Merge pull request #10858 from olemarkus/bump-metrics-server-feb

Bump metrics-server to 0.4.2
2021-02-17 23:20:51 -08:00 · 2021-02-17 23:20:51 -08:00 · 95ba51eac9
parent 7e6e2bc049 b78455264f
commit 95ba51eac9
2 changed files with 340 additions and 260 deletions
--- a/upup/models/bindata.go
+++ b/upup/models/bindata.go
@ -30324,146 +30324,39 @@ func cloudupResourcesAddonsMetadataProxyAddonsK8sIoV0112Yaml() (*asset, error) {

 var _cloudupResourcesAddonsMetricsServerAddonsK8sIoK8s111YamlTemplate = []byte(`# sourced from https://github.com/kubernetes-sigs/metrics-server/releases/download/v0.3.7/components.yaml
 ---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: system:aggregated-metrics-reader
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-view: "true"
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
-    rbac.authorization.k8s.io/aggregate-to-admin: "true"
-rules:
- apiGroups: ["metrics.k8s.io"]
-  resources: ["pods", "nodes"]
-  verbs: ["get", "list", "watch"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: metrics-server:system:auth-delegator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:auth-delegator
-subjects:
- kind: ServiceAccount
-  name: metrics-server
-  namespace: kube-system
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: metrics-server-auth-reader
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: extension-apiserver-authentication-reader
-subjects:
- kind: ServiceAccount
-  name: metrics-server
-  namespace: kube-system
---
-apiVersion: apiregistration.k8s.io/v1beta1
-kind: APIService
-metadata:
-{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
-  annotations:
-    cert-manager.io/inject-ca-from: kube-system/metrics-server
-{{ end }}
-  name: v1beta1.metrics.k8s.io
-spec:
-  service:
-    name: metrics-server
-    namespace: kube-system
-  group: metrics.k8s.io
-  version: v1beta1
-  groupPriorityMinimum: 100
-  versionPriority: 100
---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: metrics-server
-  namespace: kube-system
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: metrics-server
-  namespace: kube-system
  labels:
    k8s-app: metrics-server
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      k8s-app: metrics-server
-  template:
-    metadata:
-      name: metrics-server
-      labels:
-        k8s-app: metrics-server
-    spec:
-      serviceAccountName: metrics-server
-      volumes:
-{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
-      - name: certs
-        secret:
-          secretName: metrics-server-tls
-{{ end }}
-      - name: tmp-dir
-        emptyDir: {}
-      containers:
-      - name: metrics-server
-        image: {{ or .MetricsServer.Image "k8s.gcr.io/metrics-server/metrics-server:v0.3.7" }}
-        imagePullPolicy: IfNotPresent
-        args:
-{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
-          - --tls-cert-file=/srv/tls.crt
-          - --tls-private-key-file=/srv/tls.key
-{{ else }}
-          - --cert-dir=/tmp
-{{ end }}
-          - --secure-port=4443
-        {{ if not UseKopsControllerForNodeBootstrap }}
-          - --kubelet-insecure-tls
-        {{ end }}
-        ports:
-        - name: main-port
-          containerPort: 4443
-          protocol: TCP
-        securityContext:
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        volumeMounts:
-{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
-        - name: certs
-          mountPath: /srv
-{{ end }}
-        - name: tmp-dir
-          mountPath: /tmp
---
-apiVersion: v1
-kind: Service
-metadata:
  name: metrics-server
  namespace: kube-system
-  labels:
-    kubernetes.io/name: "Metrics-server"
-    kubernetes.io/cluster-service: "true"
-spec:
-  selector:
-    k8s-app: metrics-server
-  ports:
-  - port: 443
-    protocol: TCP
-    targetPort: main-port
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  labels:
+    k8s-app: metrics-server
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: system:aggregated-metrics-reader
+rules:
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    k8s-app: metrics-server
  name: system:metrics-server
 rules:
 - apiGroups:
@ -30480,8 +30373,42 @@ rules:
  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server-auth-reader
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+- kind: ServiceAccount
+  name: metrics-server
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server:system:auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: metrics-server
+  namespace: kube-system
+---
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    k8s-app: metrics-server
  name: system:metrics-server
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@ -30492,6 +30419,120 @@ subjects:
  name: metrics-server
  namespace: kube-system
 ---
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server
+  namespace: kube-system
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: https
+  selector:
+    k8s-app: metrics-server
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server
+  namespace: kube-system
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      k8s-app: metrics-server
+  template:
+    metadata:
+      labels:
+        k8s-app: metrics-server
+    spec:
+      containers:
+      - args:
+          - --secure-port=4443
+{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
+          - --tls-cert-file=/srv/tls.crt
+          - --tls-private-key-file=/srv/tls.key
+{{ else }}
+          - --cert-dir=/tmp
+{{ end }}
+{{ if not UseKopsControllerForNodeBootstrap }}
+          - --kubelet-insecure-tls
+{{ end }} 
+        image: {{ or .MetricsServer.Image "k8s.gcr.io/metrics-server/metrics-server:v0.4.2" }}
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /livez
+            port: https
+            scheme: HTTPS
+          periodSeconds: 10
+        name: metrics-server
+        ports:
+        - containerPort: 4443
+          name: https
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /readyz
+            port: https
+            scheme: HTTPS
+          periodSeconds: 10
+        securityContext:
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 1000
+        volumeMounts:
+{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
+        - name: certs
+          mountPath: /srv
+{{ end }}
+        - mountPath: /tmp
+          name: tmp-dir
+      nodeSelector:
+        kubernetes.io/os: linux
+      priorityClassName: system-cluster-critical
+      serviceAccountName: metrics-server
+      volumes:
+{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
+      - name: certs
+        secret:
+          secretName: metrics-server-tls
+{{ end }}
+      - emptyDir: {}
+        name: tmp-dir
+---
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
+  annotations:
+    cert-manager.io/inject-ca-from: kube-system/metrics-server
+{{ end }}
+  labels:
+    k8s-app: metrics-server
+  name: v1beta1.metrics.k8s.io
+spec:
+  group: metrics.k8s.io
+  groupPriorityMinimum: 100
+{{ if WithDefaultBool .MetricsServer.Insecure true }}
+  insecureSkipTLSVerify: true
+{{ end }}
+  service:
+    name: metrics-server
+    namespace: kube-system
+  version: v1beta1
+  versionPriority: 100
+---
 apiVersion: policy/v1beta1
 kind: PodDisruptionBudget
 metadata:
@ -30504,7 +30545,6 @@ spec:
  selector:
    matchLabels:
      k8s-app: metrics-server
-
 {{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
 ---
 apiVersion: cert-manager.io/v1
--- a/upup/models/cloudup/resources/addons/metrics-server.addons.k8s.io/k8s-1.11.yaml.template
+++ b/upup/models/cloudup/resources/addons/metrics-server.addons.k8s.io/k8s-1.11.yaml.template
@ -1,145 +1,38 @@
 # sourced from https://github.com/kubernetes-sigs/metrics-server/releases/download/v0.3.7/components.yaml
 ---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: system:aggregated-metrics-reader
-  labels:
-    rbac.authorization.k8s.io/aggregate-to-view: "true"
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
-    rbac.authorization.k8s.io/aggregate-to-admin: "true"
-rules:
- apiGroups: ["metrics.k8s.io"]
-  resources: ["pods", "nodes"]
-  verbs: ["get", "list", "watch"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: metrics-server:system:auth-delegator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:auth-delegator
-subjects:
- kind: ServiceAccount
-  name: metrics-server
-  namespace: kube-system
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: metrics-server-auth-reader
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: extension-apiserver-authentication-reader
-subjects:
- kind: ServiceAccount
-  name: metrics-server
-  namespace: kube-system
---
-apiVersion: apiregistration.k8s.io/v1beta1
-kind: APIService
-metadata:
-{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
-  annotations:
-    cert-manager.io/inject-ca-from: kube-system/metrics-server
-{{ end }}
-  name: v1beta1.metrics.k8s.io
-spec:
-  service:
-    name: metrics-server
-    namespace: kube-system
-  group: metrics.k8s.io
-  version: v1beta1
-  groupPriorityMinimum: 100
-  versionPriority: 100
---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: metrics-server
-  namespace: kube-system
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: metrics-server
-  namespace: kube-system
  labels:
    k8s-app: metrics-server
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      k8s-app: metrics-server
-  template:
-    metadata:
-      name: metrics-server
-      labels:
-        k8s-app: metrics-server
-    spec:
-      serviceAccountName: metrics-server
-      volumes:
-{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
-      - name: certs
-        secret:
-          secretName: metrics-server-tls
-{{ end }}
-      - name: tmp-dir
-        emptyDir: {}
-      containers:
-      - name: metrics-server
-        image: {{ or .MetricsServer.Image "k8s.gcr.io/metrics-server/metrics-server:v0.3.7" }}
-        imagePullPolicy: IfNotPresent
-        args:
-{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
-          - --tls-cert-file=/srv/tls.crt
-          - --tls-private-key-file=/srv/tls.key
-{{ else }}
-          - --cert-dir=/tmp
-{{ end }}
-          - --secure-port=4443
-        {{ if not UseKopsControllerForNodeBootstrap }}
-          - --kubelet-insecure-tls
-        {{ end }}
-        ports:
-        - name: main-port
-          containerPort: 4443
-          protocol: TCP
-        securityContext:
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        volumeMounts:
-{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
-        - name: certs
-          mountPath: /srv
-{{ end }}
-        - name: tmp-dir
-          mountPath: /tmp
---
-apiVersion: v1
-kind: Service
-metadata:
  name: metrics-server
  namespace: kube-system
-  labels:
-    kubernetes.io/name: "Metrics-server"
-    kubernetes.io/cluster-service: "true"
-spec:
-  selector:
-    k8s-app: metrics-server
-  ports:
-  - port: 443
-    protocol: TCP
-    targetPort: main-port
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
+  labels:
+    k8s-app: metrics-server
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: system:aggregated-metrics-reader
+rules:
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    k8s-app: metrics-server
  name: system:metrics-server
 rules:
 - apiGroups:
@ -156,8 +49,42 @@ rules:
  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server-auth-reader
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+- kind: ServiceAccount
+  name: metrics-server
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server:system:auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: metrics-server
+  namespace: kube-system
+---
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    k8s-app: metrics-server
  name: system:metrics-server
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@ -168,6 +95,120 @@ subjects:
  name: metrics-server
  namespace: kube-system
 ---
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server
+  namespace: kube-system
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: https
+  selector:
+    k8s-app: metrics-server
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server
+  namespace: kube-system
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      k8s-app: metrics-server
+  template:
+    metadata:
+      labels:
+        k8s-app: metrics-server
+    spec:
+      containers:
+      - args:
+          - --secure-port=4443
+{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
+          - --tls-cert-file=/srv/tls.crt
+          - --tls-private-key-file=/srv/tls.key
+{{ else }}
+          - --cert-dir=/tmp
+{{ end }}
+{{ if not UseKopsControllerForNodeBootstrap }}
+          - --kubelet-insecure-tls
+{{ end }} 
+        image: {{ or .MetricsServer.Image "k8s.gcr.io/metrics-server/metrics-server:v0.4.2" }}
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /livez
+            port: https
+            scheme: HTTPS
+          periodSeconds: 10
+        name: metrics-server
+        ports:
+        - containerPort: 4443
+          name: https
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /readyz
+            port: https
+            scheme: HTTPS
+          periodSeconds: 10
+        securityContext:
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 1000
+        volumeMounts:
+{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
+        - name: certs
+          mountPath: /srv
+{{ end }}
+        - mountPath: /tmp
+          name: tmp-dir
+      nodeSelector:
+        kubernetes.io/os: linux
+      priorityClassName: system-cluster-critical
+      serviceAccountName: metrics-server
+      volumes:
+{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
+      - name: certs
+        secret:
+          secretName: metrics-server-tls
+{{ end }}
+      - emptyDir: {}
+        name: tmp-dir
+---
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+{{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
+  annotations:
+    cert-manager.io/inject-ca-from: kube-system/metrics-server
+{{ end }}
+  labels:
+    k8s-app: metrics-server
+  name: v1beta1.metrics.k8s.io
+spec:
+  group: metrics.k8s.io
+  groupPriorityMinimum: 100
+{{ if WithDefaultBool .MetricsServer.Insecure true }}
+  insecureSkipTLSVerify: true
+{{ end }}
+  service:
+    name: metrics-server
+    namespace: kube-system
+  version: v1beta1
+  versionPriority: 100
+---
 apiVersion: policy/v1beta1
 kind: PodDisruptionBudget
 metadata:
@ -180,7 +221,6 @@ spec:
  selector:
    matchLabels:
      k8s-app: metrics-server
-
 {{ if not (WithDefaultBool .MetricsServer.Insecure true) }}
 ---
 apiVersion: cert-manager.io/v1