|
| 1 | +# This yaml deploys the autoscaler on a workload cluster and configures it to match |
| 2 | +# against the corresponding Cluster API cluster which is defined into the management cluster. |
| 3 | +--- |
| 4 | +apiVersion: v1 |
| 5 | +kind: Namespace |
| 6 | +metadata: |
| 7 | + name: cluster-autoscaler-system |
| 8 | + labels: |
| 9 | + pod-security.kubernetes.io/enforce: privileged |
| 10 | + pod-security.kubernetes.io/warn: privileged |
| 11 | + pod-security.kubernetes.io/audit: privileged |
| 12 | +--- |
| 13 | +# Specify kubeconfig for management cluster |
| 14 | +apiVersion: v1 |
| 15 | +kind: Secret |
| 16 | +metadata: |
| 17 | + name: kubeconfig-management-cluster |
| 18 | + namespace: cluster-autoscaler-system |
| 19 | +stringData: |
| 20 | + kubeconfig: | |
| 21 | + apiVersion: v1 |
| 22 | + kind: Config |
| 23 | + clusters: |
| 24 | + - name: management-cluster |
| 25 | + cluster: |
| 26 | + certificate-authority-data: ${MANAGEMENT_CLUSTER_CA} |
| 27 | + server: ${MANAGEMENT_CLUSTER_ADDRESS} |
| 28 | + contexts: |
| 29 | + - name: management-context |
| 30 | + context: |
| 31 | + cluster: management-cluster |
| 32 | + namespace: ${CLUSTER_NAMESPACE} |
| 33 | + user: cluster-autoscaler-sa |
| 34 | + current-context: management-context |
| 35 | + users: |
| 36 | + - name: cluster-autoscaler-sa |
| 37 | + user: |
| 38 | + token: "${MANAGEMENT_CLUSTER_TOKEN}" |
| 39 | +--- |
| 40 | +# Defines the service used by the cluster autoscaler and gives it |
| 41 | +# RBAC permissions to look at all the workloads running in this cluster. |
| 42 | +apiVersion: v1 |
| 43 | +kind: ServiceAccount |
| 44 | +metadata: |
| 45 | + name: cluster-autoscaler |
| 46 | + namespace: cluster-autoscaler-system |
| 47 | +--- |
| 48 | +kind: ClusterRoleBinding |
| 49 | +apiVersion: rbac.authorization.k8s.io/v1 |
| 50 | +metadata: |
| 51 | + name: cluster-autoscaler-workload |
| 52 | +roleRef: |
| 53 | + apiGroup: rbac.authorization.k8s.io |
| 54 | + kind: ClusterRole |
| 55 | + name: cluster-autoscaler-workload |
| 56 | +subjects: |
| 57 | +- kind: ServiceAccount |
| 58 | + name: cluster-autoscaler |
| 59 | + namespace: cluster-autoscaler-system |
| 60 | +--- |
| 61 | +kind: ClusterRole |
| 62 | +apiVersion: rbac.authorization.k8s.io/v1 |
| 63 | +metadata: |
| 64 | + name: cluster-autoscaler-workload |
| 65 | +rules: |
| 66 | +- apiGroups: |
| 67 | + - "" |
| 68 | + resources: |
| 69 | + - namespaces |
| 70 | + - persistentvolumeclaims |
| 71 | + - persistentvolumes |
| 72 | + - pods |
| 73 | + - replicationcontrollers |
| 74 | + - services |
| 75 | + verbs: |
| 76 | + - get |
| 77 | + - list |
| 78 | + - watch |
| 79 | +- apiGroups: |
| 80 | + - "storage.k8s.io" |
| 81 | + resources: |
| 82 | + - volumeattachments |
| 83 | + verbs: |
| 84 | + - get |
| 85 | + - list |
| 86 | + - watch |
| 87 | +- apiGroups: |
| 88 | + - "" |
| 89 | + resources: |
| 90 | + - nodes |
| 91 | + verbs: |
| 92 | + - get |
| 93 | + - list |
| 94 | + - update |
| 95 | + - watch |
| 96 | +- apiGroups: |
| 97 | + - "" |
| 98 | + resources: |
| 99 | + - pods/eviction |
| 100 | + verbs: |
| 101 | + - create |
| 102 | +- apiGroups: |
| 103 | + - policy |
| 104 | + resources: |
| 105 | + - poddisruptionbudgets |
| 106 | + verbs: |
| 107 | + - list |
| 108 | + - watch |
| 109 | +- apiGroups: |
| 110 | + - storage.k8s.io |
| 111 | + resources: |
| 112 | + - csinodes |
| 113 | + - storageclasses |
| 114 | + - csidrivers |
| 115 | + - csistoragecapacities |
| 116 | + verbs: |
| 117 | + - get |
| 118 | + - list |
| 119 | + - watch |
| 120 | +- apiGroups: |
| 121 | + - batch |
| 122 | + resources: |
| 123 | + - jobs |
| 124 | + verbs: |
| 125 | + - list |
| 126 | + - watch |
| 127 | +- apiGroups: |
| 128 | + - apps |
| 129 | + resources: |
| 130 | + - daemonsets |
| 131 | + - replicasets |
| 132 | + - statefulsets |
| 133 | + verbs: |
