Skip to content

Commit 1b3dabe

Browse files
yaroslavborbatyaroslavborbat
committed
add
Signed-off-by: Yaroslav Borbat <yaroslav.borbat@flant.com>
1 parent daf475f commit 1b3dabe

File tree

8 files changed

+321
-0
lines changed

8 files changed

+321
-0
lines changed

‎images/descheduler/werf.inc.yaml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{{- $version := "1.31" }}
2+
---
3+
image: {{ $.ImageName }}-builder
4+
final: false
5+
fromImage: BASE_GOLANG_23_BOOKWORM
6+
mount:
7+
- fromPath: ~/go-pkg-cache
8+
to: /go/pkg
9+
shell:
10+
install:
11+
- apt-get -qq update
12+
- apt-get -qq install -y --no-install-recommends git
13+
- apt-get clean
14+
- rm --recursive --force /var/lib/apt/lists/* /var/cache/apt/*
15+
- git clone --depth 1 --branch release-{{ $version }} https://github.com/kubernetes-sigs/descheduler.git /src
16+
- cd /src
17+
- git checkout release-{{ $version }}
18+
- rm -rf .git
19+
setup:
20+
- cd /src
21+
- |
22+
export GO111MODULE=on
23+
export GOOS=linux
24+
export CGO_ENABLED=0
25+
export GOARCH=amd64
26+
- go mod download -x
27+
- go mod vendor
28+
- go build -ldflags "-s -w -X sigs.k8s.io/descheduler/pkg/version.version={{ $version }}" -o /descheduler sigs.k8s.io/descheduler/cmd/descheduler
29+
- chown 64535:64535 /descheduler
30+
- chmod 0700 /descheduler
31+
---
32+
image: {{ $.ImageName }}
33+
fromImage: distroless
34+
import:
35+
- image: {{ $.ImageName }}-builder
36+
add: /descheduler
37+
to: /descheduler
38+
before: setup
39+
imageSpec:
40+
config:
41+
user: 64535
42+
entrypoint: ["/descheduler"]
43+
---

‎openapi/config-values.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -248,3 +248,13 @@ properties:
248248
enum:
249249
- "text"
250250
- "json"
251+
descheduler:
252+
type: object
253+
description: |
254+
Configuration for the descheduler. Enables eviction of virtual machines.
255+
properties:
256+
enabled:
257+
type: boolean
258+
description: |
259+
Enable or disable the descheduler. Set to true to activate VM eviction.
260+
x-examples: [true, false]

‎openapi/doc-ru-config-values.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -149,3 +149,12 @@ properties:
149149
150150
Работает для следующих компонентов:
151151
- `virtualization-controller`
152+
descheduler:
153+
type: object
154+
description: |
155+
Конфигурация для descheduler. Включает выселение виртуальных машин.
156+
properties:
157+
enabled:
158+
type: boolean
159+
description: |
160+
Включение или отключение descheduler. Установите значение true для активации выселения виртуальных машин.

‎templates/descheduler/configmap.yaml

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{{- if .Values.virtualization.descheduler.enabled }}
2+
---
3+
apiVersion: v1
4+
kind: ConfigMap
5+
metadata:
6+
name: descheduler-policy
7+
namespace: d8-{{ .Chart.Name }}
8+
{{- include "helm_lib_module_labels" (list $) | nindent 2 }}
9+
data:
10+
policy.yaml: |
11+
apiVersion: "descheduler/v1alpha2"
12+
kind: "DeschedulerPolicy"
13+
profiles:
14+
- name: virtualization
15+
pluginConfig:
16+
- name: "DefaultEvictor"
17+
args:
18+
evictLocalStoragePods: true
19+
evictSystemCriticalPods: false
20+
ignorePvcPods: false
21+
evictFailedBarePods: true
22+
nodeFit: true
23+
labelSelector:
24+
matchExpressions:
25+
- key: "vm.kubevirt.internal.virtualization.deckhouse.io/name"
26+
operator: Exists
27+
- name: "RemovePodsViolatingNodeAffinity"
28+
args:
29+
nodeAffinityType:
30+
- requiredDuringSchedulingIgnoredDuringExecution
31+
- name: "RemovePodsViolatingInterPodAntiAffinity"
32+
plugins:
33+
filter:
34+
enabled:
35+
- "DefaultEvictor"
36+
preEvictionFilter:
37+
enabled:
38+
- "DefaultEvictor"
39+
deschedule:
40+
enabled:
41+
- "RemovePodsViolatingNodeAffinity"
42+
- "RemovePodsViolatingInterPodAntiAffinity"
43+
44+
{{- end }}

