forked from kubernetes-sigs/scheduler-plugins
-
Notifications
You must be signed in to change notification settings - Fork 1
/
all-in-one.yaml
100 lines (100 loc) · 2.97 KB
/
all-in-one.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# First part
# Apply extra privileges to system:kube-scheduler.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: system:kube-scheduler:plugins
rules:
- apiGroups: ["scheduling.x-k8s.io"]
resources: ["podgroups", "elasticquotas", "podgroups/status", "elasticquotas/status"]
verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
# for network-aware plugins add the following lines (scheduler-plugins v.0.24.9)
#- apiGroups: [ "appgroup.diktyo.k8s.io" ]
# resources: [ "appgroups" ]
# verbs: [ "get", "list", "watch", "create", "delete", "update", "patch" ]
#- apiGroups: [ "networktopology.diktyo.k8s.io" ]
# resources: [ "networktopologies" ]
# verbs: [ "get", "list", "watch", "create", "delete", "update", "patch" ]
#- apiGroups: ["security-profiles-operator.x-k8s.io"]
# resources: ["seccompprofiles", "profilebindings"]
# verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: system:kube-scheduler:plugins
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:kube-scheduler:plugins
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: system:kube-scheduler
---
# Second part
# Install the controller image.
apiVersion: v1
kind: Namespace
metadata:
name: scheduler-plugins
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: scheduler-plugins-controller
namespace: scheduler-plugins
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: scheduler-plugins-controller
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list", "watch"]
- apiGroups: ["scheduling.x-k8s.io"]
resources: ["podgroups", "elasticquotas", "podgroups/status", "elasticquotas/status"]
verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch", "update"]
#- apiGroups: ["security-profiles-operator.x-k8s.io"]
# resources: ["seccompprofiles", "profilebindings"]
# verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: scheduler-plugins-controller
subjects:
- kind: ServiceAccount
name: scheduler-plugins-controller
namespace: scheduler-plugins
roleRef:
kind: ClusterRole
name: scheduler-plugins-controller
apiGroup: rbac.authorization.k8s.io
---
kind: Deployment
apiVersion: apps/v1
metadata:
name: scheduler-plugins-controller
namespace: scheduler-plugins
labels:
app: scheduler-plugins-controller
spec:
replicas: 1
selector:
matchLabels:
app: scheduler-plugins-controller
template:
metadata:
labels:
app: scheduler-plugins-controller
spec:
serviceAccountName: scheduler-plugins-controller
containers:
- name: scheduler-plugins-controller
image: registry.k8s.io/scheduler-plugins/controller:v0.27.8
imagePullPolicy: IfNotPresent