| 134 | + - list |
| 135 | + - watch |
| 136 | +- apiGroups: |
| 137 | + - "" |
| 138 | + resources: |
| 139 | + - events |
| 140 | + verbs: |
| 141 | + - create |
| 142 | + - patch |
| 143 | +- apiGroups: |
| 144 | + - "" |
| 145 | + resources: |
| 146 | + - configmaps |
| 147 | + verbs: |
| 148 | + - create |
| 149 | + - delete |
| 150 | + - get |
| 151 | + - update |
| 152 | +- apiGroups: |
| 153 | + - coordination.k8s.io |
| 154 | + resources: |
| 155 | + - leases |
| 156 | + verbs: |
| 157 | + - create |
| 158 | + - get |
| 159 | + - update |
| 160 | +--- |
| 161 | +apiVersion: apps/v1 |
| 162 | +kind: Deployment |
| 163 | +metadata: |
| 164 | + name: cluster-autoscaler |
| 165 | + namespace: cluster-autoscaler-system |
| 166 | + labels: |
| 167 | + app: cluster-autoscaler |
| 168 | +spec: |
| 169 | + selector: |
| 170 | + matchLabels: |
| 171 | + app: cluster-autoscaler |
| 172 | + replicas: 1 |
| 173 | + template: |
| 174 | + metadata: |
| 175 | + labels: |
| 176 | + app: cluster-autoscaler |
| 177 | + spec: |
| 178 | + containers: |
| 179 | + - image: registry.k8s.io/autoscaling/cluster-autoscaler:${AUTOSCALER_VERSION} |
| 180 | + name: cluster-autoscaler |
| 181 | + command: |
| 182 | + - /cluster-autoscaler |
| 183 | + args: |
| 184 | + - --cloud-provider=clusterapi |
| 185 | + # Specify kubeconfig for management cluster |
| 186 | + - --cloud-config=/management-cluster/kubeconfig |
| 187 | + # Limit cluster autoscaler to only match against resources belonging to a single Cluster API cluster |
| 188 | + - --node-group-auto-discovery=clusterapi:namespace=${CLUSTER_NAMESPACE},clusterName=${CLUSTER_NAME} |
| 189 | + # Set a short scale down unneeded time, so we don't have to wait too long during e2e testing |
| 190 | + - --scale-down-unneeded-time=1m |
| 191 | + # Set a short scale down delay after add time, so we don't have to wait too long during e2e testing |
| 192 | + - --scale-down-delay-after-add=1m |
| 193 | + # Set a short scale down delay after delete time, so we don't have to wait too long during e2e testing |
| 194 | + - --scale-down-delay-after-delete=1m |
| 195 | + # Set a short scale down delay after failure time, so we don't have to wait too long during e2e testing |
| 196 | + - --scale-down-delay-after-failure=1m |
| 197 | + # Disable special handling for pods in kube-system to prevent flakes when one of the core-dns pod is scheduled |
| 198 | + # on one of the MachineDeployment machines and the test is trying to scale down to zero. |
| 199 | + - --skip-nodes-with-system-pods=false |
| 200 | + # Set a max nodes limit as safeguard so that the test does not scale up unbounded. |
| 201 | + # Note: The E2E test should only go up to 4 (assuming it starts with a min node group size of 2). |
| 202 | + # Using 6 for additional some buffer and to allow different starting min node group sizes. |
| 203 | + - --max-nodes-total=6 |
| 204 | + # CABPK sets this taint on startup, so we should configure it here accordingly |
| 205 | + - --startup-taint=node.cluster.x-k8s.io/uninitialized |
| 206 | + # Set the log verbosity |
| 207 | + - --v=4 |
| 208 | + volumeMounts: |
| 209 | + - name: kubeconfig-management-cluster |
| 210 | + mountPath: /management-cluster |
| 211 | + readOnly: true |
| 212 | + # Run the autoscaler on control plane Machines to avoid disruptions when scaling to 0. |
| 213 | + nodeSelector: |
| 214 | + node-role.kubernetes.io/control-plane: "" |
| 215 | + tolerations: |
| 216 | + - key: node-role.kubernetes.io/control-plane |
| 217 | + effect: NoSchedule |
| 218 | + operator: Exists |
| 219 | + serviceAccountName: cluster-autoscaler |
| 220 | + terminationGracePeriodSeconds: 10 |
| 221 | + volumes: |
| 222 | + - name: kubeconfig-management-cluster |
| 223 | + secret: |
| 224 | + secretName: kubeconfig-management-cluster |
| 225 | + optional: false |
0 commit comments