[stable/cluster-autoscaler] add gce support (#4614)

* add gce support

* update readme

* update Chart version to 0.5.3

* increment chart version

* update RBAC and doc's

* Update Chart.yaml

stable/cluster-autoscaler/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v1
 description: Scales worker nodes within autoscaling groups.
 icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png
 name: cluster-autoscaler
-version: 0.6.0
-appVersion: 1.1.0
+version: 0.6.1
+appVersion: 1.2.0
 home: https://github.com/kubernetes/autoscaler
 sources:
 - https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler

stable/cluster-autoscaler/README.md

@@ -31,6 +31,8 @@ To install the chart with the release name `my-release`:
 
 ### Using auto-discovery of tagged instance groups
 
+#### AWS
+
 Auto-discovery finds ASGs tags as below and automatically manages them based on the min and max size specified in the ASG. `cloudProvider=aws` only.
 
 1) tag the ASGs with _key_ `k8s.io/cluster-autoscaler/enabled` and _key_ `kubernetes.io/cluster/<YOUR CLUSTER NAME>`
@@ -43,7 +45,24 @@ $ helm install stable/cluster-autoscaler --name my-release --set autoDiscovery.c
 
 The [auto-discovery](#auto-discovery) section provides more details and examples
 
-### Specifying groups manually
+#### GCE
+##### Required parameters
+- `autoDiscovery.clusterName=any-name`
+- `--cloud-provider=gce`
+- `autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefix[0].minSize=1`
+
+1) Either provide a yaml file setting `autoscalingGroupsnamePrefix` (see values.yaml) or use `--set` e.g.:
+
+```console
+$ helm install stable/cluster-autoscaler \
+--name my-release \
+--set autoDiscovery.clusterName=<CLUSTER NAME> \
+--set cloudProvider=gce \
+--set autoDiscovery.clusterName=mycluster \
+--set "autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefix[0].minSize=1"
+```
+
+### Specifying groups manually (only aws)
 
 Without autodiscovery, specify an array of elements each containing ASG name, min size, max size. The sizes specified here will be applied to the ASG, assuming IAM permissions are correctly configured.
 
@@ -73,16 +92,19 @@ The following table lists the configurable parameters of the cluster-autoscaler
 Parameter | Description | Default
 --- | --- | ---
 `affinity` | node/pod affinities | None
-`autoDiscovery.clusterName` | enable autodiscovery for name in ASG tag (only `cloudProvider=aws`)| `""` **required unless autoscalingGroups[] provided**
+`autoDiscovery.clusterName` | enable autodiscovery for name in ASG tag (only `cloudProvider=aws`). Must be set for `cloudProvider=gce`, but no MIG tagging required.| `""` **required unless autoscalingGroups[] provided**
 `autoscalingGroups[].name` | autoscaling group name | None. Required unless `autoDiscovery.enabled=true`
 `autoscalingGroups[].maxSize` | maximum autoscaling group size | None. Required unless `autoDiscovery.enabled=true`
 `autoscalingGroups[].minSize` | minimum autoscaling group size | None. Required unless `autoDiscovery.enabled=true`
 `awsRegion` | AWS region (required if `cloudProvider=aws`) | `us-east-1`
+`autoscalingGroupsnamePrefix[].name` | GCE MIG name | None. Required for `cloudProvider=gce`
+`autoscalingGroupsnamePrefix[].maxSize` | maximum MIG size | None. Required for `cloudProvider=gce`
+`autoscalingGroupsnamePrefix[].minSize` | minimum MIG size |  None. Required for `cloudProvider=gce`
 `sslCertPath` | Path on the host where ssl ca cert exists | `/etc/ssl/certs/ca-certificates.crt`
-`cloudProvider` | `aws` or `spotinst` are currently supported | `aws`
-`image.repository` | Image (used if `cloudProvider=aws`) | `k8s.gcr.io/cluster-autoscaler`
-`image.tag` | Image tag (used if `cloudProvider=aws`) | `v1.1.0`
-`image.pullPolicy` | Image pull policy (used if `cloudProvider=aws`) | `IfNotPresent`
+`cloudProvider` | `aws` or `spotinst` are currently supported for AWS. `gce` for GCE| `aws`
+`image.repository` | Image | `k8s.gcr.io/cluster-autoscaler`
+`image.tag` | Image tag  | `v1.2.0`
+`image.pullPolicy` | Image pull policy  | `IfNotPresent`
 `extraArgs` | additional container arguments | `{}`
 `podDisruptionBudget` | Pod disruption budget | `maxUnavailable: 1`
 `extraEnv` | additional container environment variables | `{}`
@@ -90,6 +112,7 @@ Parameter | Description | Default
 `podAnnotations` | annotations to add to each pod | `{}`
 `rbac.create` | If true, create & use RBAC resources | `false`
 `rbac.serviceAccountName` | existing ServiceAccount to use (ignored if rbac.create=true) | `default`
+`rbac.pspEnabled` | Must be used with `rbac.create` true. If true, creates & uses RBAC resources required in the cluster with [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) enabled. | `false`
 `replicaCount` | desired number of pods | `1`
 `resources` | pod resource requests & limits | `{}`
 `service.annotations` | annotations to add to service | none

stable/cluster-autoscaler/templates/clusterrole.yaml

@@ -91,4 +91,15 @@ rules:
     - watch
     - list
     - get
+{{- if .Values.rbac.pspEnabled }}
+  - apiGroups:
+    - extensions
+    resources:
+    - podsecuritypolicies
+    resourceNames:
+    - privileged-{{ template "cluster-autoscaler.fullname" . }}
+    verbs:
+    - use
+{{- end -}}
+
 {{- end -}}

