diff --git a/stable/cluster-autoscaler/Chart.yaml b/stable/cluster-autoscaler/Chart.yaml index bffc836a9e..3ee0494d27 100644 --- a/stable/cluster-autoscaler/Chart.yaml +++ b/stable/cluster-autoscaler/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v1 description: Scales worker nodes within autoscaling groups. icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png name: cluster-autoscaler -version: 0.6.0 -appVersion: 1.1.0 +version: 0.6.1 +appVersion: 1.2.0 home: https://github.com/kubernetes/autoscaler sources: - https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler diff --git a/stable/cluster-autoscaler/README.md b/stable/cluster-autoscaler/README.md index 3aa6ed07b8..b187256046 100644 --- a/stable/cluster-autoscaler/README.md +++ b/stable/cluster-autoscaler/README.md @@ -31,6 +31,8 @@ To install the chart with the release name `my-release`: ### Using auto-discovery of tagged instance groups +#### AWS + Auto-discovery finds ASGs tags as below and automatically manages them based on the min and max size specified in the ASG. `cloudProvider=aws` only. 1) tag the ASGs with _key_ `k8s.io/cluster-autoscaler/enabled` and _key_ `kubernetes.io/cluster/` @@ -43,7 +45,24 @@ $ helm install stable/cluster-autoscaler --name my-release --set autoDiscovery.c The [auto-discovery](#auto-discovery) section provides more details and examples -### Specifying groups manually +#### GCE +##### Required parameters +- `autoDiscovery.clusterName=any-name` +- `--cloud-provider=gce` +- `autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefix[0].minSize=1` + +1) Either provide a yaml file setting `autoscalingGroupsnamePrefix` (see values.yaml) or use `--set` e.g.: + +```console +$ helm install stable/cluster-autoscaler \ +--name my-release \ +--set autoDiscovery.clusterName= \ +--set cloudProvider=gce \ +--set autoDiscovery.clusterName=mycluster \ +--set "autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefix[0].minSize=1" +``` + +### Specifying groups manually (only aws) Without autodiscovery, specify an array of elements each containing ASG name, min size, max size. The sizes specified here will be applied to the ASG, assuming IAM permissions are correctly configured. @@ -73,16 +92,19 @@ The following table lists the configurable parameters of the cluster-autoscaler Parameter | Description | Default --- | --- | --- `affinity` | node/pod affinities | None -`autoDiscovery.clusterName` | enable autodiscovery for name in ASG tag (only `cloudProvider=aws`)| `""` **required unless autoscalingGroups[] provided** +`autoDiscovery.clusterName` | enable autodiscovery for name in ASG tag (only `cloudProvider=aws`). Must be set for `cloudProvider=gce`, but no MIG tagging required.| `""` **required unless autoscalingGroups[] provided** `autoscalingGroups[].name` | autoscaling group name | None. Required unless `autoDiscovery.enabled=true` `autoscalingGroups[].maxSize` | maximum autoscaling group size | None. Required unless `autoDiscovery.enabled=true` `autoscalingGroups[].minSize` | minimum autoscaling group size | None. Required unless `autoDiscovery.enabled=true` `awsRegion` | AWS region (required if `cloudProvider=aws`) | `us-east-1` +`autoscalingGroupsnamePrefix[].name` | GCE MIG name | None. Required for `cloudProvider=gce` +`autoscalingGroupsnamePrefix[].maxSize` | maximum MIG size | None. Required for `cloudProvider=gce` +`autoscalingGroupsnamePrefix[].minSize` | minimum MIG size | None. Required for `cloudProvider=gce` `sslCertPath` | Path on the host where ssl ca cert exists | `/etc/ssl/certs/ca-certificates.crt` -`cloudProvider` | `aws` or `spotinst` are currently supported | `aws` -`image.repository` | Image (used if `cloudProvider=aws`) | `k8s.gcr.io/cluster-autoscaler` -`image.tag` | Image tag (used if `cloudProvider=aws`) | `v1.1.0` -`image.pullPolicy` | Image pull policy (used if `cloudProvider=aws`) | `IfNotPresent` +`cloudProvider` | `aws` or `spotinst` are currently supported for AWS. `gce` for GCE| `aws` +`image.repository` | Image | `k8s.gcr.io/cluster-autoscaler` +`image.tag` | Image tag | `v1.2.0` +`image.pullPolicy` | Image pull policy | `IfNotPresent` `extraArgs` | additional container arguments | `{}` `podDisruptionBudget` | Pod disruption budget | `maxUnavailable: 1` `extraEnv` | additional container environment variables | `{}` @@ -90,6 +112,7 @@ Parameter | Description | Default `podAnnotations` | annotations to add to each pod | `{}` `rbac.create` | If true, create & use RBAC resources | `false` `rbac.serviceAccountName` | existing ServiceAccount to use (ignored if rbac.create=true) | `default` +`rbac.pspEnabled` | Must be used with `rbac.create` true. If true, creates & uses RBAC resources required in the cluster with [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) enabled. | `false` `replicaCount` | desired number of pods | `1` `resources` | pod resource requests & limits | `{}` `service.annotations` | annotations to add to service | none diff --git a/stable/cluster-autoscaler/templates/clusterrole.yaml b/stable/cluster-autoscaler/templates/clusterrole.yaml