From d02bc8b7fde022f5a5a2ef91e99014b8c39663e7 Mon Sep 17 00:00:00 2001 From: Dmytro Kozlovskyi Date: Thu, 9 May 2019 04:20:48 +0300 Subject: [PATCH] [stable/cluster-autoscaler] Add possibility to use iam user keys instead instance role for AWS (#11978) * [stable/cluster-autoscaler] Add possibility to use iam user keys instead instance role for AWS Signed-off-by: Dmytro Kozlovskyi * [stable/cluster-autoscaler] Add possibility to use iam user keys instead instance role for AWS (improve README) Signed-off-by: Dmytro Kozlovskyi --- stable/cluster-autoscaler/Chart.yaml | 2 +- stable/cluster-autoscaler/README.md | 5 ++++- .../cluster-autoscaler/templates/deployment.yaml | 14 ++++++++++++++ stable/cluster-autoscaler/templates/secret.yaml | 9 +++++++-- stable/cluster-autoscaler/values.yaml | 2 ++ 5 files changed, 28 insertions(+), 4 deletions(-) diff --git a/stable/cluster-autoscaler/Chart.yaml b/stable/cluster-autoscaler/Chart.yaml index 217c5353fc..21e70a32bd 100644 --- a/stable/cluster-autoscaler/Chart.yaml +++ b/stable/cluster-autoscaler/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v1 description: Scales worker nodes within autoscaling groups. icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png name: cluster-autoscaler -version: 0.12.4 +version: 0.13.0 appVersion: 1.13.1 home: https://github.com/kubernetes/autoscaler sources: diff --git a/stable/cluster-autoscaler/README.md b/stable/cluster-autoscaler/README.md index b637ee0a71..f30bd9238a 100644 --- a/stable/cluster-autoscaler/README.md +++ b/stable/cluster-autoscaler/README.md @@ -41,6 +41,7 @@ Auto-discovery finds ASGs tags as below and automatically manages them based on 2) verify the [IAM Permissions](#iam) 3) set `autoDiscovery.clusterName=` 4) set `awsRegion=` +5) set `awsAccessKeyID=` and `awsSecretAccessKey=` if you want to [use AWS credentials directly instead of an instance role](https://github.com/kubernetes/autoscaler/blob/5ac706fdfa5601348f33d5b634e62de6655bb9bf/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) ```console $ helm install stable/cluster-autoscaler --name my-release --set autoDiscovery.clusterName= @@ -77,7 +78,7 @@ In the event you want to explicitly specify MIGs instead of using auto-discovery ##### Required Parameters - `cloudProvider=azure` - `autoscalingGroups[0].name=your-agent-pool,autoscalingGroups[0].maxSize=10,autoscalingGroups[0].minSize=1` -- `azureClientID: "your-service-principal-app-id"` +- `azureClientID: "your-service-principal-app-id"` - `azureClientSecret: "your-service-principal-client-secret"` - `azureSubscriptionID: "your-azure-subscription-id"` - `azureTenantID: "your-azure-tenant-id"` @@ -122,6 +123,8 @@ Parameter | Description | Default `autoscalingGroups[].maxSize` | maximum autoscaling group size | None. Required unless `autoDiscovery.enabled=true` `autoscalingGroups[].minSize` | minimum autoscaling group size | None. Required unless `autoDiscovery.enabled=true` `awsRegion` | AWS region (required if `cloudProvider=aws`) | `us-east-1` +`awsAccessKeyID` | AWS access key ID ([if AWS user keys used](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)) | `""` +`awsSecretAccessKey` | AWS access secret key ([if AWS user keys used](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)) | `""` `autoscalingGroupsnamePrefix[].name` | GCE MIG name prefix (the full name is invalid) | None. Required for `cloudProvider=gce` `autoscalingGroupsnamePrefix[].maxSize` | maximum MIG size | None. Required for `cloudProvider=gce` `autoscalingGroupsnamePrefix[].minSize` | minimum MIG size | None. Required for `cloudProvider=gce` diff --git a/stable/cluster-autoscaler/templates/deployment.yaml b/stable/cluster-autoscaler/templates/deployment.yaml index 635f0bc037..f51f3aa767 100644 --- a/stable/cluster-autoscaler/templates/deployment.yaml +++ b/stable/cluster-autoscaler/templates/deployment.yaml @@ -68,6 +68,20 @@ spec: {{- if and (eq .Values.cloudProvider "aws") (ne .Values.awsRegion "") }} - name: AWS_REGION value: "{{ .Values.awsRegion }}" + {{- if .Values.awsAccessKeyID }} + - name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + key: AwsAccessKeyId + name: {{ template "cluster-autoscaler.fullname" . }} + {{- end }} + {{- if .Values.awsSecretAccessKey }} + - name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + key: AwsSecretAccessKey + name: {{ template "cluster-autoscaler.fullname" . }} + {{- end }} {{- else if eq .Values.cloudProvider "spotinst" }} - name: SPOTINST_TOKEN value: "{{ .Values.spotinst.token }}" diff --git a/stable/cluster-autoscaler/templates/secret.yaml b/stable/cluster-autoscaler/templates/secret.yaml index 6f32c9fc3b..fd8343dd61 100644 --- a/stable/cluster-autoscaler/templates/secret.yaml +++ b/stable/cluster-autoscaler/templates/secret.yaml @@ -1,9 +1,10 @@ -{{- if eq .Values.cloudProvider "azure" }} +{{- if or (eq .Values.cloudProvider "azure") (eq .Values.cloudProvider "aws") }} apiVersion: v1 kind: Secret metadata: name: {{ template "cluster-autoscaler.fullname" . }} data: +{{- if eq .Values.cloudProvider "azure" }} ClientID: "{{ .Values.azureClientID | b64enc }}" ClientSecret: "{{ .Values.azureClientSecret | b64enc }}" ResourceGroup: "{{ .Values.azureResourceGroup | b64enc }}" @@ -12,4 +13,8 @@ data: VMType: "{{ .Values.azureVMType | b64enc }}" ClusterName: "{{ .Values.azureClusterName | b64enc }}" NodeResourceGroup: "{{ .Values.azureNodeResourceGroup | b64enc }}" -{{- end }} \ No newline at end of file +{{- else if eq .Values.cloudProvider "aws" }} + AwsAccessKeyId: "{{ .Values.awsAccessKeyID | b64enc }}" + AwsSecretAccessKey: "{{ .Values.awsSecretAccessKey | b64enc }}" +{{- end }} +{{- end }} diff --git a/stable/cluster-autoscaler/values.yaml b/stable/cluster-autoscaler/values.yaml index 484f87d427..2e7675b1d7 100644 --- a/stable/cluster-autoscaler/values.yaml +++ b/stable/cluster-autoscaler/values.yaml @@ -23,6 +23,8 @@ autoscalingGroupsnamePrefix: [] # Required if cloudProvider=aws awsRegion: us-east-1 +awsAccessKeyID: "" +awsSecretAccessKey: "" # Required if cloudProvider=azure # clientID/ClientSecret with contributor permission to Cluster and Node ResourceGroup