‎templates/descheduler/deployment.yaml

+106
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{{- define "descheduler_resources" }}
2+
cpu: 25m
3+
memory: 50Mi
4+
{{- end }}
5+
6+
{{- if .Values.virtualization.descheduler.enabled }}
7+
---
8+
apiVersion: apps/v1
9+
kind: Deployment
10+
metadata:
11+
name: descheduler
12+
namespace: d8-{{ .Chart.Name }}
13+
{{- include "helm_lib_module_labels" (list $ (dict "app" "descheduler")) | nindent 2 }}
14+
spec:
15+
replicas: 1
16+
revisionHistoryLimit: 2
17+
selector:
18+
matchLabels:
19+
app: descheduler
20+
template:
21+
metadata:
22+
labels:
23+
app: descheduler
24+
spec:
25+
serviceAccountName: descheduler
26+
imagePullSecrets:
27+
- name: deckhouse-registry
28+
{{- include "helm_lib_node_selector" (tuple $ "system") | nindent 6 }}
29+
{{- include "helm_lib_tolerations" (tuple $ "system") | nindent 6 }}
30+
{{- include "helm_lib_priority_class" (tuple $ "cluster-low") | nindent 6 }}
31+
{{ include "helm_lib_module_pod_security_context_run_as_user_deckhouse" . | nindent 6 }}
32+
containers:
33+
- name: descheduler
34+
{{- include "helm_lib_module_container_security_context_read_only_root_filesystem" $ | nindent 8 }}
35+
image: {{ include "helm_lib_module_image" (list $ "descheduler") }}
36+
livenessProbe:
37+
failureThreshold: 3
38+
httpGet:
39+
path: /healthz
40+
port: 10258
41+
scheme: HTTPS
42+
initialDelaySeconds: 3
43+
periodSeconds: 10
44+
volumeMounts:
45+
- mountPath: /policy
46+
name: policy-volume
47+
args:
48+
- "--bind-address"
49+
- "127.0.0.1"
50+
- "--policy-config-file"
51+
- "/policy/policy.yaml"
52+
- "--logging-format"
53+
- "json"
54+
- "--v"
55+
- "6"
56+
- "--descheduling-interval"
57+
- "15m"
58+
resources:
59+
requests:
60+
{{- include "helm_lib_module_ephemeral_storage_only_logs" $ | nindent 12 }}
61+
{{- if not ($.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }}
62+
{{- include "descheduler_resources" $ | nindent 12 }}
63+
{{- end }}
64+
- name: kube-rbac-proxy
65+
{{- include "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all" . | nindent 8 }}
66+
image: {{ include "helm_lib_module_common_image" (list . "kubeRbacProxy") }}
67+
args:
68+
- "--secure-listen-address=$(KUBE_RBAC_PROXY_LISTEN_ADDRESS):10258"
69+
- "--v=2"
70+
- "--logtostderr=true"
71+
- "--stale-cache-interval=1h30m"
72+
env:
73+
- name: KUBE_RBAC_PROXY_LISTEN_ADDRESS
74+
valueFrom:
75+
fieldRef:
76+
fieldPath: status.podIP
77+
- name: KUBE_RBAC_PROXY_CONFIG
78+
value: |
79+
excludePaths:
80+
- /healthz
81+
upstreams:
82+
- upstream: https://127.0.0.1:10258/
83+
upstreamInsecureSkipVerify: true
84+
path: /
85+
authorization:
86+
resourceAttributes:
87+
namespace: d8-{{ .Chart.Name }}
88+
apiGroup: apps
89+
apiVersion: v1
90+
resource: deployments
91+
subresource: prometheus-metrics
92+
name: descheduler
93+
ports:
94+
- containerPort: 10258
95+
name: https-metrics
96+
resources:
97+
requests:
98+
{{- include "helm_lib_module_ephemeral_storage_only_logs" . | nindent 12 }}
99+
{{- if not ( .Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }}
100+
{{- include "helm_lib_container_kube_rbac_proxy_resources" . | nindent 12 }}
101+
{{- end }}
102+
volumes:
103+
- name: policy-volume
104+
configMap:
105+
name: descheduler-policy
106+
{{- end }}

