GistPin/infrastructure/k8s/spot-handler/deployment.yaml at fix/backend-test-suite · ghzhost/GistPin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
apiVersion: v1
kind: ServiceAccount
metadata:
  name: spot-handler
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: spot-handler
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch", "patch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["pods/eviction"]
    verbs: ["create"]
  - apiGroups: ["apps"]
    resources: ["deployments", "statefulsets", "daemonsets"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: spot-handler
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: spot-handler
subjects:
  - kind: ServiceAccount
    name: spot-handler
    namespace: kube-system
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: spot-handler
  namespace: kube-system
  labels:
    app: spot-handler
spec:
  selector:
    matchLabels:
      app: spot-handler
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: spot-handler
    spec:
      serviceAccountName: spot-handler
      hostNetwork: true
      priorityClassName: system-node-critical
      tolerations:
        - operator: Exists   # run on all nodes including spot
      containers:
        - name: spot-handler
          image: public.ecr.aws/aws-ec2-spot-interruption-notice/aws-node-termination-handler:v1.20.0
          imagePullPolicy: IfNotPresent
          env:
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: ENABLE_SPOT_INTERRUPTION_DRAINING
              value: "true"
            - name: ENABLE_SCHEDULED_EVENT_DRAINING
              value: "true"
            - name: ENABLE_REBALANCE_MONITORING
              value: "true"
            - name: DRAIN_GRACE_PERIOD
              value: "120"
            - name: TAINT_NODE
              value: "true"
            - name: METADATA_TRIES
              value: "3"
            - name: WEBHOOK_URL
              valueFrom:
                secretKeyRef:
                  name: spot-handler-secrets
                  key: webhook-url
                  optional: true
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 100m
              memory: 128Mi
          securityContext:
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}