stable/cluster-autoscaler/templates/deployment.yaml

@@ -47,10 +47,20 @@ spec:
             - --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,kubernetes.io/cluster/
               {{- .Values.autoDiscovery.clusterName }}
             {{- end }}
+          {{- else if eq .Values.cloudProvider "gce" }}
+          {{- if .Values.autoscalingGroupsnamePrefix }}
+            {{- range .Values.autoscalingGroupsnamePrefix }}
+            - --node-group-auto-discovery=mig:namePrefix={{ .name }},min={{ .minSize }},max={{ .maxSize }}
+            {{- end }}
           {{- end }}
+          {{- end }}
+          {{- if eq .Values.cloudProvider "gce" }}
+            - --cloud-config={{ .Values.cloudConfigPath }}
+            {{- end }}
           {{- range $key, $value := .Values.extraArgs }}
             - --{{ $key }}{{ if $value }}={{ $value }}{{ end }}
           {{- end }}
+
           env:
           {{- if eq .Values.cloudProvider "aws" }}
             - name: AWS_REGION
@@ -64,7 +74,7 @@ spec:
           {{- range $key, $value := .Values.extraEnv }}
           - name: {{ $key }}
             value: {{ $value }}
-          {{- end }}          
+          {{- end }}
           livenessProbe:
             httpGet:
               path: /health-check
@@ -77,6 +87,11 @@ spec:
             - name: ssl-certs
               mountPath: {{ .Values.sslCertPath }}
               readOnly: true
+            {{- if eq .Values.cloudProvider "gce" }}
+            - name: cloudconfig
+              mountPath: {{ .Values.cloudConfigPath }}
+              readOnly: true
+            {{- end }}
     {{- if .Values.affinity }}
       affinity:
 {{ toYaml .Values.affinity | indent 8 }}
@@ -92,4 +107,9 @@ spec:
         - name: ssl-certs
           hostPath:
             path: {{ .Values.sslCertPath }}
+        {{- if eq .Values.cloudProvider "gce" }}
+        - name: cloudconfig
+          hostPath:
+            path: {{ .Values.cloudConfigPath }}
+        {{- end }}
 {{- end}}

stable/cluster-autoscaler/templates/podsecuritypolicy.yaml

@@ -0,0 +1,26 @@
+{{- if .Values.rbac.pspEnabled }}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: privileged-{{ template "cluster-autoscaler.fullname" . }}
+spec:
+  allowedCapabilities:
+  - '*'
+  fsGroup:
+    rule: RunAsAny
+  privileged: true
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes:
+  - '*'
+  hostPID: true
+  hostIPC: true
+  hostNetwork: true
+  hostPorts:
+  - min: 1
+    max: 65536
+{{- end }}

stable/cluster-autoscaler/values.yaml

@@ -1,35 +1,59 @@
 autoDiscovery:
-# Only cloudProvider `aws` is supported by auto-discovery at this time
-# Set tags as described in https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup
+# Only cloudProvider `aws` and `gce` are supported by auto-discovery at this time
+# AWS: Set tags as described in https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup
   clusterName:  # cluster.local
 
 autoscalingGroups: []
 # At least one element is required if not using autoDiscovery
   # - name: asg1
-  #   maxSize: 1
-  #   minSize: 2
+  #   maxSize: 2
+  #   minSize: 1
   # - name: asg2
-  #   maxSize: 1
-  #   minSize: 2
+  #   maxSize: 2
+  #   minSize: 1
+
+autoscalingGroupsnamePrefix: []
+# At least one element is required if not using autoDiscovery
+  # - name: ig01
+  #   maxSize: 10
+  #   minSize: 0
+  # - name: ig02
+  #   maxSize: 10
+  #   minSize: 0
 
 # Required if cloudProvider=aws
 awsRegion: us-east-1
 
-# Currently only `aws` & `spotinst` are supported
+# Currently only `gce`, `aws` & `spotinst` are supported
 cloudProvider: aws
 
 sslCertPath: /etc/ssl/certs/ca-certificates.crt
 
+# Configuration file for cloud provider
+cloudConfigPath: /etc/gce.conf
+
 image:
   repository: k8s.gcr.io/cluster-autoscaler
-  tag: v1.1.0
+  tag: v1.2.0
   pullPolicy: IfNotPresent
 
 tolerations: []
 
-extraEnv: {}
-
-extraArgs: {}
+extraArgs:
+  v: 4
+  stderrthreshold: info
+  logtostderr: true
+  # write-status-configmap: true
+  # leader-elect: true
+  # skip-nodes-with-local-storage: false
+  # expander: least-waste
+  # scale-down-enabled: true
+  # balance-similar-node-groups: true
+  # min-replica-count: 2
+  # scale-down-utilization-threshold: 0.5
+  # scale-down-non-empty-candidates-count: 5
+  # max-node-provision-time: 15m0s
+  # scan-interval: 10s
   # scale-down-delay: 10m
   # scale-down-unneeded-time: 10m
   # skip-nodes-with-local-storage: false
@@ -55,7 +79,9 @@ rbac:
   ## If true, create & use RBAC resources
   ##
   create: false
-
+  ## If true, create & use Pod Security Policy resources
+  ## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
+  pspEnabled: false
   ## Ignored if rbac.create is true
   ##
   serviceAccountName: default