‎templates/descheduler/rbac-for-us.yaml

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{{- if .Values.virtualization.descheduler.enabled }}
2+
---
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
name: descheduler
7+
namespace: d8-{{ .Chart.Name }}
8+
{{- include "helm_lib_module_labels" (list . (dict "app" "descheduler")) | nindent 2 }}
9+
---
10+
kind: ClusterRole
11+
apiVersion: rbac.authorization.k8s.io/v1
12+
metadata:
13+
name: d8:virtualization:descheduler:descheduler
14+
{{- include "helm_lib_module_labels" (list . (dict "app" "descheduler")) | nindent 2 }}
15+
rules:
16+
- apiGroups: ["events.k8s.io"]
17+
resources: ["events"]
18+
verbs: ["create", "update"]
19+
- apiGroups: [""]
20+
resources: ["nodes"]
21+
verbs: ["get", "watch", "list"]
22+
- apiGroups: [""]
23+
resources: ["namespaces"]
24+
verbs: ["get", "watch", "list"]
25+
- apiGroups: [""]
26+
resources: ["pods"]
27+
verbs: ["get", "watch", "list", "delete"]
28+
- apiGroups: [""]
29+
resources: ["pods/eviction"]
30+
verbs: ["create"]
31+
- apiGroups: ["scheduling.k8s.io"]
32+
resources: ["priorityclasses"]
33+
verbs: ["get", "watch", "list"]
34+
- apiGroups: ["policy"]
35+
resources: ["poddisruptionbudgets"]
36+
verbs: ["get", "watch", "list"]
37+
- apiGroups: ["coordination.k8s.io"]
38+
resources: ["leases"]
39+
verbs: ["create", "update"]
40+
- apiGroups: ["coordination.k8s.io"]
41+
resources: ["leases"]
42+
resourceNames: ["descheduler"]
43+
verbs: ["get", "patch", "delete"]
44+
---
45+
apiVersion: rbac.authorization.k8s.io/v1
46+
kind: ClusterRoleBinding
47+
metadata:
48+
name: d8:virtualization:descheduler:descheduler
49+
{{- include "helm_lib_module_labels" (list . (dict "app" "descheduler")) | nindent 2 }}
50+
roleRef:
51+
apiGroup: rbac.authorization.k8s.io
52+
kind: ClusterRole
53+
name: d8:virtualization:descheduler:descheduler
54+
subjects:
55+
- name: descheduler
56+
kind: ServiceAccount
57+
namespace: d8-{{ .Chart.Name }}
58+
---
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: ClusterRoleBinding
61+
metadata:
62+
name: d8:virtualization:descheduler:descheduler:rbac-proxy
63+
{{- include "helm_lib_module_labels" (list . (dict "app" "descheduler")) | nindent 2 }}
64+
roleRef:
65+
apiGroup: rbac.authorization.k8s.io
66+
kind: ClusterRole
67+
name: d8:rbac-proxy
68+
subjects:
69+
- kind: ServiceAccount
70+
name: descheduler
71+
namespace: d8-{{ .Chart.Name }}
72+
{{- end }}

‎templates/descheduler/rbac-to-us.yaml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{{- if .Values.virtualization.descheduler.enabled }}
2+
---
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: Role
5+
metadata:
6+
name: access-to-descheduler
7+
namespace: d8-{{ $.Chart.Name }}
8+
{{- include "helm_lib_module_labels" (list . (dict "app" "descheduler")) | nindent 2 }}
9+
rules:
10+
- apiGroups: ["apps"]
11+
resources: ["deployments/prometheus-metrics"]
12+
resourceNames: ["descheduler"]
13+
verbs: ["get"]
14+
{{- if (.Values.global.enabledModules | has "prometheus") }}
15+
---
16+
apiVersion: rbac.authorization.k8s.io/v1
17+
kind: RoleBinding
18+
metadata:
19+
name: access-to-descheduler
20+
namespace: d8-{{ $.Chart.Name }}
21+
{{- include "helm_lib_module_labels" (list . (dict "app" "descheduler")) | nindent 2 }}
22+
roleRef:
23+
apiGroup: rbac.authorization.k8s.io
24+
kind: Role
25+
name: access-to-descheduler
26+
subjects:
27+
- kind: User
28+
name: d8-monitoring:scraper
29+
- kind: ServiceAccount
30+
name: prometheus
31+
namespace: d8-monitoring
32+
{{- end }}
33+
34+
{{- end }}

‎tools/kubeconform/fixtures/module-values.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,7 @@ global:
326326
virtualizationApi: sha256:0000000000000000000000000000000000000000000000000000000000000000
327327
virtualizationController: sha256:0000000000000000000000000000000000000000000000000000000000000000
328328
vmRouteForge: sha256:0000000000000000000000000000000000000000000000000000000000000000
329+
descheduler: sha256:0000000000000000000000000000000000000000000000000000000000000000
329330
registry:
330331
CA: ""
331332
address: some-registry.io
@@ -335,6 +336,8 @@ global:
335336
scheme: https
336337
tags: {}
337338
virtualization:
339+
descheduler:
340+
enabled: true
338341
dvcr:
339342
storage:
340343
persistentVolumeClaim:

0 commit comments

Comments
 (0)