WILL BE RESET

infra/k8s/web/templates/descheduler-cronjob.yaml

@@ -4,14 +4,14 @@ kind: CronJob
 metadata:
   name: {{ include "web.fullname" . }}
 spec:
-  schedule: {{ .Values.descheduler.schedule }}
+  schedule: "{{ .Values.descheduler.schedule }}"
   jobTemplate:
     spec:
       template:
         spec:
           containers:
             - name: descheduler
-              image: k8s.gcr.io/descheduler/descheduler:v0.26.1
+              image: registry.k8s.io/descheduler/descheduler:v0.30.1
               command:
                 - "/bin/descheduler"
               args:
@@ -20,9 +20,8 @@ spec:
                 - --descheduling-interval
                 - "30s"
               volumeMounts:
-                - name: policy-volume
-                  mountPath: /policy-dir
-                  subPath: policy.yaml
+              - mountPath: /policy-dir
+                name: policy-volume
               livenessProbe:
                 failureThreshold: 3
                 httpGet:
@@ -32,11 +31,9 @@ spec:
                 initialDelaySeconds: 3
                 periodSeconds: 10
           restartPolicy: Never
+          serviceAccountName: {{ include "web.fullname" . }}-sa
           volumes:
             - name: policy-volume
               configMap:
                 name: {{ include "web.fullname" . }}
-                items:
-                  - key: policy.yaml
-                    path: policy.yaml
 {{- end }}

infra/k8s/web/templates/rbac.yaml

@@ -0,0 +1,48 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: descheduler-cluster-role
+rules:
+- apiGroups: ["events.k8s.io"]
+  resources: ["events"]
+  verbs: ["create", "update"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get", "watch", "list"]
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["get", "watch", "list"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "watch", "list", "delete"]
+- apiGroups: [""]
+  resources: ["pods/eviction"]
+  verbs: ["create"]
+- apiGroups: ["scheduling.k8s.io"]
+  resources: ["priorityclasses"]
+  verbs: ["get", "watch", "list"]
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["create"]
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  resourceNames: ["descheduler"]
+  verbs: ["get", "patch", "delete"]
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "web.fullname" . }}-sa
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: descheduler-cluster-role-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: descheduler-cluster-role
+subjects:
+  - name: {{ include "web.fullname" . }}-sa
+    kind: ServiceAccount
+    namespace: {{ .Release.Namespace }}

infra/k8s/web/values.yaml

@@ -53,5 +53,4 @@ readinessProbe:
 descheduler:
   enabled: true
   maxPodLifeTimeSeconds: 86400
-  # 6時間に1回実行
-  schedule: "0 */6 * * *"
+  schedule: "*/1 * * * *"