index 07397f7c6a..8ea860e950 100644 --- a/stable/cluster-autoscaler/templates/clusterrole.yaml +++ b/stable/cluster-autoscaler/templates/clusterrole.yaml @@ -91,4 +91,15 @@ rules: - watch - list - get +{{- if .Values.rbac.pspEnabled }} + - apiGroups: + - extensions + resources: + - podsecuritypolicies + resourceNames: + - privileged-{{ template "cluster-autoscaler.fullname" . }} + verbs: + - use +{{- end -}} + {{- end -}} diff --git a/stable/cluster-autoscaler/templates/deployment.yaml b/stable/cluster-autoscaler/templates/deployment.yaml index 8948d0c49c..be00135fd3 100644 --- a/stable/cluster-autoscaler/templates/deployment.yaml +++ b/stable/cluster-autoscaler/templates/deployment.yaml @@ -47,10 +47,20 @@ spec: - --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,kubernetes.io/cluster/ {{- .Values.autoDiscovery.clusterName }} {{- end }} + {{- else if eq .Values.cloudProvider "gce" }} + {{- if .Values.autoscalingGroupsnamePrefix }} + {{- range .Values.autoscalingGroupsnamePrefix }} + - --node-group-auto-discovery=mig:namePrefix={{ .name }},min={{ .minSize }},max={{ .maxSize }} + {{- end }} {{- end }} + {{- end }} + {{- if eq .Values.cloudProvider "gce" }} + - --cloud-config={{ .Values.cloudConfigPath }} + {{- end }} {{- range $key, $value := .Values.extraArgs }} - --{{ $key }}{{ if $value }}={{ $value }}{{ end }} {{- end }} + env: {{- if eq .Values.cloudProvider "aws" }} - name: AWS_REGION @@ -64,7 +74,7 @@ spec: {{- range $key, $value := .Values.extraEnv }} - name: {{ $key }} value: {{ $value }} - {{- end }} + {{- end }} livenessProbe: httpGet: path: /health-check @@ -77,6 +87,11 @@ spec: - name: ssl-certs mountPath: {{ .Values.sslCertPath }} readOnly: true + {{- if eq .Values.cloudProvider "gce" }} + - name: cloudconfig + mountPath: {{ .Values.cloudConfigPath }} + readOnly: true + {{- end }} {{- if .Values.affinity }} affinity: {{ toYaml .Values.affinity | indent 8 }} @@ -92,4 +107,9 @@ spec: - name: ssl-certs hostPath: path: {{ .Values.sslCertPath }} + {{- if eq .Values.cloudProvider "gce" }} + - name: cloudconfig + hostPath: + path: {{ .Values.cloudConfigPath }} + {{- end }} {{- end}} diff --git a/stable/cluster-autoscaler/templates/podsecuritypolicy.yaml b/stable/cluster-autoscaler/templates/podsecuritypolicy.yaml new file mode 100644 index 0000000000..43d60570dd --- /dev/null +++ b/stable/cluster-autoscaler/templates/podsecuritypolicy.yaml @@ -0,0 +1,26 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: privileged-{{ template "cluster-autoscaler.fullname" . }} +spec: + allowedCapabilities: + - '*' + fsGroup: + rule: RunAsAny + privileged: true + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - '*' + hostPID: true + hostIPC: true + hostNetwork: true + hostPorts: + - min: 1 + max: 65536 +{{- end }} diff --git a/stable/cluster-autoscaler/values.yaml b/stable/cluster-autoscaler/values.yaml index 450076310d..f268169997 100644 --- a/stable/cluster-autoscaler/values.yaml +++ b/stable/cluster-autoscaler/values.yaml @@ -1,35 +1,59 @@ autoDiscovery: -# Only cloudProvider `aws` is supported by auto-discovery at this time -# Set tags as described in https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup +# Only cloudProvider `aws` and `gce` are supported by auto-discovery at this time +# AWS: Set tags as described in https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup clusterName: # cluster.local autoscalingGroups: [] # At least one element is required if not using autoDiscovery # - name: asg1 - # maxSize: 1 - # minSize: 2 + # maxSize: 2 + # minSize: 1 # - name: asg2 - # maxSize: 1 - # minSize: 2 + # maxSize: 2 + # minSize: 1 + +autoscalingGroupsnamePrefix: [] +# At least one element is required if not using autoDiscovery + # - name: ig01 + # maxSize: 10 + # minSize: 0 + # - name: ig02 + # maxSize: 10 + # minSize: 0 # Required if cloudProvider=aws awsRegion: us-east-1 -# Currently only `aws` & `spotinst` are supported +# Currently only `gce`, `aws` & `spotinst` are supported cloudProvider: aws sslCertPath: /etc/ssl/certs/ca-certificates.crt +# Configuration file for cloud provider +cloudConfigPath: /etc/gce.conf + image: repository: k8s.gcr.io/cluster-autoscaler - tag: v1.1.0 + tag: v1.2.0 pullPolicy: IfNotPresent tolerations: [] -extraEnv: {} - -extraArgs: {} +extraArgs: + v: 4 + stderrthreshold: info + logtostderr: true + # write-status-configmap: true + # leader-elect: true + # skip-nodes-with-local-storage: false + # expander: least-waste + # scale-down-enabled: true + # balance-similar-node-groups: true + # min-replica-count: 2 + # scale-down-utilization-threshold: 0.5 + # scale-down-non-empty-candidates-count: 5 + # max-node-provision-time: 15m0s + # scan-interval: 10s # scale-down-delay: 10m # scale-down-unneeded-time: 10m # skip-nodes-with-local-storage: false @@ -55,7 +79,9 @@ rbac: ## If true, create & use RBAC resources ## create: false - + ## If true, create & use Pod Security Policy resources + ## https://kubernetes.io/docs/concepts/policy/pod-security-policy/ + pspEnabled: false ## Ignored if rbac.create is true ## serviceAccountName: default