feat(sdm): support priorityClassName on the relay and proxy Pods

[satdeveloping]

Summary

Adds an optional strongdm.deployment.priorityClassName value to the sdm-relay and sdm-proxy charts, rendered into the Deployment's pod spec next to the existing nodeSelector / tolerations.

Motivation

There's currently no way to set a PriorityClass on the relay or proxy Pod via the chart. On a busy cluster these Pods can be preempted or left Pending under node pressure — and because they broker access to in-cluster resources, losing one means losing that access exactly when you're most likely to need it (e.g. during a node roll or an incident). Being able to set e.g. system-cluster-critical (or a custom high-priority class) lets operators protect them.

Changes

Applied identically to both deployments/sdm-relay and deployments/sdm-proxy:

• values.yaml — new strongdm.deployment.priorityClassName (with @schema description).
• templates/deployment.yaml — renders priorityClassName only when set ({{- with … }}).
• values.schema.json — added the matching string property under deployment.
• values.test.yaml — exercises the new value.
• Chart.yaml — relay 2.6.4 → 2.7.0, proxy 2.7.6 → 2.8.0 (minor: additive, opt-in feature).

Backward compatibility

Fully backward-compatible. The value defaults to "", and the template omits the field entirely when empty, so existing installs render byte-for-byte identically.

Testing

Both charts, e.g. for sdm-proxy:

# default: field absent
helm template t deployments/sdm-proxy --set strongdm.auth.clusterKey=x --set strongdm.auth.clusterSecret=y | grep -c priorityClassName        # -> 0

# set: field present on the pod spec
helm template t deployments/sdm-proxy --set strongdm.auth.clusterKey=x --set strongdm.auth.clusterSecret=y \
  --set strongdm.deployment.priorityClassName=system-cluster-critical | grep priorityClassName    # -> priorityClassName: system-cluster-critical

helm lint deployments/sdm-proxy --set strongdm.auth.clusterKey=x --set strongdm.auth.clusterSecret=y   # 0 charts failed

(Equivalent commands pass for sdm-relay with strongdm.auth.relayToken.) Values validate against the updated values.schema.json (helm enforces it during templating).

[kellenanker7]

this is great, thanks for the contribution!

at the risk of some minor scope creep, could you please make the same change to sdm-proxy as well?

reminder to bump the version in sdm-proxy/Chart.yaml like you did here (I often forget to myself).

[satdeveloping]

Thanks! Done — mirrored the same change onto sdm-proxy (values.yaml + template + schema + test values), and bumped sdm-proxy/Chart.yaml 2.7.6 → 2.8.0. helm template/helm lint pass for both charts: absent by default, rendered when set.

[kellenanker7]

sorry for the nit, but one last request for consistency with the other fields.

could you make these simply:

priorityClassName: {{ .Values.strongdm.deployment.priorityClassName }}

the default "" is valid if applied server-side 👍

[kellenanker7]

same as the other comment!

[kellenanker7]

@satdeveloping sorry for the delay. I resolved some merge conflicts and requested one last nitpick change.