From e7a122f93238b0b8a1d3e8acc082653ca41a42e2 Mon Sep 17 00:00:00 2001 From: Casey Lee Date: Fri, 1 Nov 2019 19:47:40 -0700 Subject: [PATCH] [stable/cluster-autoscaler] update to latest cluster-autoscaler (#18522) * [stable/cluster-autoscaler] update to latest cluster-autoscaler 1.14.6 to add support for serviceaccount annotations Signed-off-by: Casey Lee * [stable/cluster-autoscaler] Update README for serviceAccount annotations Signed-off-by: Casey Lee --- stable/cluster-autoscaler/Chart.yaml | 4 ++-- stable/cluster-autoscaler/README.md | 9 +++++++++ stable/cluster-autoscaler/values.yaml | 2 +- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/stable/cluster-autoscaler/Chart.yaml b/stable/cluster-autoscaler/Chart.yaml index 7e95b935a1..9f0e110d28 100644 --- a/stable/cluster-autoscaler/Chart.yaml +++ b/stable/cluster-autoscaler/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v1 description: Scales worker nodes within autoscaling groups. icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png name: cluster-autoscaler -version: 6.0.0 -appVersion: 1.14.5 +version: 6.0.1 +appVersion: 1.14.6 home: https://github.com/kubernetes/autoscaler sources: - https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler diff --git a/stable/cluster-autoscaler/README.md b/stable/cluster-autoscaler/README.md index 6eb336f5a3..8951e2589f 100644 --- a/stable/cluster-autoscaler/README.md +++ b/stable/cluster-autoscaler/README.md @@ -236,6 +236,15 @@ The worker running the cluster autoscaler will need access to certain resources Unfortunately AWS does not support ARNs for autoscaling groups yet so you must use "*" as the resource. More information [here](http://docs.aws.amazon.com/autoscaling/latest/userguide/IAM.html#UsingWithAutoScaling_Actions). +# IAM Roles for Service Accounts (IRSA) + +For Kubernetes clusters that use Amazon EKS, the service account can be configured with an IAM role using [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) to avoid needing to grant access to the worker nodes for AWS resources. + +In order to accomplish this, you will first need to create a new IAM role with the above mentions policies. Take care in [configuring the trust relationship](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html#iam-role-configuration) to restrict access just to the service account used by cluster autoscaler. + +Once you have the IAM role configured, you would then need to `--set rbac.serviceAccountAnnotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::123456789012:role/MyRoleName` when installing. + + ## Auto-discovery For auto-discovery of instances to work, they must be tagged with the keys in `.Values.autoDiscovery.tags`, which by default are diff --git a/stable/cluster-autoscaler/values.yaml b/stable/cluster-autoscaler/values.yaml index 0e4d62f1c5..7023f5a260 100644 --- a/stable/cluster-autoscaler/values.yaml +++ b/stable/cluster-autoscaler/values.yaml @@ -53,7 +53,7 @@ cloudConfigPath: /etc/gce.conf image: repository: k8s.gcr.io/cluster-autoscaler - tag: v1.14.5 + tag: v1.14.6 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets.