The descheduler ClusterRole granted both pods:delete and
pods/eviction:create. Eviction goes through the eviction subresource
(PolicyV1().Evictions().Evict, requiring pods/eviction:create), and there
are no direct pod Delete calls anywhere in the codebase, so the
pods:delete verb is unused. Drop it to follow least privilege.
Signed-off-by: Aman Raj <aman.yug@gmail.com>
this commit introduces a new customization on the existing PodsWithPVC
protection. this new customization allow users to make pods that refer
to a given storage class unevictable.
for example, to protect pods referring to `storage-class-0` and
`storage-class-1` this configuration can be used:
```yaml
apiVersion: "descheduler/v1alpha2"
kind: "DeschedulerPolicy"
profiles:
- name: ProfileName
pluginConfig:
- name: "DefaultEvictor"
args:
podProtections:
extraEnabled:
- PodsWithPVC
config:
PodsWithPVC:
protectedStorageClasses:
- name: storage-class-0
- name: storage-class-1
```
changes introduced by this pr:
1. the descheduler starts to observe persistent volume claims.
1. a new api field was introduced to allow per pod protection config.
1. rbac had to be adjusted (+persistentvolumeclaims).
* add ignoreNonPDBPods option
* take2
* add test
* poddisruptionbudgets are now used by defaultevictor plugin
* add poddisruptionbudgets to rbac
* review comments
* don't use GetPodPodDisruptionBudgets
* review comment, don't hide error
This adds a strategy to balance pod topology domains based on the scheduler's
PodTopologySpread constraints. It attempts to find the minimum number of pods
that should be sent for eviction by comparing the largest domains in a topology
with the smallest domains in that topology.
Aman Raj
Ricardo Maraschini
Jan Chaloupka
Simon ScharfandGitHub
Hao Fan
Amir Alavi
czm
Mike Dame
Lucas Severo AlvesandLucas Severo Alves
Jane Liu L
James RavnandGitHub
Mayank KumarandMike Dame
m3yandm3y