ca62aa1ee2
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Use default seccomp profile for unprivileged addons **What this PR does / why we need it**: This PR sets the default seccomp profile of unprivileged addons to 'docker/default'. This PR is a followup of [#62662](https://github.com/kubernetes/kubernetes/pull/62662) and [#62671](https://github.com/kubernetes/kubernetes/pull/62671). We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes #39845 **Special notes for your reviewer**: **Release note**: ```release-note NONE ```
124 lines
3.7 KiB
YAML
124 lines
3.7 KiB
YAML
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: heapster
|
|
namespace: kube-system
|
|
labels:
|
|
kubernetes.io/cluster-service: "true"
|
|
addonmanager.kubernetes.io/mode: Reconcile
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: heapster-config
|
|
namespace: kube-system
|
|
labels:
|
|
kubernetes.io/cluster-service: "true"
|
|
addonmanager.kubernetes.io/mode: EnsureExists
|
|
data:
|
|
NannyConfiguration: |-
|
|
apiVersion: nannyconfig/v1alpha1
|
|
kind: NannyConfiguration
|
|
---
|
|
apiVersion: extensions/v1beta1
|
|
kind: Deployment
|
|
metadata:
|
|
name: heapster-v1.5.3
|
|
namespace: kube-system
|
|
labels:
|
|
k8s-app: heapster
|
|
kubernetes.io/cluster-service: "true"
|
|
addonmanager.kubernetes.io/mode: Reconcile
|
|
version: v1.5.3
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
k8s-app: heapster
|
|
version: v1.5.3
|
|
template:
|
|
metadata:
|
|
labels:
|
|
k8s-app: heapster
|
|
version: v1.5.3
|
|
annotations:
|
|
scheduler.alpha.kubernetes.io/critical-pod: ''
|
|
seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
|
|
spec:
|
|
priorityClassName: system-cluster-critical
|
|
containers:
|
|
- image: k8s.gcr.io/heapster-amd64:v1.5.3
|
|
name: heapster
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8082
|
|
scheme: HTTP
|
|
initialDelaySeconds: 180
|
|
timeoutSeconds: 5
|
|
command:
|
|
- /heapster
|
|
- --source=kubernetes.summary_api:''
|
|
- --sink=stackdriver:?cluster_name={{ cluster_name }}&use_old_resources={{ use_old_resources }}&use_new_resources={{ use_new_resources }}&min_interval_sec=100&batch_export_timeout_sec=110
|
|
# BEGIN_PROMETHEUS_TO_SD
|
|
- name: prom-to-sd
|
|
image: k8s.gcr.io/prometheus-to-sd:v0.2.4
|
|
command:
|
|
- /monitor
|
|
- --source=heapster:http://localhost:8082?whitelisted=stackdriver_requests_count,stackdriver_timeseries_count
|
|
- --stackdriver-prefix={{ prometheus_to_sd_prefix }}/addons
|
|
- --api-override={{ prometheus_to_sd_endpoint }}
|
|
- --pod-id=$(POD_NAME)
|
|
- --namespace-id=$(POD_NAMESPACE)
|
|
env:
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
# END_PROMETHEUS_TO_SD
|
|
- image: k8s.gcr.io/addon-resizer:1.8.1
|
|
name: heapster-nanny
|
|
resources:
|
|
limits:
|
|
cpu: 50m
|
|
memory: {{ nanny_memory }}
|
|
requests:
|
|
cpu: 50m
|
|
memory: {{ nanny_memory }}
|
|
volumeMounts:
|
|
- name: heapster-config-volume
|
|
mountPath: /etc/config
|
|
env:
|
|
- name: MY_POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: MY_POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
command:
|
|
- /pod_nanny
|
|
- --config-dir=/etc/config
|
|
- --cpu={{ base_metrics_cpu }}
|
|
- --extra-cpu={{ metrics_cpu_per_node }}m
|
|
- --memory={{ base_metrics_memory }}
|
|
- --extra-memory={{metrics_memory_per_node}}Mi
|
|
- --threshold=5
|
|
- --deployment=heapster-v1.5.3
|
|
- --container=heapster
|
|
- --poll-period=300000
|
|
- --estimator=exponential
|
|
volumes:
|
|
- name: heapster-config-volume
|
|
configMap:
|
|
name: heapster-config
|
|
serviceAccountName: heapster
|
|
tolerations:
|
|
- key: "CriticalAddonsOnly"
|
|
operator: "Exists"
|