Merge pull request #1510 from Juneezee/chore/yaml

chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml`

.gitattributes

@@ -0,0 +1,6 @@
+# Always check-out / check-in files with LF line endings.
+* text=auto eol=lf
+
+go.sum merge=union
+**/zz_generated.*.go linguist-generated=true
+vendor/** linguist-vendored

.github/ci/ct.yaml

@@ -2,5 +2,4 @@ chart-dirs:
   - charts
 helm-extra-args: "--timeout=5m"
 check-version-increment: false
-helm-extra-set-args: "--set=kind=Deployment"
 target-branch: master

.github/workflows/helm.yaml

@@ -8,44 +8,54 @@ on:
     paths:
       - 'charts/**'
       - '.github/workflows/helm.yaml'
+      - '.github/ci/ct.yaml'
   pull_request:
     paths:
       - 'charts/**'
       - '.github/workflows/helm.yaml'
+      - '.github/ci/ct.yaml'
 
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v2.1
+        uses: azure/setup-helm@v4.2.0
         with:
-          version: v3.9.2
+          version: v3.15.1
 
-      - uses: actions/setup-python@v3.1.2
+      - uses: actions/setup-python@v5.1.1
         with:
-          python-version: 3.7
+          python-version: 3.12
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '1.19.0'
+          go-version-file: 'go.mod'
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.2.1
+        uses: helm/chart-testing-action@v2.6.1
         with:
-          version: v3.7.0
+          version: v3.11.0
+
+      - name: Install Helm Unit Test Plugin
+        run: |
+          helm plugin install https://github.com/helm-unittest/helm-unittest
+
+      - name: Run Helm Unit Tests
+        run: |
+          helm unittest charts/descheduler --strict -d
 
       - name: Run chart-testing (list-changed)
         id: list-changed
         run: |
           changed=$(ct list-changed --config=.github/ci/ct.yaml)
           if [[ -n "$changed" ]]; then
-            echo "::set-output name=changed::true"
+            echo "changed=true" >> $GITHUB_OUTPUT
           fi
 
       - name: Run chart-testing (lint)
@@ -57,11 +67,4 @@ jobs:
 
       # helm-extra-set-args only available after ct 3.6.0
       - name: Run chart-testing (install)
-        run: ct install --config=.github/ci/ct.yaml
+        run: ct install --config=.github/ci/ct.yaml --helm-extra-set-args='--set=kind=Deployment'
-
-      - name: E2E after chart install
-        env:
-          KUBERNETES_VERSION: "v1.25.0"
-          KIND_E2E: true
-          SKIP_INSTALL: true
-        run: make test-e2e

.github/workflows/manifests.yaml

@@ -0,0 +1,42 @@
+name: manifests
+
+on:
+  pull_request:
+
+jobs:
+  deploy:
+    strategy:
+      matrix:
+        k8s-version: ["v1.31.0"]
+        descheduler-version: ["v0.30.0"]
+        descheduler-api: ["v1alpha2"]
+        manifest: ["deployment"]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+      - name: Create kind cluster
+        uses: helm/kind-action@v1.10.0
+        with:
+          node_image: kindest/node:${{ matrix.k8s-version }}
+          kubectl_version: ${{ matrix.k8s-version }}
+          config: test/kind-config.yaml
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Build image
+        run: |
+          VERSION="dev" make dev-image
+          docker tag descheduler:dev registry.k8s.io/descheduler/descheduler:${{ matrix.descheduler-version }}
+      - name: Kind load image
+        run: |
+          kind load docker-image registry.k8s.io/descheduler/descheduler:${{ matrix.descheduler-version }} --name chart-testing
+      - name: Create k8s manifests
+        run: |
+          kubectl create -f kubernetes/base/rbac.yaml
+          kubectl create -f test/manifests/${{ matrix.descheduler-api }}/configmap.yaml
+          kubectl create -f kubernetes/${{ matrix.manifest }}/${{ matrix.manifest }}.yaml
+      - name: Wait for ready condition
+        run: |
+          kubectl wait --for=condition=Available --timeout=60s ${{ matrix.manifest }} descheduler -n kube-system

.github/workflows/release.yaml

@@ -20,12 +20,12 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Install Helm
-        uses: azure/setup-helm@v1
+        uses: azure/setup-helm@v4.2.0
         with:
-          version: v3.4.0
+          version: v3.15.1
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.1.0
+        uses: helm/chart-releaser-action@v1.6.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           CR_RELEASE_NAME_TEMPLATE: "descheduler-helm-chart-{{ .Version }}"

.github/workflows/security.yaml

@@ -22,7 +22,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 

.golangci.yml

@@ -1,15 +1,18 @@
 run:
-  deadline: 2m
+  timeout: 2m
 
 linters:
   disable-all: true
   enable:
     - gofmt
+    - gofumpt
     - gosimple
     - gocyclo
     - misspell
     - govet
 
 linters-settings:
+  gofumpt:
+    extra-rules: true
   goimports:
-local-prefixes: sigs.k8s.io/descheduler
+    local-prefixes: sigs.k8s.io/descheduler

Dockerfile

@@ -11,7 +11,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-FROM golang:1.19.0
+FROM golang:1.22.5
 
 WORKDIR /go/src/sigs.k8s.io/descheduler
 COPY . .
@@ -23,6 +23,8 @@ FROM scratch
 
 MAINTAINER Kubernetes SIG Scheduling <kubernetes-sig-scheduling@googlegroups.com>
 
+LABEL org.opencontainers.image.source https://github.com/kubernetes-sigs/descheduler
+
 USER 1000
 
 COPY --from=0 /go/src/sigs.k8s.io/descheduler/_output/bin/descheduler /bin/descheduler

Makefile

@@ -26,9 +26,14 @@ ARCHS = amd64 arm arm64
 
 LDFLAGS=-ldflags "-X ${LDFLAG_LOCATION}.version=${VERSION} -X ${LDFLAG_LOCATION}.buildDate=${BUILD} -X ${LDFLAG_LOCATION}.gitbranch=${BRANCH} -X ${LDFLAG_LOCATION}.gitsha1=${SHA1}"
 
-GOLANGCI_VERSION := v1.49.0
+GOLANGCI_VERSION := v1.60.3
 HAS_GOLANGCI := $(shell ls _output/bin/golangci-lint 2> /dev/null)
 
+GOFUMPT_VERSION := v0.7.0
+HAS_GOFUMPT := $(shell command -v gofumpt 2> /dev/null)
+
+GO_VERSION := $(shell (command -v jq > /dev/null && (go mod edit -json | jq -r .Go)) || (sed -En 's/^go (.*)$$/\1/p' go.mod))
+
 # REGISTRY is the container registry to push
 # into. The default is to push to the staging
 # registry, not production.
@@ -40,6 +45,10 @@ IMAGE:=descheduler:$(VERSION)
 # IMAGE_GCLOUD is the image name of descheduler in the remote registry
 IMAGE_GCLOUD:=$(REGISTRY)/descheduler:$(VERSION)
 
+# CURRENT_DIR is the current dir where the Makefile exists
+CURRENT_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+
+
 # TODO: upload binaries to GCS bucket
 #
 # In the future binaries can be uploaded to
@@ -97,7 +106,7 @@ clean:
 	rm -rf _output
 	rm -rf _tmp
 
-verify: verify-govet verify-spelling verify-gofmt verify-vendor lint lint-chart verify-toc verify-gen
+verify: verify-govet verify-spelling verify-gofmt verify-vendor lint lint-chart verify-gen
 
 verify-govet:
 	./hack/verify-govet.sh
@@ -111,8 +120,8 @@ verify-gofmt:
 verify-vendor:
 	./hack/verify-vendor.sh
 
-verify-toc:
+verify-docs:
-	./hack/verify-toc.sh
+	./hack/verify-docs.sh
 
 test-unit:
 	./test/run-unit-tests.sh
@@ -124,12 +133,16 @@ gen:
 	./hack/update-generated-conversions.sh
 	./hack/update-generated-deep-copies.sh
 	./hack/update-generated-defaulters.sh
-	./hack/update-toc.sh
+	./hack/update-docs.sh
+
+gen-docker:
+	$(CONTAINER_ENGINE) run --entrypoint make -it -v $(CURRENT_DIR):/go/src/sigs.k8s.io/descheduler -w /go/src/sigs.k8s.io/descheduler golang:$(GO_VERSION) gen
 
 verify-gen:
 	./hack/verify-conversions.sh
 	./hack/verify-deep-copies.sh
 	./hack/verify-defaulters.sh
+	./hack/verify-docs.sh
 
 lint:
 ifndef HAS_GOLANGCI
@@ -137,6 +150,12 @@ ifndef HAS_GOLANGCI
 endif
 	./_output/bin/golangci-lint run
 
+fmt:
+ifndef HAS_GOFUMPT
+	go install mvdan.cc/gofumpt@${GOFUMPT_VERSION}
+endif
+	gofumpt -w -extra .
+
 # helm
 
 ensure-helm-install:

OWNERS

@@ -3,6 +3,7 @@ approvers:
 - ingvagabund
 - seanmalloy
 - a7i
+- knelasevero
 reviewers:
 - damemi
 - seanmalloy
@@ -10,6 +11,8 @@ reviewers:
 - lixiang233
 - a7i
 - janeliul
+- knelasevero
+- jklaw90
 emeritus_approvers:
 - aveshagarwal
 - k82cn

charts/descheduler/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: descheduler
-version: 0.25.0
+version: 0.30.1
-appVersion: 0.25.0
+appVersion: 0.30.1
 description: Descheduler for Kubernetes is used to rebalance clusters by evicting pods that can potentially be scheduled on better nodes. In the current implementation, descheduler does not schedule replacement of evicted pods but relies on the default scheduler for that.
 keywords:
 - kubernetes

charts/descheduler/README.md

@@ -43,45 +43,50 @@ The command removes all the Kubernetes components associated with the chart and
 
 The following table lists the configurable parameters of the _descheduler_ chart and their default values.
 
-| Parameter                           | Description                                                                                                           | Default                              |
+| Parameter                           | Description                                                                                                           | Default                                   |
-|-------------------------------------|-----------------------------------------------------------------------------------------------------------------------|--------------------------------------|
+| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
-| `kind`                              | Use as CronJob or Deployment                                                                                          | `CronJob`                            |
+| `kind`                              | Use as CronJob or Deployment                                                                                          | `CronJob`                                 |
-| `image.repository`                  | Docker repository to use                                                                                              | `k8s.gcr.io/descheduler/descheduler` |
+| `image.repository`                  | Docker repository to use                                                                                              | `registry.k8s.io/descheduler/descheduler` |
-| `image.tag`                         | Docker tag to use                                                                                                     | `v[chart appVersion]`                |
+| `image.tag`                         | Docker tag to use                                                                                                     | `v[chart appVersion]`                     |
-| `image.pullPolicy`                  | Docker image pull policy                                                                                              | `IfNotPresent`                       |
+| `image.pullPolicy`                  | Docker image pull policy                                                                                              | `IfNotPresent`                            |
-| `imagePullSecrets`                  | Docker repository secrets                                                                                             | `[]`                                 |
+| `imagePullSecrets`                  | Docker repository secrets                                                                                             | `[]`                                      |
-| `nameOverride`                      | String to partially override `descheduler.fullname` template (will prepend the release name)                          | `""`                                 |
+| `nameOverride`                      | String to partially override `descheduler.fullname` template (will prepend the release name)                          | `""`                                      |
-| `fullnameOverride`                  | String to fully override `descheduler.fullname` template                                                              | `""`                                 |
+| `fullnameOverride`                  | String to fully override `descheduler.fullname` template                                                              | `""`                                      |
-| `cronJobApiVersion`                 | CronJob API Group Version                                                                                             | `"batch/v1"`                         |
+| `namespaceOverride`                 | Override the deployment namespace; defaults to .Release.Namespace                                                     | `""`                                      |
-| `schedule`                          | The cron schedule to run the _descheduler_ job on                                                                     | `"*/2 * * * *"`                      |
+| `cronJobApiVersion`                 | CronJob API Group Version                                                                                             | `"batch/v1"`                              |
-| `startingDeadlineSeconds`           | If set, configure `startingDeadlineSeconds` for the _descheduler_ job                                                 | `nil`                                |
+| `schedule`                          | The cron schedule to run the _descheduler_ job on                                                                     | `"*/2 * * * *"`                           |
-| `successfulJobsHistoryLimit`        | If set, configure `successfulJobsHistoryLimit` for the _descheduler_ job                                              | `nil`                                |
+| `startingDeadlineSeconds`           | If set, configure `startingDeadlineSeconds` for the _descheduler_ job                                                 | `nil`                                     |
-| `failedJobsHistoryLimit`            | If set, configure `failedJobsHistoryLimit` for the _descheduler_ job                                                  | `nil`                                |
+| `timeZone`                          | configure `timeZone` for CronJob                                                                                      | `nil`                                     |
-| `deschedulingInterval`              | If using kind:Deployment, sets time between consecutive descheduler executions.                                       | `5m`                                 |
+| `successfulJobsHistoryLimit`        | If set, configure `successfulJobsHistoryLimit` for the _descheduler_ job                                              | `3`                                       |
-| `replicas`                          | The replica count for Deployment                                                                                      | `1`                                  |
+| `failedJobsHistoryLimit`            | If set, configure `failedJobsHistoryLimit` for the _descheduler_ job                                                  | `1`                                       |
-| `leaderElection`                    | The options for high availability when running replicated components                                                  | _see values.yaml_                    |
+| `ttlSecondsAfterFinished`           | If set, configure `ttlSecondsAfterFinished` for the _descheduler_ job                                                 | `nil`                                     |
-| `cmdOptions`                        | The options to pass to the _descheduler_ command                                                                      | _see values.yaml_                    |
+| `deschedulingInterval`              | If using kind:Deployment, sets time between consecutive descheduler executions.                                       | `5m`                                      |
-| `deschedulerPolicy.strategies`      | The _descheduler_ strategies to apply                                                                                 | _see values.yaml_                    |
+| `replicas`                          | The replica count for Deployment                                                                                      | `1`                                       |
-| `priorityClassName`                 | The name of the priority class to add to pods                                                                         | `system-cluster-critical`            |
+| `leaderElection`                    | The options for high availability when running replicated components                                                  | _see values.yaml_                         |
-| `rbac.create`                       | If `true`, create & use RBAC resources                                                                                | `true`                               |
+| `cmdOptions`                        | The options to pass to the _descheduler_ command                                                                      | _see values.yaml_                         |
-| `resources`                         | Descheduler container CPU and memory requests/limits                                                                  | _see values.yaml_                    |
+| `deschedulerPolicy.strategies`      | The _descheduler_ strategies to apply                                                                                 | _see values.yaml_                         |
-| `serviceAccount.create`             | If `true`, create a service account for the cron job                                                                  | `true`                               |
+| `priorityClassName`                 | The name of the priority class to add to pods                                                                         | `system-cluster-critical`                 |
-| `serviceAccount.name`               | The name of the service account to use, if not set and create is true a name is generated using the fullname template | `nil`                                |
+| `rbac.create`                       | If `true`, create & use RBAC resources                                                                                | `true`                                    |
-| `serviceAccount.annotations`        | Specifies custom annotations for the serviceAccount                                                                   | `{}`                                 |
+| `resources`                         | Descheduler container CPU and memory requests/limits                                                                  | _see values.yaml_                         |
-| `podAnnotations`                    | Annotations to add to the descheduler Pods                                                                            | `{}`                                 |
+| `serviceAccount.create`             | If `true`, create a service account for the cron job                                                                  | `true`                                    |
-| `podLabels`                         | Labels to add to the descheduler Pods                                                                                 | `{}`                                 |
+| `serviceAccount.name`               | The name of the service account to use, if not set and create is true a name is generated using the fullname template | `nil`                                     |
-| `nodeSelector`                      | Node selectors to run the descheduler cronjob/deployment on specific nodes                                            | `nil`                                |
+| `serviceAccount.annotations`        | Specifies custom annotations for the serviceAccount                                                                   | `{}`                                      |
-| `service.enabled`                   | If `true`, create a service for deployment                                                                            | `false`                              |
+| `podAnnotations`                    | Annotations to add to the descheduler Pods                                                                            | `{}`                                      |
-| `serviceMonitor.enabled`            | If `true`, create a ServiceMonitor for deployment                                                                     | `false`                              |
+| `podLabels`                         | Labels to add to the descheduler Pods                                                                                 | `{}`                                      |
-| `serviceMonitor.namespace`          | The namespace where Prometheus expects to find service monitors                                                       | `nil`                                |
+| `nodeSelector`                      | Node selectors to run the descheduler cronjob/deployment on specific nodes                                            | `nil`                                     |
-| `serviceMonitor.interval`           | The scrape interval. If not set, the Prometheus default scrape interval is used                                       | `nil`                                |
+| `service.enabled`                   | If `true`, create a service for deployment                                                                            | `false`                                   |
-| `serviceMonitor.honorLabels`        | Keeps the scraped data's labels when labels are on collisions with target labels.                                     | `true`                               |
+| `serviceMonitor.enabled`            | If `true`, create a ServiceMonitor for deployment                                                                     | `false`                                   |
-| `serviceMonitor.insecureSkipVerify` | Skip TLS certificate validation when scraping                                                                         | `true`                               |
+| `serviceMonitor.namespace`          | The namespace where Prometheus expects to find service monitors                                                       | `nil`                                     |
-| `serviceMonitor.serverName`         | Name of the server to use when validating TLS certificate                                                             | `nil`                                |
+| `serviceMonitor.additionalLabels`   | Add custom labels to the ServiceMonitor resource                                                                      | `{}`                                      |
-| `serviceMonitor.metricRelabelings`  | MetricRelabelConfigs to apply to samples after scraping, but before ingestion                                         | `[]`                                 |
+| `serviceMonitor.interval`           | The scrape interval. If not set, the Prometheus default scrape interval is used                                       | `nil`                                     |
-| `serviceMonitor.relabelings`        | RelabelConfigs to apply to samples before scraping                                                                    | `[]`                                 |
+| `serviceMonitor.honorLabels`        | Keeps the scraped data's labels when labels are on collisions with target labels.                                     | `true`                                    |
-| `affinity`                          | Node affinity to run the descheduler cronjob/deployment on specific nodes                                             | `nil`                                |
+| `serviceMonitor.insecureSkipVerify` | Skip TLS certificate validation when scraping                                                                         | `true`                                    |
-| `tolerations`                       | tolerations to run the descheduler cronjob/deployment on specific nodes                                               | `nil`                                |
+| `serviceMonitor.serverName`         | Name of the server to use when validating TLS certificate                                                             | `nil`                                     |
-| `suspend`                           | Set spec.suspend in descheduler cronjob                                                                               | `false`                              |
+| `serviceMonitor.metricRelabelings`  | MetricRelabelConfigs to apply to samples after scraping, but before ingestion                                         | `[]`                                      |
-| `commonLabels`                      | Labels to apply to all resources                                                                                      | `{}`                                 |
+| `serviceMonitor.relabelings`        | RelabelConfigs to apply to samples before scraping                                                                    | `[]`                                      |
-| `livenessProbe`                     | Liveness probe configuration for the descheduler container                                                            | _see values.yaml_                    |
+| `affinity`                          | Node affinity to run the descheduler cronjob/deployment on specific nodes                                             | `nil`                                     |
+| `topologySpreadConstraints`         | Topology Spread Constraints to spread the descheduler cronjob/deployment across the cluster                           | `[]`                                     |
+| `tolerations`                       | tolerations to run the descheduler cronjob/deployment on specific nodes                                               | `nil`                                     |
+| `suspend`                           | Set spec.suspend in descheduler cronjob                                                                               | `false`                                   |
+| `commonLabels`                      | Labels to apply to all resources                                                                                      | `{}`                                      |
+| `livenessProbe`                     | Liveness probe configuration for the descheduler container                                                            | _see values.yaml_                         |

charts/descheduler/templates/NOTES.txt

@@ -1,7 +1,12 @@
 Descheduler installed as a {{ .Values.kind }}.
 
 {{- if eq .Values.kind "Deployment" }}
-{{- if eq .Values.replicas 1.0}}
+{{- if eq (.Values.replicas | int) 1 }}
 WARNING: You set replica count as 1 and workload kind as Deployment however leaderElection is not enabled. Consider enabling Leader Election for HA mode.
 {{- end}}
+{{- if .Values.leaderElection }}
+{{- if and (hasKey .Values.cmdOptions "dry-run") (eq (get .Values.cmdOptions "dry-run") true) }}
+WARNING: You enabled DryRun mode, you can't use Leader Election.
+{{- end}}
+{{- end}}
 {{- end}}

charts/descheduler/templates/_helpers.tpl

@@ -24,6 +24,14 @@ If release name contains chart name it will be used as a full name.
 {{- end -}}
 {{- end -}}
 
+{{/*
+Expand the namespace of the release.
+Allows overriding it for multi-namespace deployments in combined charts.
+*/}}
+{{- define "descheduler.namespace" -}}
+{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
@@ -87,8 +95,10 @@ Leader Election
 {{- if .Values.leaderElection.resourceName }}
 - --leader-elect-resource-name={{ .Values.leaderElection.resourceName }}
 {{- end }}
-{{- if .Values.leaderElection.resourceNamescape }}
+{{/* resource namespace value starts with a typo so keeping resourceNamescape for backwards compatibility */}}
-- --leader-elect-resource-namespace={{ .Values.leaderElection.resourceNamescape }}
+{{- $resourceNamespace := default .Values.leaderElection.resourceNamespace .Values.leaderElection.resourceNamescape -}}
+{{- if $resourceNamespace -}}
+- --leader-elect-resource-namespace={{ $resourceNamespace }}
 {{- end -}}
 {{- end }}
 {{- end }}

charts/descheduler/templates/clusterrole.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     {{- include "descheduler.labels" . | nindent 4 }}
 rules:
-- apiGroups: [""]
+- apiGroups: ["events.k8s.io"]
   resources: ["events"]
   verbs: ["create", "update"]
 - apiGroups: [""]

charts/descheduler/templates/clusterrolebinding.yaml

@@ -12,5 +12,5 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ template "descheduler.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+    namespace: {{ include "descheduler.namespace" . }}
 {{- end -}}

charts/descheduler/templates/configmap.yaml

@@ -1,12 +1,14 @@
+{{- if .Values.deschedulerPolicy }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ template "descheduler.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "descheduler.namespace" . }}
   labels:
     {{- include "descheduler.labels" . | nindent 4 }}
 data:
   policy.yaml: |
-    apiVersion: "descheduler/v1alpha1"
+    apiVersion: "{{ .Values.deschedulerPolicyAPIVersion }}"
     kind: "DeschedulerPolicy"
 {{ toYaml .Values.deschedulerPolicy | trim | indent 4 }}
+{{- end }}

charts/descheduler/templates/cronjob.yaml

@@ -3,7 +3,7 @@ apiVersion: {{ .Values.cronJobApiVersion | default "batch/v1" }}
 kind: CronJob
 metadata:
   name: {{ template "descheduler.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "descheduler.namespace" . }}
   labels:
     {{- include "descheduler.labels" . | nindent 4 }}
 spec:
@@ -21,8 +21,14 @@ spec:
   {{- if .Values.failedJobsHistoryLimit }}
   failedJobsHistoryLimit: {{ .Values.failedJobsHistoryLimit }}
   {{- end }}
+  {{- if .Values.timeZone }}
+  timeZone: {{ .Values.timeZone }}
+  {{- end }}
   jobTemplate:
     spec:
+      {{- if .Values.ttlSecondsAfterFinished }}
+      ttlSecondsAfterFinished: {{ .Values.ttlSecondsAfterFinished }}
+      {{- end }}
       template:
         metadata:
           name: {{ template "descheduler.fullname" . }}
@@ -45,6 +51,14 @@ spec:
           affinity:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- with .Values.topologySpreadConstraints }}
+          topologySpreadConstraints:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if .Values.dnsConfig }}
+          dnsConfig:
+            {{- .Values.dnsConfig | toYaml | nindent 12 }}
+          {{- end }}
           {{- with .Values.tolerations }}
           tolerations:
             {{- toYaml . | nindent 12 }}
@@ -63,31 +77,31 @@ spec:
               image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }}"
               imagePullPolicy: {{ .Values.image.pullPolicy }}
               command:
-                - "/bin/descheduler"
+                {{- toYaml .Values.command | nindent 16 }}
               args:
-                - "--policy-config-file"
+                - --policy-config-file=/policy-dir/policy.yaml
-                - "/policy-dir/policy.yaml"
                 {{- range $key, $value := .Values.cmdOptions }}
-                - {{ printf "--%s" $key | quote }}
+                {{- if ne $value nil }}
-                {{- if $value }}
+                - {{ printf "--%s=%s" $key (toString $value) }}
-                - {{ $value | quote }}
+                {{- else }}
+                - {{ printf "--%s" $key }}
                 {{- end }}
                 {{- end }}
               livenessProbe:
                 {{- toYaml .Values.livenessProbe | nindent 16 }}
               resources:
                 {{- toYaml .Values.resources | nindent 16 }}
+              {{- if .Values.securityContext }}
               securityContext:
-                allowPrivilegeEscalation: false
+                {{- toYaml .Values.securityContext | nindent 16 }}
-                capabilities:
+              {{- end }}
-                  drop:
-                    - ALL
-                privileged: false
-                readOnlyRootFilesystem: true
-                runAsNonRoot: true
               volumeMounts:
                 - mountPath: /policy-dir
                   name: policy-volume
+          {{- if .Values.podSecurityContext }}
+          securityContext:
+            {{- toYaml .Values.podSecurityContext | nindent 12 }}
+          {{- end }}
           volumes:
           - name: policy-volume
             configMap:

charts/descheduler/templates/deployment.yaml

@@ -3,11 +3,11 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ template "descheduler.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "descheduler.namespace" . }}
   labels:
     {{- include "descheduler.labels" . | nindent 4 }}
 spec:
-  {{- if gt .Values.replicas 1.0}}
+  {{- if gt (.Values.replicas | int) 1 }}
   {{- if not .Values.leaderElection.enabled }}
   {{- fail "You must set leaderElection to use more than 1 replica"}}
   {{- end}}
@@ -31,29 +31,32 @@ spec:
         {{- .Values.podAnnotations | toYaml | nindent 8 }}
         {{- end }}
     spec:
+      {{- if .Values.dnsConfig }}
+      dnsConfig:
+        {{- .Values.dnsConfig | toYaml | nindent 8 }}
+      {{- end }}
       {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
       {{- end }}
       serviceAccountName: {{ template "descheduler.serviceAccountName" . }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
-      {{- toYaml . | nindent 10 }}
+      {{- toYaml . | nindent 6 }}
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command:
-            - "/bin/descheduler"
+            {{- toYaml .Values.command | nindent 12 }}
           args:
-            - "--policy-config-file"
+            - --policy-config-file=/policy-dir/policy.yaml
-            - "/policy-dir/policy.yaml"
+            - --descheduling-interval={{ required "deschedulingInterval required for running as Deployment" .Values.deschedulingInterval }}
-            - "--descheduling-interval"
-            - {{ required "deschedulingInterval required for running as Deployment" .Values.deschedulingInterval }}
             {{- range $key, $value := .Values.cmdOptions }}
-            - {{ printf "--%s" $key | quote }}
+            {{- if ne $value nil }}
-            {{- if $value }}
+            - {{ printf "--%s=%s" $key (toString $value) }}
-            - {{ $value | quote }}
+            {{- else }}
+            - {{ printf "--%s" $key }}
             {{- end }}
             {{- end }}
             {{- include "descheduler.leaderElection" . | nindent 12 }}
@@ -64,17 +67,17 @@ spec:
             {{- toYaml .Values.livenessProbe | nindent 12 }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          {{- if .Values.securityContext }}
           securityContext:
-            allowPrivilegeEscalation: false
+            {{- toYaml .Values.securityContext | nindent 12 }}
-            capabilities:
+          {{- end }}
-              drop:
-                - ALL
-            privileged: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
           volumeMounts:
             - mountPath: /policy-dir
               name: policy-volume
+      {{- if .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- end }}
       volumes:
         - name: policy-volume
           configMap:
@@ -87,6 +90,10 @@ spec:
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}

charts/descheduler/templates/service.yaml

@@ -6,9 +6,15 @@ metadata:
   labels:
     {{- include "descheduler.labels" . | nindent 4 }}
   name: {{ template "descheduler.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "descheduler.namespace" . }}
 spec:
   clusterIP: None
+  {{- if .Values.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.service.ipFamilies }}
+  ipFamilies: {{ toYaml .Values.service.ipFamilies | nindent 4 }}
+  {{- end }}
   ports:
   - name: http-metrics
     port: 10258

charts/descheduler/templates/serviceaccount.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ template "descheduler.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ include "descheduler.namespace" . }}
   labels:
     {{- include "descheduler.labels" . | nindent 4 }}
 {{- if .Values.serviceAccount.annotations }}

charts/descheduler/templates/servicemonitor.yaml

@@ -7,11 +7,14 @@ metadata:
   namespace: {{ .Values.serviceMonitor.namespace | default .Release.Namespace }}
   labels:
     {{- include "descheduler.labels" . | nindent 4 }}
+    {{- if .Values.serviceMonitor.additionalLabels }}
+    {{- toYaml .Values.serviceMonitor.additionalLabels | nindent 4 }}
+    {{- end }}
 spec:
   jobLabel: jobLabel
   namespaceSelector:
     matchNames:
-    - {{ .Release.Namespace }}
+    - {{ include "descheduler.namespace" . }}
   selector:
     matchLabels:
       {{- include "descheduler.selectorLabels" . | nindent 6 }}

charts/descheduler/tests/.gitignore

@@ -0,0 +1 @@
+__snapshot__

charts/descheduler/tests/cronjob_test.yaml

@@ -0,0 +1,17 @@
+suite: Test Descheduler CronJob
+
+templates:
+  - "*.yaml"
+
+release:
+  name: descheduler
+
+set:
+  kind: CronJob
+
+tests:
+  - it: creates CronJob when kind is set
+    template: templates/cronjob.yaml
+    asserts:
+      - isKind:
+          of: CronJob

charts/descheduler/tests/deployment_test.yaml

@@ -0,0 +1,49 @@
+suite: Test Descheduler Deployment
+
+templates:
+  - "*.yaml"
+
+release:
+  name: descheduler
+
+set:
+  kind: Deployment
+
+tests:
+  - it: creates Deployment when kind is set
+    template: templates/deployment.yaml
+    asserts:
+      - isKind:
+          of: Deployment
+  
+  - it: enables leader-election
+    set:
+      leaderElection:
+        enabled: true
+    template: templates/deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --leader-elect=true
+
+  - it: support leader-election resourceNamespace
+    set:
+      leaderElection:
+        enabled: true
+        resourceNamespace: test
+    template: templates/deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --leader-elect-resource-namespace=test
+
+  - it: support legacy leader-election resourceNamescape
+    set:
+      leaderElection:
+        enabled: true
+        resourceNamescape: typo
+    template: templates/deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --leader-elect-resource-namespace=typo

charts/descheduler/values.yaml

@@ -6,7 +6,7 @@
 kind: CronJob
 
 image:
-  repository: k8s.gcr.io/descheduler/descheduler
+  repository: registry.k8s.io/descheduler/descheduler
   # Overrides the image tag whose default is the chart version
   tag: ""
   pullPolicy: IfNotPresent
@@ -22,9 +22,26 @@ resources:
   #   cpu: 100m
   #   memory: 128Mi
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  privileged: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+
+# podSecurityContext -- [Security context for pod](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
+podSecurityContext: {}
+  # fsGroup: 1000
+
 nameOverride: ""
 fullnameOverride: ""
 
+# -- Override the deployment namespace; defaults to .Release.Namespace
+namespaceOverride: ""
+
 # labels that'll be applied to all resources
 commonLabels: {}
 
@@ -32,8 +49,10 @@ cronJobApiVersion: "batch/v1"
 schedule: "*/2 * * * *"
 suspend: false
 # startingDeadlineSeconds: 200
-# successfulJobsHistoryLimit: 1
+# successfulJobsHistoryLimit: 3
 # failedJobsHistoryLimit: 1
+# ttlSecondsAfterFinished 600
+# timeZone: Etc/UTC
 
 # Required when running as a Deployment
 deschedulingInterval: 5m
@@ -46,6 +65,7 @@ replicas: 1
 
 # Specifies whether Leader Election resources should be created
 # Required when running as a Deployment
+# NOTE: Leader election can't be activated if DryRun enabled
 leaderElection: {}
 #  enabled: true
 #  leaseDuration: 15s
@@ -53,51 +73,76 @@ leaderElection: {}
 #  retryPeriod: 2s
 #  resourceLock: "leases"
 #  resourceName: "descheduler"
-#  resourceNamescape: "kube-system"
+#  resourceNamespace: "kube-system"
+
+command:
+- "/bin/descheduler"
 
 cmdOptions:
   v: 3
 
+# Recommended to use the latest Policy API version supported by the Descheduler app version
+deschedulerPolicyAPIVersion: "descheduler/v1alpha2"
+
+# deschedulerPolicy contains the policies the descheduler will execute.
+# To use policies stored in an existing configMap use:
+# NOTE: The name of the cm should comply to {{ template "descheduler.fullname" . }}
+# deschedulerPolicy: {}
 deschedulerPolicy:
   # nodeSelector: "key1=value1,key2=value2"
   # maxNoOfPodsToEvictPerNode: 10
   # maxNoOfPodsToEvictPerNamespace: 10
   # ignorePvcPods: true
   # evictLocalStoragePods: true
-  strategies:
+  # evictDaemonSetPods: true
-    RemoveDuplicates:
+  # tracing:
-      enabled: true
+  #   collectorEndpoint: otel-collector.observability.svc.cluster.local:4317
-    RemovePodsHavingTooManyRestarts:
+  #   transportCert: ""
-      enabled: true
+  #   serviceName: ""
-      params:
+  #   serviceNamespace: ""
-        podsHavingTooManyRestarts:
+  #   sampleRate: 1.0