.sh
index ac69db1..6c52971 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -48,5 +48,20 @@ for conflict in "control.rbac.create=true" "control.aws.roleArn=arn:aws:iam::123
   fi
 done
 
+echo ""
+echo "==> Verifying control pod annotations..."
+annotations=$(helm template test-release "$CHART_DIR" -f "$TEST_DIR/values-pod-annotations.yaml" \
+  | yq -o=json -I=0 'select(.kind == "Deployment" and .metadata.name == "test-release-control") | .spec.template.metadata.annotations | with_entries(select(.key | test("^checksum/") | not))')
+if [ "$annotations" != '{"meta.helm.sh/release-name":"test-release","meta.helm.sh/release-namespace":"default","karpenter.sh/do-not-disrupt":"24h"}' ]; then
+  echo "control.podAnnotations not rendered on the control pods: $annotations" >&2
+  exit 1
+fi
+raft_annotation=$(helm template test-release "$CHART_DIR" -f "$TEST_DIR/values-raft.yaml" -f "$TEST_DIR/values-pod-annotations.yaml" \
+  | yq -r 'select(.kind == "StatefulSet") | .spec.template.metadata.annotations."karpenter.sh/do-not-disrupt"')
+if [ "$raft_annotation" != "24h" ]; then
+  echo "control.podAnnotations not rendered on the raft StatefulSet pods: $raft_annotation" >&2
+  exit 1
+fi
+
 echo ""
 echo "==> All chart tests passed!"
diff --git a/test/values-pod-annotations.yaml b/test/values-pod-annotations.yaml
new file mode 100644
index 0000000..9020215
--- /dev/null
+++ b/test/values-pod-annotations.yaml
@@ -0,0 +1,4 @@
+# Extra annotations on the control pods.
+control:
+  podAnnotations:
+    karpenter.sh/do-not-disrupt: "24h"
diff --git a/values.yaml b/values.yaml
index f4a5dba..37d2e90 100644
--- a/values.yaml
+++ b/values.yaml
@@ -81,6 +81,8 @@ control:
     limits:
       memory: "4Gi"
       cpu: "1000m"
+  # Extra annotations on the control pods, e.g. karpenter.sh/do-not-disrupt.
+  podAnnotations: {}
   # Pod-level securityContext for the control deployment.
   # Defaults are PSS Restricted compliant.
   podSecurityContext: