Federation: Add task for setting up placement policies #4075

tsandall · 2017-06-14T02:12:11Z

This change is

nikhiljindal · 2017-06-14T19:06:55Z

_data/tasks.yml

@@ -135,6 +135,7 @@ toc:
  - docs/tasks/federation/federation-service-discovery.md
  - docs/tasks/federation/set-up-cluster-federation-kubefed.md
  - docs/tasks/federation/set-up-coredns-provider-federation.md
+  - docs/tasks/federation/set-up-placement-policies-federation.md


Not in this PR, but we need to rearrange the docs here.
Setting up placement policies and CoreDNS are admin tasks (should be under docs/tasks/adminster-federation) and creating API resources (deployments, configmaps, etc) are developer tasks (should be under docs/tasks/federation)

Sounds good. Will leave this as is.

nikhiljindal · 2017-06-14T19:07:28Z

docs/tasks/federation/Policy-Engine-Deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: extensions/v1beta1


lower case file name (policy-engine instead of Policy-Engine)

Will fix. Was copying the title case Values.yaml (which may just be a helm thing?)

nikhiljindal · 2017-06-14T19:09:54Z

docs/tasks/federation/Policy-Engine-Service.yaml

+    protocol: TCP
+    port: 8181
+    targetPort: 8181
+  type: LoadBalancer


This will expose the service externally. Is that what you want?
If federation control plane and this service are running on the same cluster, then an internal service should suffice?

It doesn't have to be exposed externally. I'd used this in the past to query the policy engine directly. Will remove.

nikhiljindal · 2017-06-14T19:11:37Z

docs/tasks/federation/Policy.rego

@@ -0,0 +1,32 @@
+package kubernetes.placement


Do people have to write the policy in .rego or are there other options as well?

optional: Some comments in the file can be helpful

Currently, Rego is the only language supported by OPA. I will add a comment about this.

I'll update the policy to explain how it works and provide a link to more documentation.

nikhiljindal · 2017-06-14T19:12:11Z

docs/tasks/federation/ReplicaSet-Example-Policy.yaml

@@ -0,0 +1,21 @@
+apiVersion: extensions/v1beta1


same comment about lowercase file names

nikhiljindal · 2017-06-14T19:13:31Z

docs/tasks/federation/set-up-placement-policies-federation.md

+
+{% capture objectives %}
+
+* Deploying Federation and configuring an exteranl policy engine


typo in external

- Lower case filenames - Comments in policy - Typo fixes - Removed type LoadBalancer from OPA Service

tsandall · 2017-06-15T15:11:54Z

@nikhiljindal updated per your comments.

nikhiljindal · 2017-06-19T19:59:23Z

docs/tasks/federation/policy.rego

+#
+# The SchedulingPolicy Admission Controller running inside the Federation API
+# server will merge these annotatiosn into incoming Federated resources. By
+# setting replica-set-preferences, we can control the placement of Federated


IIUC, this will also work with cluster-selectors?
If yes, then please add an example for that as well.
If not, we should be explicit that this works only for replicasets.

nikhiljindal · 2017-06-19T20:05:20Z

Thanks for the fixes @tsandall
lgtm with just one comment.

Anyone else from @kubernetes/sig-federation-pr-reviews wants to take a look before we merge this?

chenopis

You should switch to the Tasks template instead of the Tutorial one currently being used. LGTM otherwise.

chenopis · 2017-06-20T23:54:23Z

docs/tasks/federation/set-up-placement-policies-federation.md

+
+{% capture overview %}
+
+This page shows you can enforce policy-based placement decisions over Federated


suggested edit: "This page demonstrates how to enforce policy-based placement decisions..."

chenopis · 2017-06-20T23:59:53Z

docs/tasks/federation/set-up-placement-policies-federation.md

+{% endcapture %}
+
+
+{% capture objectives %}


Since this is a Task, you can remove the objectives section -- these are just restating the ToC anyway. Be sure to use the Task template at the end of the doc instead of the Tutorial one, i.e.

{% include templates/task.md %}

chenopis · 2017-06-21T00:00:36Z

docs/tasks/federation/set-up-placement-policies-federation.md

+
+{% endcapture %}
+
+{% include templates/tutorial.md %}


make this {% include templates/task.md %}

chenopis · 2017-06-21T00:01:01Z

docs/tasks/federation/set-up-placement-policies-federation.md

+{% endcapture %}
+
+
+{% capture lessoncontent %}


make this {% capture steps %}

chenopis · 2017-06-22T15:05:06Z

@tsandall Let me know if you need help switching this to using the Task template.

@nikhiljindal

Per-@nikhiljindal's suggestion

tsandall · 2017-06-23T16:01:15Z

@chenopis @nikhiljindal I've updated the docs per latest recommendations. Let me know if I ought to make any more changes. If not, let me know when to squash the commits.

chenopis · 2017-06-23T19:16:24Z

/lgtm
If @nikhiljindal is good w/ this, then I think it's time to squash and merge.

chenopis · 2017-06-26T16:29:02Z

@nikhiljindal Is this Tech LGTM?

FYI, all feedback must be addressed and LGTMs given by EOD Tue, June 27th so that this can be merged for the 1.7 release on June 28th.

nikhiljindal · 2017-06-26T17:53:51Z

docs/tasks/federation/set-up-placement-policies-federation.md

+
+{% capture overview %}
+
+This page shows how to policy-based placement decisions over Federated


missing enforce?

nikhiljindal · 2017-06-26T17:55:45Z

LGTM, with one minor comment.
Feel free to squash commits.

@nikhiljindal

* Minor fixes in the Deployment doc Signed-off-by: Michail Kargakis <mkargaki@redhat.com> * add NodeRestriction to admission-controllers (#3842) * Admins Can Configure Zones in Storage Class The PR #38505 (kubernetes/kubernetes#38505) added zones optional parameter to Storage Class for AWS and GCE provisioners. That's why documentation needs to be updated accordingly. * document custom resource definitions * add host paths to psp (#3971) * add host paths to psp * add italics * Update ConfigMap doc to explain TTL-based cache updates (#3989) * Update ConfigMap doc to explain TTL-based cache updates * swap word order Change "When a ConfigMap being already consumed..." to "When a ConfigMap already being consumed..." * Update NetworkPolicy docs for v1 * StorageOS Volume plugin * Update GPU docs * docs: HPA autoscaling/v2alpha1 status conditions This commit documents the new status conditions feature for HPA autoscaling/v2alpha1. It demonstrates how to get the status conditions using `kubectl describe`, and how to interpret them. * Update description about NodeRestriction kubelet node can alse create mirror pods for their own static pods. * adding storage as a supported resource to node allocatable Signed-off-by: Vishnu kannan <vishnuk@google.com> * Add documentation for podpreset opt-out annotation This adds the annotation for having the podpreset admission controller to skip (opt-out) manipulating the pod spec. Also, the annotation format for what presets have acted on a pod has been modified to add a prefix of "podpreset-". The new naming makes it such that there is no chance of collision with the newly introduced opt-out annotation (or future ones yet to be added). Opt-out annotation PR: kubernetes/kubernetes#44965 * Update PDB documentation to explain new field (#3885) * update-docs-pdb * Addressed erictune@'s comments * Fix title and add a TOC to the logging concept page * Patch #4118 for typos * Describe setting coredns server in nameserver resolv chain * Address comments in PR #3997. Comment is in https://github.com/kubernetes/kubernetes.github.io/pull/3997/files/f6eb59c67e28efc298c87b1ef49a96bc6adacd1e#diff-7a14981f3dd8eb203f897ce6c11d9828 * Update task for DaemonSet history and rollback (#4098) * Update task for DaemonSet history and rollback Also remove mentions of templateGeneration field because it's deprecated * Address comments * removed lt and gt as operators (#4152) * removed lt and gt as operators * replace lt and gt for node-affinfity * updated based on bsalamat review * Initial draft of upgrade guide for kubeadm clusters. In-place upgrades are supported between 1.6 and 1.7 releases. Rollback instructions to come in a separate commit. Fixes kubernetes/kubeadm#278 * Add local volume documentation (#4050) * Add local volume documentation * Add PV local volume example * Patch PR #3999 * Add documentation for Stackdriver event exporter * Add documentation about controller metrics * Federation: Add task for setting up placement policies (#4075) * Add task for setting up placement policies * Update version of management sidecar in policy engine deployment * Address @nikhiljindal's comments - Lower case filenames - Comments in policy - Typo fixes - Removed type LoadBalancer from OPA Service * Add example that sets cluster selector Per-@nikhiljindal's suggestion * Fix wording and templating per @chenopis * PodDisruptionBudget documentation Improvements (#4140) * Changes from #3885 Title: Update PDB documentation to explain new field Author: foxish * Added Placeholder Disruptions Concept Guide New file: docs/concepts/workloads/pods/disruptions.md Intented contents: concept for Pod Disruption Budget, cross reference to Eviction and Preemption docs. Linked from: concepts > workloads > pods * Added placeholder Configuring PDB Task New file: docs/tasks/run-application/configure-pdb.md Intented contents: task for writing a Pod Disruption Budget. Linked from: tasks > configuring-applications > configure pdb. * Add refs to the "drain a node" task. * Refactor PDB docs. Move the "Requesting an eviction" section from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md -- which is going away -- to: docs/tasks/administer-cluster/safely-drain-node.md The move is verbatim, except for an introductory sentence. Also added assignees. * Refactor of PDB docs Moved the section: Specifying a PodDisruptionBudget from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md to: docs/tasks/run-application/configure-pdb.md because that former file is going away. Move is verbatim. * Explain how Eviction tools should handle failures * Refactor PDB docs Move text from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md to: docs/concepts/workloads/pods/disruptions.md Delete the now empty: docs/tasks/administer-cluster/configure-pod-disruption-budget.md Added a redirects_from section to the new doc, containing the path of the now-deleted doc, plus all the redirects from the deleted doc. * Expand PDB Concept guide Building on a little content from the old task, greatly expanded the Disruptions concept guide, including an abstract example. * Update creating a pdb Task. * Address review comments. * Fixed for all cody-clark's review comments * Address review comments from mml * Address review comments from maisem * Fix missing backtick * Api and Kubectl reference docs updates for 1.7 (#4193) * Fix includes groups * Generated kubectl docs for 1.7 * Generated references docs for 1.7 api * Document node authorization mode * API Aggregator (#4173) * API Aggregator * Additional bullet points * incorporated feedback for apiserver-aggregation.md * split setup-api-aggregator.md into two docs and address feedback * fix link * addressed docs feedback * incorporate feedback * integrate feedback * Add documentation for DNS stub domains (#4063) * Add documentation for DNS stub domains * add additional prereq * fix image path * review feedback * minor grammar and style nits * documentation for using hostAliases to manage hosts file (#4080) * documentation for using hostAliases to manage hosts file * add to table of contents * review comments * update the right command to see hosts file * reformat doc based on suggestion and change some wording * Fix typo for #4080 * Patch PR #4063 * Fix wording in placement policy task introduction * Add update to statefulset concepts and basic tutorial (#4174) * Add update to statefulset concpets and basic tutorial * Address tech comments. * Update ESIPP docs for new added API fields * Custom resource docs * update audit document with advanced audit features added in 1.7 * kubeadm v1.7 documentation updates (#4018) * v1.7 updates for kubeadm * Address review comments * Address Luke's comments * Encrypting secrets at rest and cluster security guide * Edits for Custom DNS Documentation (#4207) * reorganize custom dns doc * format fixes * Update version numbers to 1.7 * Patch PR #4140 (#4215) * Patch PR #4140 * fix link and typos * Update PR template * Update TLS bootstrapping with 1.7 features This includes documenting the new CSR approver built into the controller manager and the kubelet alpha features for certificate rotation. Since the CSR approver changed over the 1.7 release cycle we need to call out the migration steps for those using the alpha feature. This document as a whole could probably use some updates, but the main focus of this PR is just to get these features minimally documented before the release. * Federated ClusterSelector formatting updates from review * complete PR #4181 (#4223) * complete PR #4181 * fix security link * Extensible admission controller (#4092) * extensible-admission-controllers * Update extensible-admission-controllers.md * more on initializers * fixes * Expand external admission webhooks documentation * wrap at 80 chars * more * add reference * Use correct apigroup for network policy * Docs changes to PR #4092 (#4224) * Docs changes to PR #4092 * address feedback * add doc for --as-group in cli Add doc for this pr: kubernetes/kubernetes#43696

@nikhiljindal

* Add task for setting up placement policies * Update version of management sidecar in policy engine deployment * Address @nikhiljindal's comments - Lower case filenames - Comments in policy - Typo fixes - Removed type LoadBalancer from OPA Service * Add example that sets cluster selector Per-@nikhiljindal's suggestion * Fix wording and templating per @chenopis

@nikhiljindal

* Minor fixes in the Deployment doc Signed-off-by: Michail Kargakis <mkargaki@redhat.com> * add NodeRestriction to admission-controllers (#3842) * Admins Can Configure Zones in Storage Class The PR #38505 (kubernetes/kubernetes#38505) added zones optional parameter to Storage Class for AWS and GCE provisioners. That's why documentation needs to be updated accordingly. * document custom resource definitions * add host paths to psp (#3971) * add host paths to psp * add italics * Update ConfigMap doc to explain TTL-based cache updates (#3989) * Update ConfigMap doc to explain TTL-based cache updates * swap word order Change "When a ConfigMap being already consumed..." to "When a ConfigMap already being consumed..." * Update NetworkPolicy docs for v1 * StorageOS Volume plugin * Update GPU docs * docs: HPA autoscaling/v2alpha1 status conditions This commit documents the new status conditions feature for HPA autoscaling/v2alpha1. It demonstrates how to get the status conditions using `kubectl describe`, and how to interpret them. * Update description about NodeRestriction kubelet node can alse create mirror pods for their own static pods. * adding storage as a supported resource to node allocatable Signed-off-by: Vishnu kannan <vishnuk@google.com> * Add documentation for podpreset opt-out annotation This adds the annotation for having the podpreset admission controller to skip (opt-out) manipulating the pod spec. Also, the annotation format for what presets have acted on a pod has been modified to add a prefix of "podpreset-". The new naming makes it such that there is no chance of collision with the newly introduced opt-out annotation (or future ones yet to be added). Opt-out annotation PR: kubernetes/kubernetes#44965 * Update PDB documentation to explain new field (#3885) * update-docs-pdb * Addressed erictune@'s comments * Fix title and add a TOC to the logging concept page * Patch #4118 for typos * Describe setting coredns server in nameserver resolv chain * Address comments in PR #3997. Comment is in https://github.com/kubernetes/kubernetes.github.io/pull/3997/files/f6eb59c67e28efc298c87b1ef49a96bc6adacd1e#diff-7a14981f3dd8eb203f897ce6c11d9828 * Update task for DaemonSet history and rollback (#4098) * Update task for DaemonSet history and rollback Also remove mentions of templateGeneration field because it's deprecated * Address comments * removed lt and gt as operators (#4152) * removed lt and gt as operators * replace lt and gt for node-affinfity * updated based on bsalamat review * Initial draft of upgrade guide for kubeadm clusters. In-place upgrades are supported between 1.6 and 1.7 releases. Rollback instructions to come in a separate commit. Fixes kubernetes/kubeadm#278 * Add local volume documentation (#4050) * Add local volume documentation * Add PV local volume example * Patch PR #3999 * Add documentation for Stackdriver event exporter * Add documentation about controller metrics * Federation: Add task for setting up placement policies (#4075) * Add task for setting up placement policies * Update version of management sidecar in policy engine deployment * Address @nikhiljindal's comments - Lower case filenames - Comments in policy - Typo fixes - Removed type LoadBalancer from OPA Service * Add example that sets cluster selector Per-@nikhiljindal's suggestion * Fix wording and templating per @chenopis * PodDisruptionBudget documentation Improvements (#4140) * Changes from #3885 Title: Update PDB documentation to explain new field Author: foxish * Added Placeholder Disruptions Concept Guide New file: docs/concepts/workloads/pods/disruptions.md Intented contents: concept for Pod Disruption Budget, cross reference to Eviction and Preemption docs. Linked from: concepts > workloads > pods * Added placeholder Configuring PDB Task New file: docs/tasks/run-application/configure-pdb.md Intented contents: task for writing a Pod Disruption Budget. Linked from: tasks > configuring-applications > configure pdb. * Add refs to the "drain a node" task. * Refactor PDB docs. Move the "Requesting an eviction" section from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md -- which is going away -- to: docs/tasks/administer-cluster/safely-drain-node.md The move is verbatim, except for an introductory sentence. Also added assignees. * Refactor of PDB docs Moved the section: Specifying a PodDisruptionBudget from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md to: docs/tasks/run-application/configure-pdb.md because that former file is going away. Move is verbatim. * Explain how Eviction tools should handle failures * Refactor PDB docs Move text from: docs/tasks/administer-cluster/configure-pod-disruption-budget.md to: docs/concepts/workloads/pods/disruptions.md Delete the now empty: docs/tasks/administer-cluster/configure-pod-disruption-budget.md Added a redirects_from section to the new doc, containing the path of the now-deleted doc, plus all the redirects from the deleted doc. * Expand PDB Concept guide Building on a little content from the old task, greatly expanded the Disruptions concept guide, including an abstract example. * Update creating a pdb Task. * Address review comments. * Fixed for all cody-clark's review comments * Address review comments from mml * Address review comments from maisem * Fix missing backtick * Api and Kubectl reference docs updates for 1.7 (#4193) * Fix includes groups * Generated kubectl docs for 1.7 * Generated references docs for 1.7 api * Document node authorization mode * API Aggregator (#4173) * API Aggregator * Additional bullet points * incorporated feedback for apiserver-aggregation.md * split setup-api-aggregator.md into two docs and address feedback * fix link * addressed docs feedback * incorporate feedback * integrate feedback * Add documentation for DNS stub domains (#4063) * Add documentation for DNS stub domains * add additional prereq * fix image path * review feedback * minor grammar and style nits * documentation for using hostAliases to manage hosts file (#4080) * documentation for using hostAliases to manage hosts file * add to table of contents * review comments * update the right command to see hosts file * reformat doc based on suggestion and change some wording * Fix typo for #4080 * Patch PR #4063 * Fix wording in placement policy task introduction * Add update to statefulset concepts and basic tutorial (#4174) * Add update to statefulset concpets and basic tutorial * Address tech comments. * Update ESIPP docs for new added API fields * Custom resource docs * update audit document with advanced audit features added in 1.7 * kubeadm v1.7 documentation updates (#4018) * v1.7 updates for kubeadm * Address review comments * Address Luke's comments * Encrypting secrets at rest and cluster security guide * Edits for Custom DNS Documentation (#4207) * reorganize custom dns doc * format fixes * Update version numbers to 1.7 * Patch PR #4140 (#4215) * Patch PR #4140 * fix link and typos * Update PR template * Update TLS bootstrapping with 1.7 features This includes documenting the new CSR approver built into the controller manager and the kubelet alpha features for certificate rotation. Since the CSR approver changed over the 1.7 release cycle we need to call out the migration steps for those using the alpha feature. This document as a whole could probably use some updates, but the main focus of this PR is just to get these features minimally documented before the release. * Federated ClusterSelector formatting updates from review * complete PR #4181 (#4223) * complete PR #4181 * fix security link * Extensible admission controller (#4092) * extensible-admission-controllers * Update extensible-admission-controllers.md * more on initializers * fixes * Expand external admission webhooks documentation * wrap at 80 chars * more * add reference * Use correct apigroup for network policy * Docs changes to PR #4092 (#4224) * Docs changes to PR #4092 * address feedback * add doc for --as-group in cli Add doc for this pr: kubernetes/kubernetes#43696

Add task for setting up placement policies

caf813f

k8s-ci-robot requested review from nikhiljindal and a user June 14, 2017 02:12

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jun 14, 2017

tsandall changed the title ~~Add task for setting up placement policies~~ Federation: Add task for setting up placement policies Jun 14, 2017

k8s-github-robot assigned janetkuo Jun 14, 2017

chenopis added this to the 1.7 milestone Jun 14, 2017

Update version of management sidecar in policy engine deployment

c100724

nikhiljindal reviewed Jun 14, 2017

View reviewed changes

Address @nikhiljindal's comments

55cab44

- Lower case filenames - Comments in policy - Typo fixes - Removed type LoadBalancer from OPA Service

janetkuo added Needs Docs Review labels Jun 16, 2017

janetkuo assigned nikhiljindal and ghost and unassigned janetkuo Jun 16, 2017

tsandall mentioned this pull request Jun 16, 2017

Policy-based Federated Resource Placement kubernetes/enhancements#250

Closed

nikhiljindal reviewed Jun 19, 2017

View reviewed changes

k8s-ci-robot added the sig/federation label Jun 19, 2017

chenopis added kind/feature and removed Needs Tech Review labels Jun 19, 2017

chenopis suggested changes Jun 21, 2017

View reviewed changes

chenopis added Docs Review: Open Issues and removed Needs Docs Review labels Jun 21, 2017

tsandall added 2 commits June 23, 2017 08:52

Add example that sets cluster selector

d966a30

Per-@nikhiljindal's suggestion

Fix wording and templating per @chenopis

d03e9c1

chenopis self-assigned this Jun 23, 2017

chenopis added Docs LGTM and removed Docs Review: Open Issues labels Jun 23, 2017

chenopis approved these changes Jun 23, 2017

View reviewed changes

k8s-ci-robot added the lgtm label Jun 23, 2017

nikhiljindal reviewed Jun 26, 2017

View reviewed changes

chenopis merged commit 5825ea1 into kubernetes:release-1.7 Jun 26, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Federation: Add task for setting up placement policies #4075

Federation: Add task for setting up placement policies #4075

tsandall commented Jun 14, 2017 •

edited by k8s-reviewable

Loading

nikhiljindal Jun 14, 2017

tsandall Jun 15, 2017

nikhiljindal Jun 14, 2017

tsandall Jun 15, 2017

nikhiljindal Jun 14, 2017

tsandall Jun 15, 2017

nikhiljindal Jun 14, 2017

tsandall Jun 15, 2017

nikhiljindal Jun 14, 2017

tsandall Jun 15, 2017

nikhiljindal Jun 14, 2017

tsandall Jun 15, 2017

tsandall commented Jun 15, 2017

nikhiljindal Jun 19, 2017

nikhiljindal commented Jun 19, 2017

chenopis left a comment •

edited

Loading

chenopis Jun 20, 2017

chenopis Jun 20, 2017

chenopis Jun 21, 2017

chenopis Jun 21, 2017

chenopis commented Jun 22, 2017

tsandall commented Jun 23, 2017

chenopis commented Jun 23, 2017

chenopis commented Jun 26, 2017

nikhiljindal Jun 26, 2017

nikhiljindal commented Jun 26, 2017


		{% capture objectives %}

		* Deploying Federation and configuring an exteranl policy engine


		{% capture overview %}

		This page shows you can enforce policy-based placement decisions over Federated


		{% capture overview %}

		This page shows how to policy-based placement decisions over Federated

Federation: Add task for setting up placement policies #4075

Federation: Add task for setting up placement policies #4075

Conversation

tsandall commented Jun 14, 2017 • edited by k8s-reviewable Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tsandall commented Jun 15, 2017

Choose a reason for hiding this comment

nikhiljindal commented Jun 19, 2017

chenopis left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chenopis commented Jun 22, 2017

tsandall commented Jun 23, 2017

chenopis commented Jun 23, 2017

chenopis commented Jun 26, 2017

Choose a reason for hiding this comment

nikhiljindal commented Jun 26, 2017

tsandall commented Jun 14, 2017 •

edited by k8s-reviewable

Loading

chenopis left a comment •

edited

Loading