Skip to content

Commit d5d6bf3

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #8699 from kincoy/vpa-chart-updater-rbac
feat(vpa-chart): support updater rbac
2 parents 3b0c3bf + ba36cab commit d5d6bf3

File tree

8 files changed

+288
-1
lines changed

8 files changed

+288
-1
lines changed

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,3 +100,6 @@ The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory resou
100100
| updater.podAnnotations | object | `{}` | |
101101
| updater.podLabels | object | `{}` | |
102102
| updater.replicas | int | `1` | |
103+
| updater.serviceAccount.annotations | object | `{}` | |
104+
| updater.serviceAccount.create | bool | `true` | |
105+
| updater.serviceAccount.labels | object | `{}` | |

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/updater-clusterrole.yaml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
{{- if and (.Values.updater.enabled) .Values.rbac.create -}}
2+
---
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: ClusterRole
5+
metadata:
6+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-in-place
7+
labels:
8+
{{- include "vertical-pod-autoscaler.updater.labels" . | nindent 4 }}
9+
rules:
10+
- apiGroups:
11+
- ""
12+
resources:
13+
- pods/resize
14+
- pods
15+
verbs:
16+
- patch
17+
---
18+
apiVersion: rbac.authorization.k8s.io/v1
19+
kind: ClusterRole
20+
metadata:
21+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-actor
22+
rules:
23+
- apiGroups:
24+
- ""
25+
resources:
26+
- pods
27+
- nodes
28+
- limitranges
29+
verbs:
30+
- get
31+
- list
32+
- watch
33+
- apiGroups:
34+
- ""
35+
- events.k8s.io
36+
resources:
37+
- events
38+
verbs:
39+
- create
40+
- get
41+
- list
42+
- watch
43+
- patch
44+
- update
45+
- apiGroups:
46+
- "poc.autoscaling.k8s.io"
47+
resources:
48+
- verticalpodautoscalers
49+
verbs:
50+
- get
51+
- list
52+
- watch
53+
- apiGroups:
54+
- "autoscaling.k8s.io"
55+
resources:
56+
- verticalpodautoscalers
57+
verbs:
58+
- get
59+
- list
60+
- watch
61+
---
62+
apiVersion: rbac.authorization.k8s.io/v1
63+
kind: ClusterRole
64+
metadata:
65+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-evictioner
66+
rules:
67+
- apiGroups:
68+
- "apps"
69+
- "extensions"
70+
resources:
71+
- replicasets
72+
verbs:
73+
- get
74+
- apiGroups:
75+
- ""
76+
resources:
77+
- pods/eviction
78+
verbs:
79+
- create
80+
---
81+
apiVersion: rbac.authorization.k8s.io/v1
82+
kind: ClusterRole
83+
metadata:
84+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-target-reader
85+
rules:
86+
- apiGroups:
87+
- '*'
88+
resources:
89+
- '*/scale'
90+
verbs:
91+
- get
92+
- watch
93+
- apiGroups:
94+
- ""
95+
resources:
96+
- replicationcontrollers
97+
verbs:
98+
- get
99+
- list
100+
- watch
101+
- apiGroups:
102+
- apps
103+
resources:
104+
- daemonsets
105+
- deployments
106+
- replicasets
107+
- statefulsets
108+
verbs:
109+
- get
110+
- list
111+
- watch
112+
- apiGroups:
113+
- batch
114+
resources:
115+
- jobs
116+
- cronjobs
117+
verbs:
118+
- get
119+
- list
120+
- watch
121+
---
122+
apiVersion: rbac.authorization.k8s.io/v1
123+
kind: ClusterRole
124+
metadata:
125+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-status-reader
126+
rules:
127+
- apiGroups:
128+
- "coordination.k8s.io"
129+
resources:
130+
- leases
131+
verbs:
132+
- get
133+
- list
134+
- watch
135+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/updater-clusterrolebinding.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{{- if and (.Values.updater.enabled) .Values.rbac.create -}}
2+
---
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: ClusterRoleBinding
5+
metadata:
6+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-in-place-binding
7+
labels:
8+
{{- include "vertical-pod-autoscaler.updater.labels" . | nindent 4 }}
9+
roleRef:
10+
apiGroup: rbac.authorization.k8s.io
11+
kind: ClusterRole
12+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-in-place
13+
subjects:
14+
- kind: ServiceAccount
15+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}
16+
namespace: {{ .Release.Namespace }}
17+
---
18+
apiVersion: rbac.authorization.k8s.io/v1
19+
kind: ClusterRoleBinding
20+
metadata:
21+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-actor-binding
22+
labels:
23+
{{- include "vertical-pod-autoscaler.updater.labels" . | nindent 4 }}
24+
roleRef:
25+
apiGroup: rbac.authorization.k8s.io
26+
kind: ClusterRole
27+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-actor
28+
subjects:
29+
- kind: ServiceAccount
30+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}
31+
namespace: {{ .Release.Namespace }}
32+
---
33+
apiVersion: rbac.authorization.k8s.io/v1
34+
kind: ClusterRoleBinding
35+
metadata:
36+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-target-reader-binding
37+
labels:
38+
{{- include "vertical-pod-autoscaler.updater.labels" . | nindent 4 }}
39+
roleRef:
40+
apiGroup: rbac.authorization.k8s.io
41+
kind: ClusterRole
42+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-target-reader
43+
subjects:
44+
- kind: ServiceAccount
45+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}
46+
namespace: {{ .Release.Namespace }}
47+
---
48+
apiVersion: rbac.authorization.k8s.io/v1
49+
kind: ClusterRoleBinding
50+
metadata:
51+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-evictioner-binding
52+
labels:
53+
{{- include "vertical-pod-autoscaler.updater.labels" . | nindent 4 }}
54+
roleRef:
55+
apiGroup: rbac.authorization.k8s.io
56+
kind: ClusterRole
57+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-evictioner
58+
subjects:
59+
- kind: ServiceAccount
60+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}
61+
namespace: {{ .Release.Namespace }}
62+
---
63+
apiVersion: rbac.authorization.k8s.io/v1
64+
kind: ClusterRoleBinding
65+
metadata:
66+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-status-reader-binding
67+
labels:
68+
{{- include "vertical-pod-autoscaler.updater.labels" . | nindent 4 }}
69+
roleRef:
70+
apiGroup: rbac.authorization.k8s.io
71+
kind: ClusterRole
72+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-status-reader
73+
subjects:
74+
- kind: ServiceAccount
75+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}
76+
namespace: {{ .Release.Namespace }}
77+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/updater-deployment.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ spec:
2727
imagePullSecrets:
2828
{{- toYaml . | nindent 8 }}
2929
{{- end }}
30+
serviceAccountName: {{ include "vertical-pod-autoscaler.updater.fullname" . }}
3031
securityContext:
3132
runAsNonRoot: true
3233
runAsUser: 65534

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/updater-role.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{{- if and (.Values.updater.enabled) .Values.updater.serviceAccount.create -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-leader-locking
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "vertical-pod-autoscaler.updater.labels" . | nindent 4 }}
9+
{{- with .Values.updater.serviceAccount.labels }}
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
{{- with .Values.updater.serviceAccount.annotations }}
13+
annotations:
14+
{{- toYaml . | nindent 4 }}
15+
{{- end }}
16+
rules:
17+
- apiGroups:
18+
- "coordination.k8s.io"
19+
resources:
20+
- leases
21+
verbs:
22+
- create
23+
- apiGroups:
24+
- "coordination.k8s.io"
25+
resourceNames:
26+
- vpa-updater
27+
resources:
28+
- leases
29+
verbs:
30+
- get
31+
- watch
32+
- update
33+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/updater-rolebinding.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{{- if and (.Values.updater.enabled) .Values.rbac.create -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-leader-locking-binding
6+
namespace: {{ .Release.Namespace }}
7+
roleRef:
8+
apiGroup: rbac.authorization.k8s.io
9+
kind: Role
10+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}-leader-locking
11+
subjects:
12+
- kind: ServiceAccount
13+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}
14+
namespace: {{ .Release.Namespace }}
15+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/templates/updater-serviceaccount.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- if and (.Values.updater.enabled) .Values.updater.serviceAccount.create -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "vertical-pod-autoscaler.updater.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "vertical-pod-autoscaler.updater.labels" . | nindent 4 }}
9+
{{- with .Values.updater.serviceAccount.labels }}
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
{{- with .Values.updater.serviceAccount.annotations }}
13+
annotations:
14+
{{- toYaml . | nindent 4 }}
15+
{{- end }}
16+
{{- end -}}

‎vertical-pod-autoscaler/charts/vertical-pod-autoscaler/values.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ updater:
189189
tag:
190190
# Image pull policy for the Updater default container.
191191
pullPolicy: IfNotPresent
192-
192+
193193
# Number of Updater replicas to create.
194194
replicas: 1
195195

@@ -198,3 +198,10 @@ updater:
198198

199199
# Annotations to add to the Updater pod.
200200
podAnnotations: {}
201+
serviceAccount:
202+
# If `true`, create a new `ServiceAccount` for the Updater.
203+
create: true
204+
# Labels to add to the Updater service account.
205+
labels: {}
206+
# Annotations to add to the Updater service account.
207+
annotations: {}

0 commit comments

Comments
 (0)