Explain why to use priorityClassName: system-cluster-critical in production

[wallrj]

Preview: https://deploy-preview-1444--cert-manager-website.netlify.app/docs/installation/best-practice/#priority-class-name

I've done some research into the use-cases for setting priorityClassName and what priority class to use.
I think cert-manager should use the built in priority class system-cluster-critical,
and I've tried to justify that in the document.

It turns out that if you want to use that built in priority class, you (always?) also have to create a ResourceQuota resource, and I've tried to explain that too.

@hawksight interested to know what you think about this new recommendation.

Links:

• feat(helm chart): add priorityClassName option cert-manager#1190
• Allow configuring of the priorityClass trust-manager#176
• Allow users to configure the priorityClassName field in the Helm chart approver-policy#403
• Adds priorityClassName option to helm chart csi-driver#124
• Adds priorityClassName option to helm chart csi-driver-spiffe#20
• Add very useful values common with the main Cert-manager chart google-cas-issuer#96
• Add support of priorityClassName to the helm chart aws-privateca-issuer#286
• https://linkerd.io/2.15/tasks/customize-install/#add-priorityclass
• https://github.com/kubernetes/design-proposals-archive/blob/main/scheduling/pod-priority-resourcequota.md
• Set priority class for the critical Flux components fluxcd/flux2#3802
• https://goteleport.com/docs/reference/helm-reference/teleport-cluster/#priorityclassname
• feat(argo-rollouts): Allow defining priorityClassName argoproj/argo-helm#1212

[netlify]

✅ Deploy Preview for cert-manager-website ready!

Name	Link
🔨 Latest commit	22da1ab
🔍 Latest deploy log	https://app.netlify.com/sites/cert-manager-website/deploys/65f465fd80b8a40008df2ced
😎 Deploy Preview	https://deploy-preview-1444--cert-manager-website.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[hawksight]

@wallrj thank you for all the detailed explanation.

I think that I agree based on your research. Assuming Certificate or CertificateRequest resources need to validated (which needs the webhook component running), then the cert-manager components are now system critical.

The recommendations here look good, although I have not actually implemented them in a cluster to validate.

[hawksight]

/lgtm

[hawksight]

/approve

[hawksight]

/lgtm
/approve

It is easier to read and more suggestive in this manner. Thanks @wallrj.
@aidy how does the revised content read to you?

[wallrj]

/approve

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hawksight, wallrj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [wallrj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment