Merge pull request #31 from rimusz/add-gke-pvm-killer

add gke-pvm-killer chart

stable/gke-pvm-killer/.helmignore

@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

stable/gke-pvm-killer/Chart.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+appVersion: 1.0.46
+version: 0.1.0
+description: A Helm chart for gke-pvm-killer
+name: gke-pvm-killer
+keywords:
+- gke
+- preemptible
+source: https://github.com/rimusz/charts/blob/master/stable/gke-pvm-killer
+home: https://github.com/estafette/estafette-gke-preemptible-killer
+maintainers:
+- email: rmocius@gmail.com
+  name: rimusz

stable/gke-pvm-killer/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 estafette
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

stable/gke-pvm-killer/OWNERS

@@ -0,0 +1,4 @@
+approvers:
+- rimusz
+reviewers:
+- rimusz

stable/gke-pvm-killer/README.md

@@ -0,0 +1,101 @@
+# GKE preemptible VMs killer
+
+This small Kubernetes application loop through a given GKE [preemptibles](https://cloud.google.com/compute/docs/instances/preemptible) node pool and kill a node before the regular [24h life time of a preemptible VM](https://cloud.google.com/compute/docs/instances/preemptible#limitations).
+
+## Why?
+
+When creating a cluster, all the node are created at the same time and should be deleted after 24h of activity. To
+prevent large disruption, the [estafette-gke-preemptible-killer](https://github.com/estafette/estafette-gke-preemptible-killer) can be used to kill instances during a random period of time between 12 and 24h. It makes use of the node annotation to store the time to kill value.
+
+
+## How does that work
+
+At a given interval, the application get the list of preemptible (PVMs) nodes and check either the node should be
+deleted or not. If the annotation doesn't exist, a time to kill value is added to the node annotation with a
+random range between 12h and 24h based on the node creation time stamp.
+When the time to kill time is passed, the Kubernetes node is marked as unschedulable, drained and the instance
+deleted on Google Cloud.
+
+## Installing the Chart
+
+To install the chart with the release name `gke-pvm-killer`:
+
+```
+helm upgrade --install gke-pvm-killer --namespace estafette rimusz/gke-pvm-killer \
+    --set googleServiceAccount="$(cat path_to_your/google-service-account.json | base64)"
+```
+
+### Installing with existing secret
+
+You can deploy the Google service account `google-service-account.json` file as a [Kubernetes secret](https://kubernetes.io/docs/concepts/configuration/secret/).
+
+
+Create the Kubernetes secret:
+
+```
+kubectl create secret generic gke-pvm-killer -n estafette --from-file=path_to_your/google-service-account.json
+```
+
+Pass the configuration file to helm:
+
+```
+helm upgrade --install gke-pvm-killer --namespace estafette rimusz/gke-pvm-killer \
+    --set existingSecret="gke-pvm-killer"
+```
+
+**NOTE:** You have to keep passing the configuration file secret parameter as `--set existingSecret="gke-pvm-killer"` on all future calls to `helm upgrade` or set it in `values.yaml` file `existingSecret: gke-pvm-killer`!
+
+## Uninstalling the Chart
+
+To uninstall/delete the `gke-pvm-killer` deployment:
+
+```
+helm delete --purge gke-pvm-killer
+```
+
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+## Configuration
+
+The following table lists the configurable parameters of the kubernetes-dashboard chart and their default values.
+
+|         Parameter            |                    Description                   |           Default                  |
+|------------------------------|--------------------------------------------------|------------------------------------|
+| `image.repository`| Image repository name | `estafette/estafette-gke-preemptible-killer` |
+| `image.pullPolicy`| Image pull policy | `IfNotPresent` |
+| `image.pullSecrets`| Image pull secret from private registry | `` |
+| `googleServiceAccount` | base64 encoded `google-service-account.json` file | `` |
+| `existingSecret` | Specifies an existing secret for `google-service-account.json` file| `` |
+| `securityContext.enabled` | Enables Security Context  | `true` |
+| `securityContext.userId` |  Security User Id | `1000` |
+| `securityContext.groupId` |  Security Group Id | `1000` |
+| `node.drainTimeout` | Max time in second to wait before deleting a node | `300` |
+| `node.interval` | Time in second to wait between each node check | `900` |
+| `annotations.prometheus.io/scrape` | The address to listen on for Prometheus metrics requests | `true` |
+| `annotations.prometheus.io/port` | The port to listen for Prometheus metrics requests | `9001` |
+| `livenessProbe` | Set liveness probe | `{}` |
+| `resources.limits.cpu` | Specifies CPU limit | `50m` |
+| `resources.limits.memory` | Specifies memory limit | `128Mi` |
+| `resources.requests.cpu` | Specifies CPU request | `10m` |
+| `resources.requests.memory` | Specifies memory request | `16Mi` |
+| `nodeSelector` | gke-pvm-killer node selector | `{}` |
+| `tolerations` | gke-pvm-killer node tolerations | `[]` |
+| `affinity` | gke-pvm-killer node affinity | `cloud.google.com/gke-preemptible` |
+| `podDisruptionBudget.enabled` | Enables Pod Disruption Budget | `false` |
+| `podDisruptionBudget.maxUnavailable` | Max unavailable Pods | `1` |
+| `podDisruptionBudget.minAvailable` | min unavailable Pods | `` |
+| `rbac.enabled` | Specifies whether RBAC resources should be created | `true` |
+
+Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
+
+```
+helm upgrade --install gke-pvm-killer --namespace estafette rimusz/gke-pvm-killer --set resources.limits.cpu=200m
+```
+
+Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
+
+```
+helm upgrade --install gke-pvm-killer --namespace estafette rimusz/gke-pvm-killer -f values.yaml
+```
+
+> **Tip**: You can use the default [values.yaml](values.yaml)

stable/gke-pvm-killer/templates/NOTES.txt

@@ -0,0 +1,7 @@
+Check the {{ .Chart.Name }} application by running:
+
+kubectl get pods --namespace {{ .Release.Namespace }}
+
+Check the logs of the {{ .Chart.Name }} to see whether all runs well:
+
+kubectl logs --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "gke-pvm-killer.fullname" . }}"

stable/gke-pvm-killer/templates/_helpers.tpl

@@ -0,0 +1,32 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "gke-pvm-killer.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "gke-pvm-killer.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "gke-pvm-killer.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}

stable/gke-pvm-killer/templates/clusterrole.yaml

@@ -0,0 +1,30 @@
+{{- if .Values.rbac.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "gke-pvm-killer.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "gke-pvm-killer.name" . }}
+    helm.sh/chart: {{ include "gke-pvm-killer.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+  - apiGroups: 
+      - ""  # "" indicates the core API group
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - patch
+      - update
+      - delete
+  - apiGroups: 
+      - ""   # "" indicates the core API group
+    resources:
+      - pods
+    verbs:
+      - delete
+      - get
+      - list
+{{ end }}

stable/gke-pvm-killer/templates/clusterrolebinding.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.rbac.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "gke-pvm-killer.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "gke-pvm-killer.name" . }}
+    helm.sh/chart: {{ include "gke-pvm-killer.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "gke-pvm-killer.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "gke-pvm-killer.fullname" . }}
+    namespace: {{ .Release.Namespace | quote }}
+{{ end }}

stable/gke-pvm-killer/templates/deployment.yaml

@@ -0,0 +1,72 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "gke-pvm-killer.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "gke-pvm-killer.name" . }}
+    helm.sh/chart: {{ include "gke-pvm-killer.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "gke-pvm-killer.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "gke-pvm-killer.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+      {{- with .Values.annotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      serviceAccount: {{ include "gke-pvm-killer.fullname" . }}
+      terminationGracePeriodSeconds: {{ .Values.node.drainTimeout }}
+      {{- if .Values.securityContext.enabled }}
+      securityContext:
+        runAsUser: {{ .Values.securityContext.userId }}
+        fsGroup: {{ .Values.securityContext.groupId }}
+      {{- end }}
+      {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+        - name: {{ .Values.image.pullSecrets }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            - name: "DRAIN_TIMEOUT"
+              value: {{ .Values.node.drainTimeout | quote }}
+            - name: "INTERVAL"
+              value: {{ .Values.node.interval | quote }}
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/app-secrets/google-service-account.json
+          livenessProbe:
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: app-secrets
+              mountPath: /etc/app-secrets
+      volumes:
+        - name: app-secrets
+          secret:
+            secretName: {{ default (include "gke-pvm-killer.fullname" .) .Values.existingSecret }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}

stable/gke-pvm-killer/templates/pdb.yaml

@@ -0,0 +1,20 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "gke-pvm-killer.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "gke-pvm-killer.name" . }}
+    helm.sh/chart: {{ include "gke-pvm-killer.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+{{- if .Values.podDisruptionBudget.minAvailable }}
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+{{- else }}
+  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+{{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "gke-pvm-killer.name" . }}
+{{- end }}

stable/gke-pvm-killer/templates/secret.yaml

@@ -0,0 +1,14 @@
+{{- if not .Values.existingSecret -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gke-pvm-killer.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "gke-pvm-killer.name" . }}
+    helm.sh/chart: {{ include "gke-pvm-killer.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+type: Opaque
+data:
+  google-service-account.json: {{ .Values.googleServiceAccount }}
+{{- end -}}

stable/gke-pvm-killer/templates/service-account.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "gke-pvm-killer.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "gke-pvm-killer.name" . }}
+    helm.sh/chart: {{ include "gke-pvm-killer.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}